Log storage device and log storage method

Abstract

To reduce a storage amount of log data.SOLUTION: A collection unit 10 collects log data for a target system 2. A monitoring unit 20 monitors the target system 2 to detect the occurrence of an event. A storage unit 30 stores the collected log data according to a notification of the occurrence of the event from the monitoring unit 20. When the collected log data includes an overlapped part with the log data already stored in the storage unit 30 at the time of the notification, the storage unit 30 stores the residual log data excluding the overlapped part.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a monitoring technique for a target system. [Background technology]

[0002] There are several known techniques for collecting and storing log data indicating the operating status of a target system (see, for example, Patent Documents 1 to 4). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2010-140111 A [Patent Document 2] JP 2006-277078 A [Patent Document 3] Japanese Patent Application Publication No. 7-219818 [Patent Document 4] Japanese Patent Application Publication No. 10-275098 Summary of the Invention [Problem to be solved by the invention]

[0004] It is desirable to keep log data for a long period of time in order to clarify the process by which an event occurred in a target system. However, if many events occur in the target system, the total amount of log data to be kept becomes enormous. [Means for solving the problem]

[0005] In one embodiment, a log storage device includes a collection unit, a monitoring unit, and a storage unit. The collection unit collects log data for a target system. The monitoring unit monitors the target system to detect the occurrence of an event. The storage unit stores the collected log data in response to a notification of the occurrence of an event from the monitoring unit. When the collected log data includes a portion that overlaps with log data already stored in the storage unit at the time of the notification, the storage unit stores the remaining log data excluding the overlapping portion. Effect of the Invention

[0006] According to the above aspect, the amount of log data to be stored can be reduced. [Brief description of the drawings]

[0007] [Figure 1] FIG. 2 illustrates a functional configuration of a log storage device according to an embodiment. [Diagram 2] 2 is a diagram illustrating an overview of the processing performed by each component of the log storage device. FIG. [Diagram 3] FIG. 2 illustrates an example of a table stored in a configuration definition file. [Figure 4] FIG. 2 is a diagram illustrating an example of a directory structure used in a storage. [Diagram 5] 11 is a diagram showing a first example of a correspondence relationship between a log reference information file and a storage status of a log in a storage device; FIG. [Figure 6] 13 is a diagram illustrating a second example of the correspondence relationship between the log reference information file and the storage status of the log in the storage. FIG. [Figure 7] FIG. 13 is a diagram illustrating a third example of the correspondence relationship between a log reference information file and the storage status of logs in storage. [Figure 8] FIG. 13 is a diagram illustrating a fourth example of the correspondence relationship between a log reference information file and the storage status of logs in storage. [Figure 9] 13 is a flowchart showing an example of processing contents of data collection processing. [Figure 10]13 is a flowchart showing an example of a process content of a log update process. [Figure 11] 13 is a flowchart showing an example of a process content of an abnormal event detection process. [Figure 12] 13 is a flowchart showing an example of a process content of a log request process. [Figure 13] 13 is a flowchart illustrating an example of a process content of a log response process. [Figure 14] 13 is a flowchart showing an example of processing contents of a substance log information creating process. [Figure 15] 13 is a flowchart showing an example of a process content of a log reference process. [Figure 16] FIG. 2 is a diagram illustrating an example of a hardware configuration of an information processing device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, the embodiments will be described in detail with reference to the drawings.

[0009] First, a description will be given of Fig. 1. Fig. 1 shows a functional configuration of a log storage device 1 as an example of an embodiment.

[0010] The log storage device 1 is used while being connected to a target system 2. In the example of FIG.

[0011] In the target system 2, various applications and services are provided, and the software executed to provide these applications and services creates log data on various events that occur during execution. The log storage device 1 is a device that stores the log data created in the target system 2.

[0012] In addition, in Figure 1, three log file names, "Log A," "Log B," and "Log C," are displayed as file names for log data created in target system 2, but this display is not intended to limit the log data created to only three.

[0013] The log storage device 1 includes a collection unit 10, a monitoring unit 20, and a storage unit 30.

[0014] The collection unit 10 collects log data about the target system 2.

[0015] The monitoring unit 20 detects the occurrence of an event by monitoring the target system 2. When the monitoring unit 20 detects the occurrence of an event, it notifies the storage unit 30 of the occurrence of the event.

[0016] The storage unit 30 stores the log data collected by the collection unit 10 in response to a notification of the occurrence of an event from the monitoring unit 20. However, in this embodiment, if the collected log data includes a portion that overlaps with log data already stored in the storage unit 30 at the time of the notification, the storage unit 30 stores the remaining log data excluding the overlapping portion.

[0017] Since the storage unit 30 stores the log data in the above manner, the amount of log data to be stored can be reduced according to this embodiment.

[0018] If the collected log data includes a portion that overlaps with already stored log data, the storage unit 30 further stores information that identifies the existing log data that includes the overlapping portion from among the already stored log data. By using this information, it is easy to refer to log data other than the remaining log data (log data of the overlapping portion).

[0019] The outline of the processing performed by each component of the log storage device 1 will be described in further detail with reference to FIG.

[0020] In the following description, as an example of a case where the monitoring unit 20 detects the occurrence of an event that has occurred in the target system 2, a case where the monitoring unit 20 detects the occurrence of an abnormal operation of the target system 2 will be described.

[0021] The data collection process 110 and the log update process 120 are performed by the collection unit 10. The data collection process 110 is a process of collecting log data from the target system 2, assigning a data file name (collected log name) to the collected log data (collected log) and temporarily storing it. The log update process 120 is a process of deleting log data that has been temporarily stored by the data collection process 110 for a predetermined period of time.

[0022] The abnormal event detection process 200 is performed by the monitoring unit 20. This process refers to the log data collected by the collection unit 10 from the target system 2, and constantly monitors whether the log data matches predetermined conditions for the operating state during normal operation of the target system 2. If this monitoring detects that the operating state does not meet the conditions for normal operation, a process of notifying the storage unit 30 of the occurrence of an abnormal operation event in the target system 2 is also performed.

[0023] The abnormality notification message sent to the storage unit 30 by the abnormal event detection process 200 has, for example, the following data structure.

[0024] Anomaly notification: (anomaly identification, anomaly category, anomaly detection date and time)

[0025] Each item in the data structure of this abnormality notification will be described below.

[0026] "Anomaly identification" is information for individually identifying an operational anomaly whose occurrence has been detected. In this embodiment, this information is represented by a character string such as "anomaly identification a", "anomaly identification b", "anomaly identification c", etc.

