Access log analyzer and access log analyzing method

• US 7,216,056 B2
• Filed: 06/12/2002
• Issued: 05/08/2007
• Est. Priority Date: 12/06/2001
• Status: Expired due to Fees

• Current Assignee: C Life Incorporated
• Original Assignee: C Life Incorporated
• Inventors: Kubota, Koji, Ihara, Ikuhiro
• Primary Examiner(s): Barbee; Manuel L.
• Application Number:
  US10/497,689
• Publication Number:
  US 20060085667A1
• Time in Patent Office: 1,791 Days
• Field of Search: 702/179, 702/180, 702/182, 702/183, 702/187, 702/188, 702/10, 702/186, 340/3.1, 340/3.9, 709223-225
• US Class Current: 702/179
• CPC Class Codes: G06F 16/345 Summarisation for human users
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking

Abstract

An access log analyzer extracts significant information from an enormous amount of data of access logs of a Web server so as to appropriately display the result of analysis. The access log analyzer includes an FTP module for acquiring a log from a server to be analyzed, a pre-formatting module for pre-processing the acquired log, a pre-counting module for totaling preformatted data for each monitored item, a main diagnostic statement creating module for creating a main diagnostic statement for the monitored item of the pre-counted data, a sub-diagnostic statement creating module for creating a sub-diagnostic statement for data related to the main diagnostic statement, a diagnostic statement connecting module for connecting the diagnostic statements, and a dispatcher module for managing the execution of each of the modules. The diagnostic statement creating modules have the functions of calculating a Z value for a diagnosed item and then generating a diagnostic statement in a natural language if there is a variation larger than usual with reference to a diagnostic parameter describing a model of a diagnostic statement corresponding to the range of the Z value.

Claims

1. An access log analyzing method comprising the steps of:

acquiring an access log from a server to be analyzed;

totaling the acquired data for each monitored item;

diagnosing an access status of the server based on the totaled data; and

providing the result of diagnosis to a requester of the analysis;

wherein

the diagnosing step includes a step of calculating an amount of variation in target data based on the statistic of data within a predetermined period of time for the monitored item, and a step of creating a diagnostic statement with reference to a diagnostic table defining a model of a corresponding diagnostic statement when a significant variation is detected by the step of calculating the amount of the variation in the target data.

2. The access log analyzing method according to claim 1, wherein the calculating step includes a step of obtaining an average and a dispersion for a specified item within a predetermined period of time in the past and a step of calculating a Z value obtained by normalizing a deviation from an average of the target data with a standard deviation based on the average and the dispersion.

3. The access log analyzing method according to claim 1, wherein the diagnosing step includes a step of calculating an amount of variation in the target data based on the statistic of data within a predetermined period of time for the data related to the created diagnostic statement, and a step of creating a sub-diagnostic statement with reference to a sub-diagnostic table describing a model of a corresponding diagnostic statement when a significant variation is detected by the step of calculation an amount of variation in the target data.

4. The access log analyzing method according to claim 1, wherein the diagnosing step includes a step of connecting a plurality of the created diagnostic statements by using a method for finding out a common directory and a statement connection rule table specifying a connection rule of the diagnostic statements.

5. The access log analyzing method according to claim 1, wherein the diagnosing step includes a step of detecting statistical change tendency in the data within a predetermined period of time, and a step of creating a diagnostic statement with reference to a second diagnostic table describing a model of a corresponding diagnostic statement for the statistical change tendency detected by the detecting step.

6. The access log analyzing method according to claim 1, wherein the totaling step includes a step of pre-formatting to customize the data by a search function using a regular expression.

7. The access log analyzing method according to claim 1, further comprising a step of monitoring mutual dependency of processes of the acquiring step, the totaling step, and the diagnosing step so as to manage the execution.

8. The access log analyzing method according to claim 1, wherein

the totaling step includes a step of classifying visitors into new visitors and repeat visitors based on referrer information and further sorting out frequent visitors from the repeat visitors based on the number of visits and the interval of visits;

and

the providing step includes a step of displaying a rate of the new visitors, the repeat visitors, and the frequent visitors obtained by the classification as visitor information in a graph in different colors.

9. The access log analyzing method according to claim 1, further comprising a step of acquiring license information of the requester of the analysis so as to determine if a service can be provided or not.

10. A computer-readable medium having an access log analyzing program for making a computer execute at least the procedures of:

acquiring an access log from a server to be analyzed;

totaling the acquired data for each monitored item;

diagnosing an access status of the server based on the totaled data; and

providing the result of diagnosis to a requester of the analysis;

wherein

the diagnosing procedure includes a procedure of calculating an amount of variation in target data based on the statistic of data within a predetermined period of time for the monitored item, and a procedure of creating a diagnostic statement with reference to a diagnostic table defining a model of a corresponding diagnostic statement when a significant variation is detected by the procedure of calculating the amount of the variation in the target data.