Log analysis method and recording medium storing log analysis program

• US 20030125904A1
• Filed: 12/27/2002
• Published: 07/03/2003
• Est. Priority Date: 12/28/2001
• Status: Active Grant

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Okamoto, Wataru, Hirayama, Masayuki, Tamura, Humitaka, Ueki, Katsuhiko
• Granted Patent: US 6,865,508 B2
• Time in Patent Office: Days
• US Class Current: 702/181
• CPC Class Codes: G06F 11/3616 using software metrics

Abstract

One of log analysis methods of the present invention comprises the step of executing a program a plurality of times; executing a program a plurality of times; the step of generating a plurality of logs, each log being recorded a plurality of events occurring upon the execution of the program according to an occurrence order of each of the events in each of the logs; the step of performing a first calculation to calculate an event occurrence probability, for the occurrence order of each event, based on at least one from the program description concerning each event recorded in the logs and the data to be used upon the execution of the program description; and the step of outputting information concerning an event which corresponds to a characteristic included in the logs, based on the event occurrence probability.

Claims

1. A log analysis method comprising:

executing a program a plurality of times;

generating a plurality of logs, each log being recorded a plurality of events occurring upon the execution of the program according to an occurrence order of each of the events in each of the logs;

performing a first calculation to calculate an event occurrence probability, for the occurrence order of each event, based on at least one from the program description concerning each event recorded in the logs and the data to be used upon the execution of the program description; and

outputting information concerning an event which corresponds to a characteristic included in the logs, based on the event occurrence probability.

2. The log analysis method of claim 1 further comprising:

calculating rarity, indicating a level of an occurrence frequency of each event, for the occurrence order of each event, based on each calculated event occurrence probability; and

outputting information concerning an event which corresponds to a characteristic included in the logs, based on the calculated rarity.

3. The log analysis method of claim 1 further comprising:

generating an event row in which a plurality of events are recorded according to the occurrence order of each of the plurality of events, based on events recorded in each of the plurality of logs;

comparing each event recorded in the event row with each event recorded in each of the logs respectively;

converting each of the logs into converted log respectively, based on result of the comparison;

calculating an event occurrence probability for the occurrence order of each event, based on each program description concerning each event recorded in each of the converted logs;

calculating rarity, indicating a level of an occurrence frequency of each event, for the occurrence order of each event based on each calculated event occurrence probability; and

performing a first judgment to judge as to whether or not a characteristic is included in the converted logs, based on each calculated rarity;

wherein the first calculation is performed based on a judgment result of the first judgment.

4. The log analysis method of claim 2 further comprising:

generating an event row in which a plurality of events are recorded according to the occurrence order of each of the plurality of events, based on events recorded in each of the plurality of logs;

comparing each event recorded in the event row with each event recorded in each of the logs respectively;

converting each of the logs into converted log respectively, based on result of the comparison;

calculating an event occurrence probability for the occurrence order of each event, based on each program description concerning each event recorded in each of the converted logs;

calculating rarity, indicating a level of an occurrence frequency of each event, for the occurrence order of each event, based on each calculated event occurrence probability; and

performing a first judgment to judge as to whether or not a characteristic is included in the converted logs, based on each calculated rarity;

wherein the first calculation is performed based on a judgment result of the first judgment.

5. The log analysis method of claim 3 further comprising:

calculating a characteristic value of a converted log indicating the degree, from among a plurality of converted logs, the converted log may contain a distinguishing characteristic, for each converted log; and

outputting the characteristic value of each converted log.

6. The log analysis method of claim 4 further comprising:

calculating a characteristic value of a converted log indicating the degree, from among a plurality of converted logs, the converted log may contain a distinguishing characteristic, for each converted log; and

outputting the characteristic value of each converted log.

7. A log analysis method configured to analyze a log in which a series of events occurring upon execution of a program are recorded according to an occurrence order of each of the events, the log analysis method comprising:

classifying each event based on a reference to a memory area being performed upon execution of a program description corresponding to the each event;

generating a classified log, in each of which one or more events classified as event concerning the reference to the memory area, are recorded according to the occurrence order of each event, for each memory area;

generating an event row in which a plurality of events are recorded according to the occurrence order of each of the plurality of events, based on events recorded in each of the plurality of classified logs;

comparing each event recorded in the event row with each event recorded in each of the classified logs respectively;

converting each of the classified logs into converted log respectively, based on result of the comparison;

calculating an event occurrence probability for the occurrence order of each event, based on each program description concerning each event recorded in each of the converted logs;

calculating rarity, indicating a level of an occurrence frequency of each event, for the occurrence order of each event based on each calculated event occurrence probability; and

outputting information concerning the event which corresponds to a characteristic included in the converted logs, based on each calculated rarity.