[0027] The "abnormality category" is information indicating the type of the operational abnormality that has been detected. In this embodiment, Greek letters such as "α", "β", and "γ" are used as this information.

[0028] "Date and time of abnormality detection" is information indicating the date and time when the monitoring unit 20 detected an abnormal operation of the target system 2 (date and time when the event occurred).

[0029] The log request process 300 is performed by the storage unit 30. When an abnormality notification is received from the monitoring unit 20, this process requests the collection unit 10 for log data related to the occurrence of the notified operational abnormality.

[0030] The log request message sent to the collection unit 10 by the log request process 300 has, for example, the following data structure.

[0031] Log Request: (Anomaly identification, start date and time, {collected log name, period}, {collected log name, period}, ...)

[0032] Each item in the data structure of this log request will be explained below.

[0033] “Abnormality identification” is information contained in the abnormality notification from the monitoring unit 20.

[0034] The “start date and time” is information on the same date and time as the abnormality detection date and time included in the abnormality notification from the monitoring unit 20 .

[0035] "Collected log name" is information on the file name of the collected log temporarily saved in the collection unit 10, in which log data to be analyzed for an operational abnormality of the type specified by the abnormality category included in the abnormality notification from the monitoring unit 20 is stored. "Period" is information on the period to be the subject of the analysis among the log data specified by the "Collected log name". The storage unit 30 acquires information on the combination of this "Collected log name" and "Period" by referring to a configuration definition file 31 prepared in advance.

[0036] 3 shows an example of a table stored in the configuration file 31. In this table, a combination of the above-mentioned collected log name and period is associated with each abnormality category.

[0037] For example, the first line of this example table indicates that the analysis of operational abnormalities in the abnormality category "α" will be performed on the log data with the collected log name "Log A" from the time the abnormality occurred until a specified time before (here, "3 hours" before).

[0038] Also, for example, the third and fourth rows of this example table indicate that the analysis targets for operation abnormalities of the abnormality category "γ" are the log data from "2 hours" before the occurrence of the abnormality in "log A" and the log data from "5 hours" before the occurrence of the abnormality in "log B." In this way, when multiple combinations of collected log names and periods are indicated for one abnormality category, information on the multiple combinations is indicated in the log request.

[0039] Returning to the explanation of Fig. 2, the log response process 400 is performed by the collection unit 10. This process is a process of responding to the storage unit 30 with information on the log data requested in the log request sent from the storage unit 30.

[0040] The log response message sent to the storage unit 30 by the log response process 400 has, for example, the following data structure.

[0041] Log response: ({Collected log name, End date and time, Start date and time}, [ <Saved entity log name, log end date and time, log start date and time, entity log data>, … ] ), ({Collected log name, End date and time, Start date and time}, [ <Saved entity log name, log end date and time, log start date and time, entity log data>, … ] )

[0042] Each item in the data structure of this log response will be described below.

[0043] In the combination of {collected log name, end date and time, start date and time}, "collected log name" and "start date and time" are the collected log name and start date and time information indicated in the log request, respectively. Also, "end date and time" is the date and time information that predates the start date and time indicated in the log request by the period indicated in the log request.

[0044] In the combination of <saved entity log name, log end date and time, log start date and time, entity log data>, the "entity log data" is the log data collected by the collection unit 10 from the target system 2, and is the entity (entity log) of the log data to be stored in the storage unit 30. In addition, the remaining combination excluding the "entity log data" from the above combinations, that is, the combination of <saved entity log name, log end date and time, log start date and time>, is referred to as "reference information" in this embodiment.

[0045] The "log end date and time" and "log start date and time" in the reference information are respectively the end date and time (oldest date and time) and start date and time (latest date and time) of the "entity log data" that is referenced going back in time. Furthermore, the "saved entity log name" is information on the log file name that is given to the file of the "entity log data" that is to be stored in the storage unit 30.

[0046] The log response process 400 also includes a process of holding and managing information on this combination as the log reference information file 11. The log reference information file 11 is a file indicating the storage status of the entity log in the storage unit 30, and is used to determine whether the entity log to be stored contains a portion that overlaps with an entity log already stored in the storage unit 30. Here, if it is determined that the entity log contains the overlapping portion, the "entity log data" is excluded from the above combination, leaving only the reference information.

[0047] In the reference information after the exclusion, i.e., the combination of <saved entity log name, log end date and time, log start date and time>, the "saved entity log name" is the log file name of the entity log that contains the overlapping portion and has already been stored in the storage unit 30. Also, the "log end date and time" and the "log start date and time" are information on the end date and time and the start date and time, respectively, of the overlapping portion in the entity log.

[0048] The log response message has the above-mentioned data structure, and indicates the correspondence between the collected logs and the actual logs.

[0049] The above-mentioned log request process 300 performed by the saving unit 30 further includes a process of saving various information included in the log response sent from the collecting unit 10 in the storage 32. In the storage 32, data files that store this information are managed using, for example, a directory structure.

[0050] An example of a directory structure used in the storage 32 is shown in FIG.

[0051] In the storage 32, an "abnormality list" directory is provided as a higher-level directory. An "abnormality identification" directory is placed directly below this "abnormality list" directory. The "abnormality identification" directory is created every time an abnormality notification is received from the monitoring unit 20, and the character string for abnormality identification included in the abnormality notification is used as the directory name.

[0052] In the "anomaly identification" directory, an "anomaly details" file, an "anomaly log" file, and an "entity log" file are placed.

[0053] The “abnormal details” file is a file in which the same information as the abnormality notification received from the monitoring unit 20 is stored.

[0054] The "abnormal log" file is a file that stores information indicating the correspondence between collected logs and actual logs, which are indicated in the log response sent from the collection unit 10. Although details will be described later, when collected log data includes a portion that overlaps with already stored log data, this information is information that identifies the existing log data including the overlapping portion from the already stored log data. This information also includes information indicating the overlapping portion in the existing log data.

[0055] The "substance log" file is a file in which the substance log included in the log response sent from the collection unit 10 is stored. Although details will be described later, if the log data collected by the collection unit 10 includes a portion that overlaps with log data already stored in the storage unit 30, the remaining log data excluding the overlapping portion is included in the log response as a substance log.

[0056] These data files are managed using the above-mentioned directory structure in the storage 32. That is, in the storage 32, information for identifying existing log data and the remaining log data are stored in association with each other.

[0057] Next, a specific example of the operation of storing log data in log storage device 1 will be described.

