Information processing device, and information processing program

Abstract

To enable specifying a format of date and time information from an operation log without relying on another information.SOLUTION: An information processing device 10 specifies a format of date and time information from a specific period including a specific date update portion from an operation log 24. The information processing device 10 can detect "08" from "07" and "01" from "31", for example, in date update of the operation log 24. The information processing device 10 can specify that since an update from "31" to "01" may be only for a date though an update from "07" to "08" may be for any one of a year, a month and a date, the update from "31" to "01" is the update of a date. In addition, the information processing device 10 can specify that since there is an update from "07" to "08" but no update to "22", the update from "07" to "08" is the update for a month. In this manner, the information processing device 10 can specify that the format of the date and time information of the operation log 24 is "month-date-year (mm-dd-yy)".SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device and an information processing program. [Background technology]

[0002] The date and time format in a log record may differ for each application, and it is necessary to define the date and time format for each application in advance. In addition, even if there is no predefined date and time format, a specific device has been proposed that identifies the date and time format in a log record based on the known update date and time, assuming that the update date and time of the log record is known. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-5363 A Summary of the Invention [Problem to be solved by the invention]

[0004] When obtaining an operation log for a specified period generated by an application in which the format of date and time information is not specified, it may not be possible to know the update date and time of the operation log. In such cases, it is not possible to identify the update date and time as known for the format of the date and time information in the operation log.

[0005] In one aspect, an object of the present invention is to make it possible to identify the format of date and time information from an operation log without relying on other information. [Means for solving the problem]

[0006] In order to achieve the above object, an information processing device as described below is provided. The information processing device has a processing unit that acquires an operation log for a predetermined period generated by a predetermined application for which the format of date and time information is not specified, acquires the occurrence date and time of an event to be analyzed from the operation log, identifies a specific period in which a date has been updated from the operation log for the predetermined period, identifies the format of the date and time information from the date and time information included in the operation log for the specific period, and extracts an operation log for an analysis period including the occurrence date and time from the operation log for the predetermined period. Effect of the Invention

[0007] According to one aspect, it is possible to identify the format of date and time information from an operation log without relying on other information. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 illustrates an example of an operation log analysis system according to a first embodiment. [Diagram 2] FIG. 13 illustrates an example of a sales office system according to a second embodiment. [Diagram 3] FIG. 11 illustrates an example of a hardware configuration of an analysis terminal according to a second embodiment. [Figure 4] FIG. 11 illustrates an example of functional blocks of an analysis terminal according to the second embodiment; [Diagram 5] FIG. 11 illustrates an example of a flowchart of a log collection process according to the second embodiment; [Figure 6] FIG. 11 illustrates an example of a flowchart of a format analysis process according to the second embodiment. [Figure 7] FIG. 13 is a diagram illustrating an example of a date-specific update mode table according to the second embodiment. [Figure 8] FIG. 13 is a diagram illustrating an example of a monthly specific update mode table according to the second embodiment. [Figure 9] FIG. 11 is a diagram illustrating an example of an operation log according to the second embodiment. [Figure 10] FIG. 11 illustrates an example of an extraction range specification based on the occurrence of a failure according to the second embodiment; [Figure 11]FIG. 11 illustrates an example of an analysis log according to the second embodiment; [Figure 12] FIG. 11 illustrates an example of a date and time information definition table according to the second embodiment; [Figure 13] FIG. 13 illustrates an example of a format correction analysis log according to the second embodiment; [Figure 14] FIG. 13 illustrates an example of a flowchart of a format analysis process according to the third embodiment. [Figure 15] FIG. 13 is a diagram illustrating an example of a format candidate table according to the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, the present embodiment will be described with reference to the drawings. Note that each embodiment can be implemented in combination with a plurality of other embodiments within a range that does not cause inconsistency. [First embodiment] First, the first embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of an operation log analysis system according to the first embodiment. The operation log analysis system 1 enables the operation of one or more applications to be verified from operation logs (log records) generated by each application.

[0010] The operation log analysis system 1 includes an information processing device 10 and a server 20. The information processing device 10 and the server 20 are connected so as to be able to communicate with each other. The server 20 runs applications by programs and is able to provide predetermined services. There are one or more applications running on the server 20, for example, application A, application B, and application C. Application A generates an operation log 21 (operation log A) for a predetermined period, application B generates an operation log 22 (operation log B) for a predetermined period, and application C generates an operation log 23 (operation log C) for a predetermined period.

[0011] The operation log 21 records a predetermined operation in application A with a date and time stamp. For example, the operation log 21 includes a record that event A occurred at the date and time "22-08-01 12:34:56". The date and time "22-08-01 12:34:56" in the operation log 21 means 12:34:56, August 1, 2022. However, the date and time "22-08-01 12:34:56" cannot uniquely identify 12:34:56, August 1, 2022 from the data alone without definition data.

[0012] The operation log 22 records a predetermined operation in the application B with a date and time stamp (time stamp, date and time information). For example, the operation log 22 includes a record that the event B occurred at the date and time "08-01-22 12:34:56". The date and time "08-01-22 12:34:56" in the operation log 22 also means 12:34:56, August 1, 2022. However, the date and time "08-01-22 12:34:56" cannot uniquely identify 12:34:56, August 1, 2022 from the data alone without definition data. For example, if the operation log 22 is interpreted in the same way as the date and time stamp of the operation log 21, the date and time "08-01-22 12:34:56" becomes 12:34:56, January 22, 2008.

[0013] The operation log 23 records a predetermined operation in the application C with a date and time stamp. For example, the operation log 23 includes a record that the event C occurred at the date and time "01-08-22 12:34:56". The date and time "01-08-22 12:34:56" in the operation log 23 also means 2022-08-01 12:34:56. However, the date and time "01-08-22 12:34:56" cannot uniquely identify 2022-08-01 12:34:56 from the data alone without definition data. For example, if the operation log 23 is interpreted in the same way as the date and time stamp of the operation log 21, the date and time "01-08-22 12:34:56" becomes 2001-08-22 12:34:56.