8. The log analysis method of claim 7 further comprising:

calculating a characteristic value of a converted log indicating the degree, from the plurality of converted logs, the converted log may contain a distinguishing characteristic, for each converted log; and

outputting the characteristic value of each converted log.

9. A computer-readable recording medium storing a log analysis program configured to analyze a log by controlling a computer, the log analysis program causing a computer to execute a process comprising:

executing a program a plurality of times;

generating a plurality of logs, each log being recorded a plurality of events occurring upon the execution of the program according to an occurrence order of each of the events in each of the logs;

performing a first calculation to calculate an event occurrence probability, for the occurrence order of each event, based on at least one from the program description concerning each event recorded in the logs and the data to be used upon the execution of the program description; and

outputting information concerning an event which corresponds to a characteristic included in the logs, based on the event occurrence probability.

10. The computer-readable recording medium of claim 9 storing the log analysis program, the log analysis program further causing the computer to execute a process comprising:

calculating rarity, indicating a level of an occurrence frequency of each event, for the occurrence order of each event, based on each calculated event occurrence probability; and

outputting information concerning an event which corresponds to a characteristic included in the logs, based on the calculated rarity.

11. The computer-readable recording medium of claim 9 storing the log analysis program, the log analysis program further causing the computer to execute a process comprising:

generating an event row in which a plurality of events are recorded according to the occurrence order of each of the plurality of events, based on events recorded in each of the plurality of logs;

comparing each event recorded in the event row with each event recorded in each of the logs respectively;

converting each of the logs into converted log respectively, based on result of the comparison;

calculating an event occurrence probability for the occurrence order of each event, based on each program description concerning each event recorded in each of the converted logs;

calculating rarity, indicating a level of an occurrence frequency of each event, for the occurrence order of each event, based on each calculated event occurrence probability; and

performing a first judgment to judge as to whether or not a characteristic is included in the converted logs, based on each calculated rarity;

wherein the first calculation is performed based on a judgment result of the first judgment.

12. The computer-readable recording medium of claim 10 storing the log analysis program, the log analysis program further causing the computer to execute a process comprising:

generating an event row in which a plurality of events are recorded according to the occurrence order of each of the plurality of events, based on events recorded in each of the plurality of logs;

comparing each event recorded in the event row with each event recorded in each of the logs respectively;

converting each of the logs into converted log respectively, based on result of the comparison;

calculating an event occurrence probability for the occurrence order of each event, based on each program description concerning each event recorded in each of the converted logs;

calculating rarity, indicating a level of an occurrence frequency of each event, for the occurrence order of each event, based on each calculated event occurrence probability; and

performing a first judgment to judge as to whether or not a characteristic is included in the converted logs, based on each calculated rarity;

wherein the first calculation is performed based on a judgment result of the first judgment.

13. The computer-readable recording medium of claim 11 storing the log analysis program, the log analysis program further causing the computer to execute a process comprising:

calculating a characteristic value of a converted log indicating the degree, from among a plurality of converted logs, the converted log may contain a distinguishing characteristic, for each converted log; and

outputting the characteristic value of each converted log.

14. The computer-readable recording medium of claim 12 storing the log analysis program, the log analysis program further causing the computer to execute a process comprising:

calculating a characteristic value of a converted log indicating the degree, from among a plurality of converted logs, the converted log may contain a distinguishing characteristic, for each converted log; and

outputting the characteristic value of each converted log.

15. A computer-readable recording medium storing a log analysis program configured to analyze a log by controlling a computer, the log in which a series of events occurring upon execution of a program are recorded according to an occurrence order of each of the events, the log analysis program causing a computer to execute a process comprising:

classifying each event based on a reference to a memory area being performed upon execution of a program description corresponding to the each event;

generating a classified log, in each of which one or more events classified as event concerning the reference to the memory area, are recorded according to the occurrence order of each event, for each memory area;

generating an event row in which a plurality of events are recorded according to the occurrence order of each of the plurality of events, based on events recorded in each of the plurality of classified logs;

comparing each event recorded in the event row with each event recorded in each of the classified logs respectively;

converting each of the classified logs into converted log respectively, based on result of the comparison;

calculating an event occurrence probability for the occurrence order of each event, based on each program description concerning each event recorded in each of the converted logs;

calculating rarity, indicating a level of an occurrence frequency of each event, for the occurrence order of each event, based on each calculated event occurrence probability; and

outputting information concerning the event which corresponds to a characteristic included in the converted logs, based on each calculated rarity.

16. The computer-readable recording medium of claim 15 storing the log analysis program, the log analysis program further causing the computer to execute a process comprising:

calculating a characteristic value of a converted log indicating the degree, from the a plurality of converted logs, the converted log may contain a distinguishing characteristic, for each converted log; and

outputting the characteristic value of each converted log.