[0058] [First example of log data saving behavior]

[0059] In the first example, it is assumed that the monitoring unit 20 detects the occurrence of an abnormal operation event in the target system 2 and sends an abnormality notification to the storage unit 30. It is assumed that at this point in time, no actual log for the target system 2 is stored in the storage 32 of the storage unit 30.

[0060] At this time, the abnormality notification sent from the monitoring unit 20 to the storage unit 30 includes the following information as the abnormality identification, abnormality category, and abnormality detection date and time.

[0061] Abnormality notification: (Abnormality identification a, α, 2023 / 01 / 01 04:00)

[0062] 3, and acquires the collected log name "Log A" and the period "3 hours" from the record whose abnormality category is "α." The storage unit 30 creates the following log request using the acquired information and the information on the abnormality identification and the abnormality detection date and time included in the abnormality notification, and sends it to the collection unit 10.

[0063] Log request: (Anomaly identification a, 2023 / 01 / 01 04:00, {Log A, 3 hours})

[0064] When the collection unit 10 receives this log request, it uses the log reference information file 11 to determine whether the entity logs already stored in the storage unit 30 overlap with the entity log requested in the log request.

[0065] As described above, at the time of this determination, no actual logs for the target system 2 are stored in the storage unit 30, so it is determined that no overlapping portion exists.

[0066] At this time, the collection unit 10 reads out the log data between 2023 / 01 / 01 04:00 and 2023 / 01 / 01 01:00, which is three hours before the time, from the temporarily stored collected log "log A", and acquires it as the substance log of "log A". In addition, the collection unit 10 creates a stored substance log name for the acquired substance log. A name that is unique as the stored substance log name is created. That is, the collection unit 10 creates, for example, "anomaly identification a / log A-1", which is a combination of the information of the collected log name and a unique number, and further combines the directory name of the anomaly identification directory in which the substance log is placed, as the stored substance log name.

[0067] The collection unit 10 creates the following log response including each piece of information obtained as described above, and sends it to the storage unit 30.

[0068] Log response: ({Log A, 2023 / 01 / 01 01:00, 2023 / 01 / 01 04:00}, [<Abnormality Identification a / Log A-1, 2023 / 01 / 01 01:00, 2023 / 01 / 01 04:00, (Substance log of "Log A-1")>])

[0069] The storage unit 30, which has received this log response, stores the actual log of "log A-1" included in the log response, and creates and stores an abnormality log file including information about the collected log "log A" included in the log response. The collection unit 10 also adds information about the storage status of the actual log of "log A-1" in the storage unit 30 to the log reference information file 11. The correspondence relationship between the log reference information file 11 and the storage status of the log in the storage 32 of the storage unit 30 at this time is shown in FIG. 5.

[0070] The log reference information file 11 of [A] in Figure 5 shows the same reference information for the entity log “Log A-1” included in the above log response, i.e., the information <Saved entity log name, log end date and time, log start date and time>.

[0071] On the other hand, the storage status [B] in FIG. 5 shows a table included in the "abnormality log" file located in the "abnormality identification a" directory immediately under the "abnormality list" directory of the storage 32.

[0072] The table of this "abnormal log" file has the fields "target log", "log end date and time", "log start date and time", and "substantive log".

[0073] The record in the first row of the table in the "Abnormal Log" file stores information about the collected log included in the log response. That is, the "Target Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information {Collected Log Name, End Date and Time, Start Date and Time} included in the log response. The "Substance Log" field is set to null data.

[0074] Furthermore, the record in the second row of the table of the "abnormal log" file stores reference information for the actual log "log A-1" included in the log response. That is, the "actual log", "log end date and time", and "log start date and time" fields in this record store the information <saved actual log name, log end date and time, log start date and time> related to "log A-1" included in the log response. The "target log" field is set to null data. Furthermore, the data file of the actual log of "log A-1" included in the log response is placed in the "abnormal identification a" directory, the same as the "abnormal log".

[0075] [Second example of log data saving behavior]

[0076] In the second example, assume that one hour after the occurrence of the abnormal operation event detected in the first example described above, the monitoring unit 20 detects the occurrence of a new abnormal operation event in the target system 2, and sends a new abnormality notification about the new event to the storage unit 30.

[0077] At this time, the new abnormality notification sent from the monitoring unit 20 to the storage unit 30 includes the following information as the abnormality identification, abnormality category, and abnormality detection date and time.

[0078] Abnormality notification: (Abnormality identification b, α, 2023 / 01 / 01 05:00)

[0079] 3, and acquires the collected log name "Log A" and the period "3 hours" from the record whose abnormality category is "α." The storage unit 30 creates the following new log request using the acquired information and the information on the abnormality identification and the abnormality detection date and time included in the abnormality notification, and sends it to the collection unit 10.

[0080] Log request: (Anomaly identification b, 2023 / 01 / 01 05:00, {Log A, 3 hours})

[0081] When the collection unit 10 receives this log request, it uses the log reference information file 11 to determine whether there is any overlap between the substance log already stored in the storage unit 30 and the substance log requested in the new log request.

[0082] The above new log request is a request for log data between 2023 / 01 / 01 05:00 and 2023 / 01 / 01 02:00, three hours back from the time, in the collected log "log A". Meanwhile, the log reference information file 11 at this time shows the information of [A] in FIG. 5 described above, which shows that the substance log for the collected log "log A" from 2023 / 01 / 01 04:00 to 2023 / 01 / 01 01:00 has already been stored in the storage unit 30. Therefore, in the above judgment, it is determined that the substance logs for the period between 2023 / 01 / 01 04:00 and 2023 / 01 / 01 02:00 among the substance logs already stored in the storage unit 30 are duplicated.

[0083] At this time, the collection unit 10 reads out the remaining log data between 2023 / 01 / 01 05:00 and 2023 / 01 / 01 04:00, which does not overlap with the entity log already stored in the storage unit 30, from the temporarily stored collected log "log A", and acquires it as the remaining entity log of "log A". In addition, the collection unit 10 creates a stored entity log name for the acquired remaining entity log. That is, the collection unit 10 creates, for example, "anomaly identification b / log A-2", which is a combination of the information of the collected log name and a unique number, and further combines the directory name of the anomaly identification directory in which the entity log is placed, as the stored entity log name.

[0084] At this time, the collection unit 10 also obtains from the log reference information file 11 the stored entity log name “Abnormality Identification a / Log A-1” of the entity log “Log A-1” that has the overlapping portion among the entity logs already stored in the storage unit 30.

