Method and apparatus for supporting log analysis

• US 7,747,587 B2
• Filed: 06/07/2005
• Issued: 06/29/2010
• Est. Priority Date: 02/28/2005
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Take, Riichiro, Akaboshi, Naoki, Harada, Lilian, Kubota, Kazumi
• Primary Examiner(s): Jalil; Neveen Abel
• Assistant Examiner(s): Chbouki; Tarek
• Application Number:
  US11/146,322
• Publication Number:
  US 20060195297A1
• Time in Patent Office: 1,848 Days
• Field of Search: 707/6
• US Class Current: 707/694
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/95 Retrieval from the web

Abstract

An apparatus for classifying a plurality of logs recorded in a log file includes: a parsing unit that performs a parsing of the logs in the log file; a rule generating unit that generates a rule for a data classification based on a result of the parsing; a data classifying unit that performs the data classification, based on the rule generated, to classify the logs into a plurality of groups; a display unit that displays a result of the data classification; and a rule editing that edits the rules based on an instruction from a user.

Claims

1. A computer-readable recording medium that stores a computer program for classifying a plurality of logs recorded in a log file, wherein the computer program causes a computer to execute:

performing a parsing of the logs in the log file;

generating a rule for a log classification based on a result of the parsing;

performing the log classification, based on the rule generated, to classify the logs into a plurality of groups;

displaying a result of the log classification;

editing the rule based on an instruction from a user, wherein the rule generated includes deleting a first parameter that exists in each of a plurality of first logs, the first logs being included in the logs, and the first logs each including a same program name, replacing a value of a second parameter existing in each of the first logs with a predetermined character string when a number of values of the second parameter is more than a predetermined value, deleting a third parameter that exists in each of the first logs when a number of the first logs is less than a predetermined value, or replacing a variable part of a program name with a predetermined character string, a non-variable part of the program name existing in each of a plurality of second logs, when a number of the second logs is more than a predetermined value; and

determining whether a distribution of a response time is biased due to a specific combination of a parameter name and a parameter value,

wherein the editing includes editing, when determined that the distribution of the response time is biased due to the specific combination, the rule so that a parameter name and a parameter value other that those included in the specific combination are deleted from the logs.

2. The computer-readable recording medium according to claim 1, wherein the displaying includes displaying a graph that indicates a relationship between number of groups and a predetermined number of logs.

3. The computer-readable recording medium according to claim 1, wherein the displaying includes displaying a diagram that indicates a relationship between a response time and a combination of a parameter name and a parameter value that are included in the logs.

4. The computer-readable recording medium according to claim 1, wherein the displaying includes displaying a histogram that is created for each process corresponding to each of the groups and that indicates a relationship between a response time and number of logs.

5. The computer-readable recording medium according to claim 4, wherein the computer program further causes the computer to execute determining a first histogram that is most similar to a second histogram, the first histogram being created for a first process corresponding to a first group from among the groups, the second histogram being created for a second process corresponding to a second group from among the groups, wherein

the editing includes editing the rule so that the first histogram and the second histogram are merged.

6. An apparatus for classifying a plurality of logs recorded in a log file, the log-analysis-supporting apparatus comprising:

a parsing unit that performs a parsing of the logs in the log file;

a rule generating unit that generates a rule for a log classification based on a result of the parsing;

a log classifying unit that performs the log classification, based on the rule generated, to classify the logs into a plurality of groups;

a display unit that displays a result of the log classification;

a rule editing unit that edits the rules based on an instruction from a user, wherein the rule generated by the rule generating unit includes deleting a first parameter that exists in each of a plurality of first logs, the first logs being included in the logs, and the first logs each including a same program name, replacing a value of a second parameter existing in each of the first logs with a predetermined character string when a number of values of the second parameter is more than a predetermined value, deleting a third parameter that exists in each of the first logs when a number of the first logs is less than a predetermined value, or replacing a variable part of a program name with a predetermined character string, a non-variable part of the program name existing in each of a plurality of second logs, when a number of the second logs is more than a predetermined value; and

a determining unit that determines whether a distribution of a response time is biased due to a specific combination of a parameter name and a parameter value,

wherein the editing includes editing, when determined that the distribution of the response time is biased due to the specific combination, the rule so that a parameter name and a parameter value other that those included in the specific combination are deleted from the logs.

7. The apparatus according to claim 6, wherein the display unit displays a graph that indicates a relationship between number of groups and a predetermined number of logs.

8. The apparatus according to claim 6, wherein the display unit displays a diagram that indicates a relationship between a response time and a combination of a parameter name and a parameter value that are included in the logs.

9. The apparatus according to claim 6, wherein the display unit displays a histogram that is created for each process corresponding to each of the groups and that indicates a relationship between a response time and number of logs.

10. The apparatus according to claim 9, further comprising a determining unit that determines a first histogram that is most similar to a second histogram, the first histogram being created for a first process corresponding to a first group from among the groups, the second histogram being created for a second process corresponding to a second group from among the groups, wherein

the editing unit edits the rule so that the first histogram and the second histogram are merged.

11. A method performed by a log-analysis-supporting system for classifying a plurality of logs recorded in a log file, the method comprising:

performing a parsing of the logs in the log file;

generating a rule for a log classification based on a result of the parsing;

performing the log classification, based on the rule generated, to classify the logs into a plurality of groups;

displaying a result of the log classification;

editing the rule based on an instruction from a user, wherein the rule generated includes deleting a first parameter that exists in each of a plurality of first logs, the first logs being included in the logs, and the first logs each including a same program name, replacing a value of a second parameter existing in each of the first logs with a predetermined character string when a number of values of the second parameter is more than a predetermined value, deleting a third parameter that exists in each of the first logs when a number of the first logs is less than a predetermined value, or replacing a variable part of a program name with a predetermined character string, a non-variable part of the program name existing in each of a plurality of second logs, when a number of the second logs is more than a predetermined value; and

determining whether a distribution of a response time is biased due to a specific combination of a parameter name and a parameter value,

wherein the editing includes editing, when determined that the distribution of the response time is biased due to the specific combination, the rule so that a parameter name and a parameter value other that those included in the specific combination are deleted from the logs.

12. The method according to claim 11, wherein the displaying includes displaying a graph that indicates a relationship between number of groups and a predetermined number of logs.

13. The method according to claim 11, wherein the displaying includes displaying a diagram that indicates a relationship between a response time and a combination of a parameter name and a parameter value that are included in the logs.

14. The method according to claim 11, wherein the displaying includes displaying a histogram that is created for each process corresponding to each of the groups and that indicates a relationship between a response time and number of logs.

15. The method according to claim 14, further comprising determining a first histogram that is most similar to a second histogram, the first histogram being created for a first process corresponding to a first group from among the groups, the second histogram being created for a second process corresponding to a second group from among the groups, wherein

the editing includes editing the rule so that the first histogram and the second histogram are merged.