LOG MESSAGE GROUPING APPARATUS, LOG MESSAGE GROUPING SYSTEM, AND LOG MESSAGE GROUPING METHOD

• US 20180203757A1
• Filed: 01/08/2018
• Published: 07/19/2018
• Est. Priority Date: 01/16/2017
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: AKUNE, Ken, OZAWA, Yoji, KINOSHITA, Junji
• Granted Patent: US 10,579,461 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/0784 Routing of error reports, e.g. with a specific transmission path or data flow
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/2268 Logging of test results
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence

Abstract

A log message grouping apparatus calculates a coincidence degree evaluation value E1 representing the degree of coincidence between minority words, which are relatively low occurrence frequency words, out of the words that form a log message and minority words in another log message. The log message grouping apparatus further calculates an occurrence degree evaluation value E2 representing the degree of occurrence of the combination of a classification value of a log message and the classification value of a past log message on the basis of the occurrence frequency of the combination of the classification values and calculates an association degree evaluation value E3 representing the degree of association between the log message and the past log message on the basis of the coincidence degree evaluation value E1 and the occurrence degree evaluation value E2.

Claims

1. A log message grouping apparatus comprising a processor, the log message grouping apparatus being characterized in that the processor is configured to

(a) collect a log that records a plurality of log messages,

(b) acquire the plurality of log messages from the log,

(c) acquire an occurrence frequency of each word that forms a first log message from word-occurrence frequency association information that is created based on the plurality of log messages contained in the log and stores each word contained in the plurality of log messages and the occurrence frequency of the word with the word and the occurrence frequency associated with each other,

(d) store, in log-word association information, the first log message and a word that is one of words that form the first log message and occurs by a frequency smaller than a predetermined occurrence frequency determination threshold with the first log message and the word as a minority word associated with each other,

(e) acquire the minority word contained in a second log message earlier than the first log message from the log-word association information, and

(f) calculate a first evaluation value that is an evaluation value representing a degree of coincidence between the minority word contained in the first log message and the minority word contained in the second log message.

2. The log message grouping apparatus according to claim 1, characterized in that the processor is configured to

(g) produce a classification value that is information that identifies the first log message and is determined based on the occurrence frequency of each word that forms the first log message,

(h) store, in the log-word association information, the first log message and the classification value of the first log message with the first log message and the classification value associated with each other,

(i) acquire the classification value of the second log message determined based on the occurrence frequency of each word that forms the second log message,

(j) acquire the occurrence frequency of a combination of the classification value of the first log message and the classification value of the second log message from classification value-occurrence frequency association information that is created based on the plurality of log messages contained in the log and stores the combination of the classification values of the log messages determined based on the occurrence frequency of each word that forms each of the log messages and the occurrence frequency of the combination with the combination and the occurrence frequency associated with each other,

(k) calculate a second evaluation value that is an evaluation value representing a degree of occurrence of the combination of the classification value of the first log message and the classification value of the second log message based on the occurrence frequency of the combination acquired from the classification value-occurrence frequency association information, and

(l) calculate a third evaluation value that is an evaluation value representing a degree of association between the first log message and the second log message based on the first evaluation value and the second evaluation value.

3. The log message grouping apparatus according to claim 1, characterized in that the processor is configured to

(m) create the word-occurrence frequency association information, which stores each word contained in the plurality of log messages and the occurrence frequency of the word with the word and the occurrence frequency associated with each other.

4. The log message grouping apparatus according to claim 2, characterized in that the processor is configured to

(n) create the classification value-occurrence frequency association information, which stores the combination of the classification value of the first log message and the classification value of the second log message and the occurrence frequency of the combination with the combination and the occurrence frequency associated with each other.

5. The log message grouping apparatus according to claim 2, characterized in that the processor is configured to

(o) store, in log-group association information, the first log message and the second log message with the first log message and the second log message associated with each other as a group based on any of the first to third evaluation values.

6. The log message grouping apparatus according to claim 5, characterized in that the processor is configured to

(p) upon acceptance of a request that requests information on a log message, acquire a log message different from but associated with as a group a log message contained in the request from the log-group association information and output a response containing the different log message in response to the request.

7. The log message grouping apparatus according to claim 6, characterized in that

the request contains information representing a condition relating to any of the first to third evaluation values, and the processor is configured to

(p′

) acquire a log message different from but associated with as a group the log message contained in the request and satisfying the condition from the log-group association information and output a response containing the different log message in response to the request.

8. A log message grouping system, characterized by comprising:

one or multiple information systems each configured to output a log that records a log message;

a log message grouping apparatus configured to collect the logs and associate the log messages with one another as a group; and

a management terminal configured to acquire information on the log messages associated with one another as a group from the log message grouping apparatus, wherein

the log message grouping apparatus is formed of the log message grouping apparatus according to claim 7.

9. A log message grouping method, characterized in that

a processor is configured to

(a) collect a log that records a plurality of log messages,

(b) acquire the plurality of log messages from the log,

(c) acquire an occurrence frequency of each word that forms a first log message from word-occurrence frequency association information that is created based on the plurality of log messages contained in the log and stores each word contained in the plurality of log messages and the occurrence frequency of the word with the word and the occurrence frequency associated with each other,

(d) store, in log-word association information, the first log message and a word that is one of words that form the first log message and occurs by a frequency smaller than a predetermined occurrence frequency determination threshold with the first log message and the word as a minority word associated with each other,

(e) acquire the minority word contained in a second log message earlier than the first log message from the log-word association information, and

(f) calculate a first evaluation value that is an evaluation value representing a degree of coincidence between the minority word contained in the first log message and the minority word contained in the second log message.