[0085] The collection unit 10 creates the following log response including each piece of information obtained as described above, and sends it to the storage unit 30.

[0086] Log response: ({Log A, 2023 / 01 / 01 02:00, 2023 / 01 / 01 05:00}, [<Anomaly Identification b / Log A-2, 2023 / 01 / 01 04:00, 2023 / 01 / 01 05:00, ("Log A-2" substance log)>] [<Anomaly Identification a / Log A-1, 2023 / 01 / 01 02:00, 2023 / 01 / 01 04:00>])

[0087] The storage unit 30, which has received this log response, stores the actual log of "log A-2" included in the log response, and also stores information about the collected log "log A" included in the log response. The collection unit 10 also adds information about the storage status of the actual log of "log A-2" in the storage unit 30 to the log reference information file 11. The correspondence relationship between the log reference information file 11 and the storage status of the log in the storage 32 of the storage unit 30 at this time is shown in FIG. 6.

[0088] The log reference information file 11 of [A] in Fig. 6 is obtained by adding the record on the second line to the one shown in [A] in Fig. 5. This record on the second line shows the same information as the information on the <stored entity log name, log end date and time, log start date and time>, which is the reference information on the entity log "Log A-2" included in the above log response data.

[0089] On the other hand, in the storage status of [B] in Figure 6, a table contained in the "Abnormality Log" file located in the "Abnormality Identification a" directory immediately below the "Abnormality List" directory of storage 32 has been added to the status shown in [B] in Figure 5.

[0090] The record in the first row of the table in this "Abnormal Log" file stores information about the collected log included in the log response, just like the table contained in the "Abnormal Log" file placed in the "Abnormal Identification b" directory. That is, the "Target Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information {Collected Log Name, End Date and Time, Start Date and Time} included in the log response. The "Substance Log" field is set to null data.

[0091] Furthermore, the record in the second row of the table of the "Abnormal Log" file stores reference information for the actual log "Log A-2" included in the log response. That is, the "Actual Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information <Saved Actual Log Name, Log End Date and Time, Log Start Date and Time> related to "Log A-2" included in the log response. The "Target Log" field is set to null data. Furthermore, the data file of the actual log of "Log A-2" included in the log response is placed in the "Abnormal Identification b" directory, the same as the "Abnormal Log".

[0092] Furthermore, the record in the second row of the table in the "Abnormal Log" file stores reference information for the actual log "Log A-1" included in the log response. That is, the "Actual Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information <Saved Actual Log Name, Log End Date and Time, Log Start Date and Time> related to "Log A-1" included in the log response. Note that the "Target Log" field contains null data.

[0093] [Third example of log data saving behavior]

[0094] In the third example, assume that six hours after the occurrence of the abnormal operation event detected in the first example described above, the monitoring unit 20 detects the occurrence of a new abnormal operation event in the target system 2, and sends a new abnormality notification about the new event to the storage unit 30.

[0095] However, in this third example, it is assumed that the new abnormality notification sent from the monitoring unit 20 to the storage unit 30 includes the following information as the abnormality identification, abnormality category, and abnormality detection date and time.

[0096] Abnormality notification: (Abnormality identification b, α, 2023 / 01 / 01 10:00)

[0097] 3, and acquires the collected log name "Log A" and the period "3 hours" from the record whose abnormality category is "α." The storage unit 30 creates the following new log request using the acquired information and the information on the abnormality identification and the abnormality detection date and time included in the abnormality notification, and sends it to the collection unit 10.

[0098] Log request: (Anomaly identification b, 2023 / 01 / 01 10:00, {Log A, 3 hours})

[0099] When the collection unit 10 receives this log request, it uses the log reference information file 11 to determine whether there is any overlap between the substance log already stored in the storage unit 30 and the substance log requested in the new log request.

[0100] The above new log request is a request for log data between 2023 / 01 / 01 10:00 and 2023 / 01 / 01 07:00, three hours back from the time, in the collected log "log A". Meanwhile, the log reference information file 11 at this time shows the information of [A] in FIG. 5 described above, which shows that the actual log of the collected log "log A" from 2023 / 01 / 01 04:00 to 2023 / 01 / 01 01:00 has already been stored in the storage unit 30. Therefore, in the above judgment, it is determined that there is no overlapping part in the actual log already stored in the storage unit 30.

[0101] At this time, the collection unit 10 reads out the remaining log data between 2023 / 01 / 01 10:00 and 2023 / 01 / 01 07:00, which does not overlap with the entity log already stored in the storage unit 30, from the temporarily stored collected log "log A", and acquires it as the remaining entity log of "log A". In addition, the collection unit 10 creates a stored entity log name for the acquired remaining entity log. That is, the collection unit 10 creates, for example, "anomaly identification b / log A-2", which is a combination of the information of the collected log name and a unique number, and further combines the directory name of the anomaly identification directory in which the entity log is placed, as the stored entity log name.

[0102] The collection unit 10 creates the following log response including each piece of information obtained as described above, and sends it to the storage unit 30.

[0103] Log response: ({Log A, 2023 / 01 / 01 07:00, 2023 / 01 / 01 10:00}, [<Anomaly Identification b / Log A-2, 2023 / 01 / 01 07:00, 2023 / 01 / 01 10:00, ("Log A-2" Entity Log)>])

[0104] The storage unit 30, which has received this log response, stores the actual log of "log A-2" included in the log response, and also stores information about the collected log "log A" included in the log response. The collection unit 10 also adds information about the storage status of the actual log of "log A-2" in the storage unit 30 to the log reference information file 11. The correspondence relationship between the log reference information file 11 and the storage status of the log in the storage 32 of the storage unit 30 at this time is shown in FIG. 7.

[0105] The log reference information file 11 of [A] in Fig. 7 is obtained by adding the record on the second line to the one shown in [A] in Fig. 5. This record on the second line shows the same information as the information on the <stored entity log name, log end date and time, log start date and time>, which is the reference information on the entity log "Log A-2" included in the above log response data.

[0106] On the other hand, in the storage status of [B] in Figure 7, a table contained in the "Abnormality Log" file located in the "Abnormality Identification b" directory immediately below the "Abnormality List" directory of storage 32 has been added to the status shown in [B] in Figure 5.

[0107] The record in the first row of the table in this "Abnormal Log" file stores information about the collected log included in the log response, just like the table contained in the "Abnormal Log" file placed in the "Abnormal Identification A" directory. That is, the "Target Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information {Collected Log Name, End Date and Time, Start Date and Time} included in the log response. The "Substance Log" field is set to null data.

