Computer for gathering log data

• US 6,173,418 B1
• Filed: 04/13/1998
• Issued: 01/09/2001
• Est. Priority Date: 04/18/1997
• Status: Expired due to Term

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Morita, Shinji, Morikawa, Kazuyoshi, Nakano, Hidetomo, Niimura, Miki, Yamada, Mitsugu, Urano, Akihiro, Fujino, Shuji
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): ELISCA, PIERRE E
• Application Number:
  US09/058,890
• Time in Patent Office: 1,002 Days
• Field of Search: 714/15, 714/16, 714/19, 714/20, 714/274, 714/795, 709/212, 709/213, 709/220, 709/223, 709/232
• US Class Current: 714/20
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50

Abstract

A computer for gathering log data includes a device for normalizing the log data by cutting out values corresponding to pre-defined data items from log data in log files of respective computers on the alert and re-arranging the values of data items defined, and storing the normalized log data therein and a device for gathering the stored normalized log data into a computer having a manager function. Further, when the normalized log data have log data output times corrected on the basis of a time of the computer having the manager function, the normalized log data are stored in order of the corrected log data output times.

Claims

1. A computer for gathering log data of said computer, comprising:

first storage means for storing an original log data thereon;

second storage means for storing a format rule that defines normalized data items to be extracted from the original log data;

third storage means for storing a normalized log data;

means for fetching said original log data from the first storage means;

means for extracting a set of character strings from said original log data and identifying each corresponding to said normalized data item to produce said normalized log data, said extracting being performed in accordance with the format rule stored in the second storage means;

means for outputting said normalized log data to the third storage means; and

means for transferring said normalized log data stored in said third storage means to a specific computer.

2. A computer according to claim 1, wherein at least one of said computer and said specific computer includes means for arranging the normalized data items according to a predetermined order.

3. A computer program substantiated on a computer readable storage medium and having an agent function for gathering log data, comprising the following steps of:

(a) extracting a set of character strings from an original log data and identifying each corresponding to a normalized data item defined in a format rule to produce a normalized log data, said extracting being performed in accordance with said format rule;

(b) storing said normalized log data to a storage means; and

(c) transferring the normalized log data from said storage means to a specific computer.

4. A computer program according to claim 3, further including the following step of:

arranging the normalized log data items according to a predetermined order.

5. A computer for gathering log data of said computer, comprising:

first storage means for storing an original log data thereon;

second storage means for storing a format rule that defines normalized data items to be extracted from the original log data;

third storage means for storing a normalized log data;

means for fetching said original log data from the first storage means;

means for extracting a set of character strings from said original log data and identifying each corresponding to said normalized data item to produce said normalized log data, said extracting being performed in accordance with said format rule stored in the second storage means;

means for adding corrected log data output times based on a standardized time;

means for outputting said normalized log data and the corrected log data output times to said third storage means; and

means for transferring said normalized log data from the third storage means to a specific computer.

6. A computer according to claim 5, further including means for deleting the normalized log data when the difference between the corrected times added to the normalized log data and the present time of said specific computer has exceeded a predetermined preservation period.

7. A computer program substantiated on a computer readable storage medium and having an agent function for gathering log data, comprising the following steps of:

(a) extracting a set of character strings from an original log data and identifying each corresponding to a normalized data item defined in a format rule to produce a normalized log data, said extracting being performed in accordance with said format rule;

(b) adding corrected log data output times based on a standardized time;

(c) storing said normalized log data and the corrected log data output times in order to a storage means; and

(d) transferring said normalized log data from said storage means to an external computer.

8. A method for gathering log data of a computer, comprising:

searching an original log data to determine a log classification of the log data and to pick up a set of character strings each as a normalized data item with its normalized name attached in accordance with a definition of a series of the normalized data items;

producing the normalized data item designating the log classification and a set of normalized data items from the set of character strings picked up;

arranging the normalized data items according to a predetermined order to produce a normalized log data;

storing said normalized log data to a storage means; and

transferring said normalized log data from said storage means to an external entity.

9. A method for gathering log data in a computer system having a first computer executing a manager and a second computer executing an agent connected to each other through a network, said method comprising:

said agent correcting log output times recorded on a log data of the second computer by the times based on the manager'"'"'s times;

sending the log data including the corrected log output times from said agent to said manager; and

said manager storing the received log data on a log database of said first computer in order of the corrected log output times.