[0108] Furthermore, the record in the second row of the table of the "Abnormal Log" file stores reference information for the actual log "Log A-2" included in the log response. That is, the "Actual Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information <Saved Actual Log Name, Log End Date and Time, Log Start Date and Time> related to "Log A-2" included in the log response. The "Target Log" field is set to null data. Furthermore, the data file of the actual log of "Log A-2" included in the log response is placed in the "Abnormal Identification b" directory, the same as the "Abnormal Log".

[0109] [Fourth example of log data saving behavior]

[0110] In the fourth example, assume that two hours after the occurrence of the newly detected abnormal operation event in the third example described above, the monitoring unit 20 detects the occurrence of a further abnormal operation event in the target system 2 and sends an abnormality notification about the further event to the storage unit 30.

[0111] However, in this fourth example, the further abnormality notification sent from the monitoring unit 20 to the storage unit 30 includes the following information as the abnormality identification, abnormality category, and abnormality detection date and time.

[0112] Abnormality notification: (Abnormality identification c, β, 2023 / 01 / 01 12:00)

[0113] 3, and acquires the collected log name "Log A" and the period "11 hours" from the record whose abnormality category is "β." The storage unit 30 creates the following new log request using the acquired information and the information on the abnormality identification and the abnormality detection date and time included in the abnormality notification, and sends it to the collection unit 10.

[0114] Log request: (Anomaly identification c, 2023 / 01 / 01 12:00, {Log A, 11 hours})

[0115] The above new log request is a request for log data between 2023 / 01 / 01 12:00 and 2023 / 01 / 01 01:00, 11 hours back from the time in the collected log "log A". Meanwhile, the log reference information file 11 at this time shows the information of [A] in FIG. 7 described above. That is, it shows that the entity log from 2023 / 01 / 01 04:00 to 2023 / 01 / 01 01:00 and the entity log from 2023 / 01 / 01 10:00 to 2023 / 01 / 01 07:00 for the collected log "log A" have already been stored in the storage unit 30. Therefore, it is determined that the entity logs for the period between 2023 / 01 / 01 04:00 and 2023 / 01 / 01 01:00, and the entity logs for the period between 2023 / 01 / 01 10:00 and 2023 / 01 / 01 07:00, which are already stored in the storage unit 30, overlap.

[0116] At this time, the collection unit 10 reads out the first remaining log data between 2023 / 01 / 01 12:00 and 2023 / 01 / 01 10:00, which does not overlap with the entity log already stored in the storage unit 30, from the temporarily stored collected log "log A", and acquires it as the first remaining entity log of "log A". In addition, the collection unit 10 creates a stored entity log name for the acquired first remaining entity log. That is, the collection unit 10 creates, for example, "anomaly identification c / log A-3", which is a combination of the information of the collected log name and a unique number, and further combines the directory name of the anomaly identification directory in which the entity log is placed, as the log name for the first remaining entity log.

[0117] In addition, the collection unit 10 obtains from the log reference information file 11 the stored entity log name "Abnormality Identification b / Log A-2" of the entity log "Log A-2" which has already been stored in the storage unit 30 and which overlaps with the portion from 2023 / 01 / 01 10:00 to 2023 / 01 / 01 07:00.

[0118] Furthermore, the collection unit 10 reads out the second residual log data between 2023 / 01 / 01 07:00 and 2023 / 01 / 01 04:00, which does not overlap with the entity log already stored in the storage unit 30, from the temporarily stored collected log "log A", and acquires it as the second residual entity log of "log A". In addition, the collection unit 10 creates a stored entity log name for the acquired second residual entity log. That is, the collection unit 10 creates, for example, "anomaly identification c / log A-4", which is a combination of the information of the collected log name and a unique number, and further combines the directory name of the anomaly identification directory in which the entity log is placed, as the stored entity log name for the entity log.

[0119] In addition, the collection unit 10 obtains from the log reference information file 11 the stored entity log name "Abnormality Identification a / Log A-1" of the entity log "Log A-1" which has already been stored in the storage unit 30 and which overlaps with the portion from 2023 / 01 / 01 04:00 to 2023 / 01 / 01 01:00.

[0120] The collection unit 10 creates the following log response including each piece of information obtained as described above, and sends it to the storage unit 30.

[0121] Log response: ({Log A, 2023 / 01 / 01 01:00, 2023 / 01 / 01 12:00}, [<Anomaly Identification c / Log A-3, 2023 / 01 / 01 10:00, 2023 / 01 / 01 12:00, ("Log A-3" substance log)>] [<Anomaly Identification b / Log A-2, 2023 / 01 / 01 07:00, 2023 / 01 / 01 10:00>], [<Anomaly Identification c / Log A-4, 2023 / 01 / 01 04:00, 2023 / 01 / 01 07:00, ("Log A-4" Entity Log)>] [<Anomaly Identification a / Log A-1, 2023 / 01 / 01 01:00, 2023 / 01 / 01 04:00>])

[0122] The storage unit 30, which has received this log response, stores the actual logs of "log A-3" and "log A-4" included in the log response, and also stores information about the collected log "log A" included in the log response. The collection unit 10 also adds information about the storage status of the actual logs of "log A-3" and "log A-4" in the storage unit 30 to the log reference information file 11. The correspondence relationship between the log reference information file 11 and the storage status of the logs in the storage 32 of the storage unit 30 at this time is shown in FIG. 8.

[0123] Log reference information file 11 of [A] in Figure 8 is a total of four records, consisting of two records added to the two records shown in log reference information file 11 of [A] in Figure 7, arranged in chronological order of the log start date and time.

[0124] In the log reference information file 11 of [A] in Fig. 8, the records in the first and third lines are respectively the same as the records in the first and second lines in the log reference information file 11 of [A] in Fig. 7. Also, in the log reference information file 11 of [A] in Fig. 8, the record in the second line shows the same information as each of the information <stored entity log name, log end date and time, log start date and time> which is the reference information for the entity log "log A-4" included in the above log response data. Also, the record in the fourth line shows the same information as each of the information <stored entity log name, log end date and time, log start date and time> which is the reference information for the entity log "log A-3" included in the above log response data.

[0125] On the other hand, in the storage status of [B] in Fig. 8, a table of the “abnormal log” file located in the “abnormal identification c” directory directly under the “abnormal list” directory has been added from the status of [B] in Fig. 7.

[0126] The record in the first row of the table in this "Abnormal Log" file stores information about the collected log included in the log response, just like the table contained in the "Abnormal Log" file placed in the "Abnormal Identification A" directory. That is, the "Target Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information {Collected Log Name, End Date and Time, Start Date and Time} included in the log response. The "Substance Log" field is set to null data.

[0127] Furthermore, the record in the second row of the table of the "Abnormal Log" file stores reference information for the actual log "Log A-3" included in the log response. That is, the "Actual Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information <Saved Actual Log Name, Log End Date and Time, Log Start Date and Time> related to "Log A-3" included in the log response. The "Target Log" field is set to null data. Furthermore, the data file of the actual log of "Log A-3" included in the log response is placed in the "Abnormal Identification c" directory, the same as the "Abnormal Log".

[0128] Furthermore, the record in the third row of the table in the "Abnormal Log" file stores reference information for the actual log "Log A-2" included in the log response. That is, the "Actual Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information <Saved Actual Log Name, Log End Date and Time, Log Start Date and Time> for "Log A-2" included in the log response. Note that the "Target Log" field contains null data.

[0129] Furthermore, the record on the fourth line of the table in the "Abnormal Log" file stores reference information for the actual log "Log A-4" included in the log response. That is, the "Actual Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information <Saved Actual Log Name, Log End Date and Time, Log Start Date and Time> for "Log A-3" included in the log response. The "Target Log" field is set to null data. Furthermore, the data file of the actual log of "Log A-4" included in the log response is placed in the "Abnormal Identification c" directory, the same as the "Abnormal Log".

[0130] Furthermore, the record on the fifth line of the table in the "Abnormal Log" file stores reference information for the actual log "Log A-1" included in the log response. That is, the "Actual Log", "Log End Date and Time", and "Log Start Date and Time" fields in this record store the information <Saved Actual Log Name, Log End Date and Time, Log Start Date and Time> related to "Log A-1" included in the log response. Note that the "Target Log" field contains null data.

[0131] By referring to the table of the "abnormal log" file created in the first to fourth examples of the log data saving operation described above, the location of the log data entity for the collected log can be known. Also, by referring to the log reference information file 11 created in the above manner, information on the entity of the log data saved in the storage 32 of the saving unit 30 can be obtained.

[0132] Next, the processes performed by each component of the log storage device 1 described above will be described in more detail.

[0133] First, a description will be given of the data collection process 110 performed by the collection unit 10. Fig. 9 is a flowchart showing an example of the process contents of the data collection process 110.

[0134] 9 is started, first, in S111, a process of collecting log data created in the target system 2 is performed. Next, in S112, a process of adding the collected log data to a data file (collected log) for the temporarily stored log data is performed. When the process of S112 is completed, the data collection process 110 is temporarily terminated, and then, the execution of this data collection process 110 is started again and repeatedly executed.

[0135] The above-mentioned processing is the data collection processing 110, and this processing is performed for each piece of log data for each event created in the target system 2.

[0136] Next, a description will be given of the log update process 120 performed by the collection unit 10. Fig. 10 is a flowchart showing an example of the process contents of the log update process 120.

[0137] When the process of FIG. 10 is started, first, in S121, a process is performed in which the date and time at which this process is executed is obtained as the current date and time.

[0138] The processes of S122 and S123 following the process of S121 are performed on each collected log temporarily stored in the collection unit 10.

[0139] First, in S122, a process is performed to delete log data with old dates and times outside a pre-specified period (for example, one month) from the collected log to be processed.

[0140] Next, in S123, a process is performed in which records for the collected logs to be processed in the log reference information file 11 and in which an older date and time outside the above range is indicated in the log start date and time field are deleted from the log reference information file 11.

[0141] After that, when the above-mentioned processes of S122 and S123 are completed for all collected logs temporarily stored in the collection unit 10, the log update process 120 is temporarily terminated, and then the execution of this log update process 120 is restarted and executed repeatedly.

[0142] The above processing is the log update processing 120.

[0143] Next, a description will be given of the abnormal event detection process 200 performed by the monitoring unit 20. Fig. 11 is a flow chart showing an example of the process contents of the abnormal event detection process 200.

[0144] In the abnormal event detection process 200, each process from S201 to S203 is performed for each collected log temporarily stored in the collection unit 10.

[0145] When the process of FIG. 11 is started, first, in S201, a process of reading and acquiring the log data added by the data collection process 110 illustrated in FIG. 9 from the collected log to be processed is performed.

[0146] Next, in S202, a process is performed to determine whether or not the value represented by the log data acquired by the process of S201 is outside a pre-specified range of values ​​during normal operation of the target system 2. This process is a process to detect the occurrence of an abnormal operation event in the target system 2. Here, only when the result of this determination is YES, the process of S203 is executed. In this S203, the date and time at which this process is executed is set as the abnormality detection date and time, and the process of issuing the above-mentioned abnormality notification with an abnormality category set according to, for example, the target collected log at this time and the value represented by the acquired log data is sent to the storage unit 30.

[0147] After that, when the above-mentioned processing from S201 to S203 is completed for all collected logs temporarily stored in the collection unit 10, the abnormal event detection processing 200 is temporarily terminated, and then the execution of this abnormal event detection processing 200 is restarted and repeatedly executed.

[0148] The abnormal event detection process 200 is the above-mentioned process.

[0149] Next, a description will be given of the log request process 300 performed by the storage unit 30. Fig. 12 is a flow chart showing an example of the process contents of the log request process 300.

[0150] This log request process 300 is started when the storage unit 30 receives an abnormality notification sent from the monitoring unit 20 .

[0151] First, in S301, the configuration file 31 is referenced to obtain information on the collected log name and period associated with the abnormality category indicated in the received abnormality notification.

[0152] Next, in S302, the above-mentioned log request is issued, containing the information on the abnormality detection date and time indicated in the received abnormality notification, and the collected log name and period information obtained by the processing of S301, and is sent to the collection unit 10.

[0153] Next, in S303, the process of receiving the log response sent from the storage unit 30 in response to the log request issued in the process of S302 is performed.

[0154] Next, in S304, a process is performed in which the substance log included in the log response received in the process of S303 is saved in the storage 32. In this process, a directory having the name of the anomaly identification indicated in the log response is created in the storage 32, and the substance log is stored under the saved substance log name indicated in the log response directly under the directory.

[0155] Next, in S305, the reference information for the collected log "Log A" included in the log response received in the process of S303 is placed and stored as the above-mentioned abnormal log directly under the directory created in the process of S304. After that, this log request process 300 ends.

[0156] The above processing is the log request processing 300 .

[0157] Next, a description will be given of the log response process 400 performed by the collection unit 10. Fig. 13 is a flowchart showing an example of the process contents of the log response process 400.

[0158] The log response process 400 is started when the collection unit 10 receives a log request sent from the storage unit 30. Each process from S401 to S405 of this log response process 400 is performed for each collected log whose name is indicated in the log request.

[0159] 13 starts, first, in S401, a process is performed to calculate the "end date and time" for the collected log from the "start date and time" and the "period" for the collected log to be processed, which are indicated in the received log request. As described above, the "end date and time" is the date and time that is the "period" back from the "start date and time".

[0160] Next, in S402, a process is performed to create collected log information to be included in the log response, i.e., {collected log name, end date and time, start date and time}, from the information indicated in the log request and the information calculated by the process of S401.

[0161] In S403, the process performs a process of substituting the "start date and time" indicated in the log request into a variable S indicating the date and time.

[0162] In S404, a process is performed to identify, from among the records contained in the table of the log reference information file 11, the record with the latest "log start date and time", i.e., the record whose "log start date and time" represents the latest date and time, as the "reference record".

[0163] Next, in S405, a substance log information creation process is performed. This process is a process for identifying a substance log from the "start date and time" to the "end date and time" of the collected log to be processed, and creating various information related to the substance log. Note that this process is repeatedly executed until the value of the variable S, into which the "start date and time" has been assigned in the process of S403, becomes the "end date and time" of the collected log to be processed.

[0164] The actual log information creation process will be described in detail later.

[0165] In S406, the process is performed to issue the above-mentioned log response, which includes the collected log information created in the process of S402 and various information related to the actual log for the collected log created in the process of S405, and send it to the storage unit 30. After that, this log response process 400 ends.

[0166] The above-mentioned processing is the log response processing 400 .

[0167] Next, a further explanation will be given of the actual log information creation process, which is the process of S405 in the above-mentioned log response process 400. Fig. 14 is a flowchart showing an example of the process contents of the actual log information creation process.

[0168] First, in S411, a process is performed to determine whether the date and time indicated by the value of variable S is within the period from the "log start date and time" to the "log end date and time" in the reference record. In this determination process, if it is determined that variable S is within the period (if the determination result is YES), the process proceeds to S417. On the other hand, in this determination process, if it is determined that variable S is outside the period (if the determination result is NO), the process proceeds to S412.

[0169] In S412, the later of the "end date and time" for the collected log being processed and the "log start date and time" in the reference record is assigned to variable E indicating date and time.

[0170] In S413, a process is performed in which the actual log from the date and time indicated by the variable S to the date and time indicated by the variable E is acquired from the collected log that is the processing target and is temporarily stored in the collection unit 10.

[0171] In S414, a process is performed to create a saved entity log name for the entity log acquired in the process of S413. In this process, for example, as described above, the saved entity log name is created by further combining the combination of the collected log name information and a unique number with the directory name of the anomaly identification directory in which the entity log is placed.

[0172] In S415, a process is performed to create reference information for the substance log acquired in the process of S413, that is, information of a combination of <stored substance log name, log end date and time, log start date and time>. Note that the stored substance log name created in the process of S414 is used. Also, the log end date and time and the log start date and time are used based on the values ​​of the variables E and S at the time of execution of this process.

[0173] In S416, the value of the variable E at the time of execution of this process is substituted for the variable S, and thereafter, this substance log information creation process is temporarily terminated.

[0174] Meanwhile, in S417, a process is performed to determine whether the "log end date and time" in the reference record is later (later) than the "end date and time" for the collected log to be processed. In this determination process, when it is determined that the "log end date and time" is later than the "end date and time" (when the determination result is YES), the process proceeds to S418. On the other hand, in this determination process, when it is determined that the "log end date and time" is earlier than the "end date and time" (when the determination result is NO), the process proceeds to S420.

[0175] In S418, the reference information for the entity log indicated in the reference record is used as is to create information for the entity log, such as <stored entity log name, log end date and time, log start date and time>.

[0176] In S419, the "log end date and time" in the reference record is substituted into the variable S, and then the process proceeds to S422.

[0177] On the other hand, in S420, the process creates information for the entity log <name of saved entity log, log end date and time, log start date and time> using the reference information for the entity log shown in the reference record and the "end date and time" for the collected log to be processed. In this process, the "log end date and time" for the entity log is set to the "end date and time" for the collected log to be processed instead of the "log end date and time" shown in the reference record.

[0178] In S421, the "end date and time" of the collected log to be processed is substituted into the variable S, and then the process proceeds to S422.

[0179] In S422, a process is performed to identify the record contained in the table of the log reference information file 11 that has the next most recent "log start date and time" after the reference record as the new "reference record," and then the actual log information creation process is temporarily terminated.

[0180] The above processing is the actual log information creation processing.

[0181] By performing each of the processes shown in Figures 9 to 14 described above in the log storage device 1, duplicate storage of log data necessary for clarifying the process by which an abnormal operation event occurs in the target system 2 is eliminated, thereby reducing the amount of log data stored.

[0182] Next, a description will be given of a method for referencing log data stored in the storage 32 of the log storage device 1. Fig. 15 is a flowchart showing an example of the process contents of a log reference process.

[0183] The instruction to start the log reference process includes the information specifying the abnormality identification described above. When the process is started in response to the instruction to start the process, first, in S501, the "abnormality log" file stored in the storage 32 is read.

[0184] As described above with reference to the example of Fig. 4, an "abnormality list" directory is provided in storage 32, an "abnormality identification" directory is placed directly below the "abnormality list" directory, and an "abnormality log" file is placed in this "abnormality identification" directory. In the process of S501, the "abnormality identification" directory is identified by the abnormality identification specified in the information included in the instruction to start execution, and the "abnormality log" file under the "abnormality identification" directory is read.

[0185] Next, the process of S502 is performed for each target log indicated in the "abnormal log" file read by the process of S501. In this S502, the process of reading and outputting the contents (log data) of the actual log associated with the target log according to the information indicated in the "abnormal log" file, while going back in chronological order from the most recent log start date and time, is performed.

[0186] Thereafter, when the process of S502 is completed for all target logs indicated in the "abnormal log" file read in the process of S501, this log reference process ends.

[0187] The above-mentioned processing is the log reference processing.

[0188] For example, assume that log data has been saved in the storage 32 as shown in [B] of Fig. 8, as a result of the log data being saved in the manner described above in the fourth example of the log data saving operation. In this case, when an instruction is given to start execution of a log reference process including the designation of "abnormality identification c", the "abnormality log" file under the "abnormality identification c" directory is read in the process of S501. Then, in the subsequent process of S502, a process is performed to read and output the actual log for the collected log "log A" indicated in the "abnormality log" file.

[0189] That is, first, a process is performed to read and output log data from the entity log "Log A-3" located in the "Abnormal Identification c" folder, from 2023 / 01 / 01 12:00 to 2023 / 01 / 01 10:00.

[0190] Next, a process is performed to read and output log data from 2023 / 01 / 01 10:00 to 2023 / 01 / 01 07:00 from the actual log "Log A-2" located in the "Abnormal Identification b" folder.

[0191] Furthermore, a process is performed to read and output log data from the entity log "Log A-4" located in the "Abnormal Identification c" folder from the time point 2023 / 01 / 01 07:00 to the time point 2023 / 01 / 01 04:00.

[0192] Finally, a process is performed to read and output log data from the entity log "Log A-1" located in the "Abnormal Identification a" folder, from 2023 / 01 / 01 04:00 to 2023 / 01 / 01 01:00.

[0193] As described above, by referencing log data stored in log storage device 1 according to this log reference process, it becomes possible to easily refer to log data that is not stored in duplicate.

[0194] Next, the hardware configuration of the log storage device 1 will be described.

[0195] 16 shows an example of the hardware configuration of an information processing device 40. The log storage device 1 can be configured using this information processing device 40.

[0196] The information processing device 40 is a computer equipped with the following components: a CPU 41, a memory 42, an input device 43, a display device 44, an auxiliary storage device 45, and a communication I / F 46. All of these components are connected to an internal bus 47, and are configured to enable data to be exchanged between the components. Note that "CPU" is an abbreviation for Central Processing Unit. Also, "I / F" is an abbreviation for Interface.

[0197] The CPU 41 controls each component of the information processing device 40 by, for example, executing a predetermined program using the memory 42, thereby enabling the provision of the functions of each component of the log storage device 1.

[0198] The input device 43 is, for example, a keyboard or a pointing device for inputting instructions.

[0199] The display device 44 is used, for example, to display and output various types of information.

[0200] The auxiliary storage device 45 is, for example, a flash memory or a hard disk drive. Various programs and data are stored in the auxiliary storage device 45, and the information processing device 40 can load them into the memory 42 for use.

[0201] The communication I / F 46 transmits and receives data via a communication network (not shown) according to instructions sent from the CPU 41 as necessary, for example.

[0202] When the log storage device 1 is configured using the information processing device 40, various programs are created to cause the CPU 41 to perform each process, such as the data collection process 110, the log update process 120, the abnormal event detection process 200, the log request process 300, and the log response process 400. The created various programs are stored in advance in the auxiliary storage device 45, and these programs are loaded into the memory 42 and executed by the CPU 41. In this way, the CPU 41 provides the functions of the collection unit 10, the monitoring unit 20, and the storage unit 30. In this case, the auxiliary storage device 45 holds the log reference information file 11 and the configuration definition file 31, and temporarily stores the log data collected by the collection unit 10 from the target system 2. Furthermore, the auxiliary storage device 45 provides the function of the storage 32. The communication I / F 46 provides an interface function with the communication network 3, and manages the exchange of various data with the target system 2.

[0203] When configuring the log storage device 1 using the information processing device 40, the information processing device 40 does not need to include all of the components shown in FIG. 16, and some components may be omitted depending on the application or conditions.

[0204] Also, the information processing device 40 may be caused to perform the log reference process whose processing contents are shown in Fig. 15. For this purpose, for example, a program for causing the CPU 41 to perform the log reference process is stored in advance in the auxiliary storage device 45, and this program is loaded into the memory 42 and executed by the CPU 41. In this case, for example, in the processing of S502 in Fig. 15, the contents of the log data may be output by display on the display device 44.

[0205] Although the disclosed embodiments and their advantages have been described in detail above, it will be appreciated that those skilled in the art may make various modifications, additions, and omissions therein without departing from the scope of the present invention as clearly set forth in the claims. [Explanation of symbols]

[0206] 1 Log storage device 2. Target System 3. Communication Network 10 Collection Department 11 Log Reference Information File 20 Monitoring Department 30 Preservation Department 31 Configuration File 32 Storage 110 Data Collection and Processing 120 Log update process 200 Abnormal event detection process 300 Log Request Processing 400 Log Response Handling

Claims

1. A collection unit that collects log data about a target system; A monitoring unit that monitors the target system to detect the occurrence of an event; a storage unit that stores the collected log data in response to a notification of the occurrence of the event from the monitoring unit, and when the collected log data includes a portion that overlaps with the log data already stored in the storage unit at the time of the notification, the storage unit stores the remaining log data excluding the overlapping portion; A log storage device comprising:

2. The log storage device according to claim 1, characterized in that, if the collected log data includes the overlapping portion at the time of the notification, the storage unit further stores information identifying existing log data from among the already stored log data that is log data that includes the overlapping portion.

3. The log storage device according to claim 2 , wherein the information for identifying the existing log data includes information indicating the overlapping portion in the existing log data.

4. 4. The log storage device according to claim 3, wherein the storage unit stores the information identifying the existing log data in association with the remaining log data.

5. 5. The log storage device according to claim 4, wherein the storage unit stores the information identifying the existing log data and the remaining log data in association with the notification.

6. the notification of the occurrence of the event includes information on the date and time of the occurrence of the event; The storage unit stores the log data collected within a period from the occurrence date and time of the event to a predetermined time before that.

6. The log storage device according to claim 1,

7. the notification of the occurrence of the event includes information indicating a type of the event; the storage unit stores the log data collected during a period from the occurrence date and time of the event to the predetermined time associated with the type of the event.

7. The log storage device according to claim 6.

8. The collection unit collects a plurality of pieces of the log data for the target system; the notification of the occurrence of the event includes information indicating a type of the event; The storage unit stores log data associated with the type of the event among the plurality of collected log data.

7. The log storage device according to claim 6.

9. Collect log data about the target system; monitoring the target system to detect the occurrence of an event; When storing the collected log data in response to detection of the occurrence of the event, if the collected log data includes a portion that overlaps with the log data already stored at the time of the detection, the remaining log data excluding the overlapping portion is stored. A log storage method characterized in that the above steps are performed by an information processing device.

Images