[0014] The server 20 can prepare definition data to enable unique interpretation of the date and time stamps in the operation log, but it is not easy to manage updates to the definition data in response to updates or replacement of applications running on the server.

[0015] The information processing device 10 makes it possible to uniquely identify the interpretation of the date and time stamp from the date and time stamp of the operation log without definition data. The information processing device 10 collects operation logs for a predetermined period from the server 20 in order to make it possible to uniquely identify the interpretation of the date and time stamp without definition data.

[0016] First, the interpretation of the date and time stamp for the operation log B will be described. The information processing device 10 collects the operation log 24 including log data for a predetermined period for the operation log B. The operation log 24 has a specific period including a specific date update point within the predetermined period. The specific date update point is a date update point that involves a change in month. For example, the operation log 24 makes it possible to identify a date update that occurred between the occurrence date and time of event X "07-31-22 23:59:59" and the occurrence date and time of event Y "08-01-22 00:00:01" by the change from hour "23" to hour "00". Note that the hours, minutes, and seconds in the date and time stamp can usually be uniquely identified without definition data, but since the hour can only take values ​​from "00" to "23", it can be clearly distinguished from the minutes and seconds that can take values ​​from "00" to "59".

[0017] The information processing device 10 can detect an update from "07" to "08" and an update from "31" to "01" in the date updates of the operation log 24. The information processing device 10 can identify that the update from "31" to "01" is a day update because the update from "07" to "08" can be any of the year, month, and day, but the update from "31" to "01" cannot be the year and month, but can only be the day. Furthermore, the information processing device 10 can identify that the update from "07" to "08" is a month update because there is an update from "07" to "08" but no update to "22."

[0018] In this way, the information processing device 10 can identify that the format of the date and time information in the operation log B is "month-day-year (mm-dd-yy)" from the operation log 24. Similarly, the information processing device 10 can identify that the format of the date and time information in the operation log A is "year-month-day (yy-mm-dd)" and that the format of the date and time information in the operation log C is "day-month-year (dd-mm-yy)".

[0019] In addition, the information processing device 10 can acquire the occurrence date and time of an event to be analyzed in the operation log, for example, the failure occurrence date and time. The information processing device 10 extracts an operation log 25 having a predetermined range including the failure occurrence date and time (for example, 10 minutes before and after, 10 events before and after, etc.) as an analysis target period from the operation log 24. For example, when the failure occurrence date and time is August 1, 2022, 12:00:00, the information processing device 10 can extract logs before and after the failure occurrence date and time based on the specified date and time information format. The operation log 25 includes an event F at the failure occurrence date and time "August 1, 2022, 12:00:00", and records an event E at the previous date and time "August 1, 2022, 11:59:55", and an event G at the subsequent date and time "August 1, 2022, 12:00:03".

[0020] In this way, the information processing device 10 can identify the format of date and time information of application B, the format of which is not identified from the operation log 22 without relying on other information, and extract the operation log 25 to be analyzed when a failure occurs. The other information can be, for example, a definition file that is prepared in advance and can identify the format of date and time information. The operation log 25 does not necessarily need to be included in the operation log 24. The operation log 24 and the operation log 25 may be different ranges of the operation log 22, may be the same range, or may have partially overlapping ranges. Similarly, the information processing device 10 can extract the operation log to be analyzed from the operation log 21 or the operation log 23.

[0021] Second Embodiment Next, a second embodiment will be described. The second embodiment relates to a branch office system of a financial institution. First, the system configuration of a payment management system will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the branch office system of the second embodiment.

[0022] The financial institution's branch office system 50 includes networks 30 and 40, an analysis terminal 100, a server 200, and counter terminals 300(a), 300(b), 300(c), etc. The server 200 and the counter terminals 300(a), 300(b), 300(c), etc. are communicatively connected via a network 40. The branch office system 50 enables financial services to be provided from the counter terminals 300(a), 300(b), 300(c), etc. of the branch office by an application running on the server 200. The server 200 centralizes the financial institution's business processing by making multiple applications work together. The server 200 also records the operation of each application as log data (operation log) and makes the log data available for investigating the cause of a failure when one occurs. Counter terminals 300(a), 300(b), 300(c),... are terminal devices that can be operated by bank employees who handle counter operations at business offices (the head office and each branch office), and enable the use of services provided by server 200. Server 200 can accumulate a predetermined amount of log data (for example, a predetermined period or a predetermined number of events, a predetermined data size, etc.), and the amount of recording may differ for each application.

[0023] The analysis terminal 100 and the server 200 are communicatively connected via a network 30. The analysis terminal 100 may be communicatively connected to the server 200 via a network 40. The analysis terminal 100 is a terminal device that acquires log data to be analyzed from the server 200.

[0024] The formats of date and time information in log data are not uniform among multiple applications running on server 200. Server 200 or analyzing terminal 100 can prepare definition data for each application to enable identification of the format of date and time information in log data, but it is not easy to manage updates to the definition data in response to updates or replacement of applications running on server 200. Analyzing terminal 100 enables identification of the format of date and time information in log data without definition data.

[0025] The branch office system 50 is an example of a system that analyzes log data generated by multiple applications running on the server 200, and any system that generates log data in which the format of date and time information is not specified can be used as the analysis target of the analysis terminal 100.

[0026] Next, the hardware configuration of the analysis terminal 100 will be described with reference to FIG. 3. FIG. 3 is a diagram showing an example of the hardware configuration of the analysis terminal of the second embodiment. The analysis terminal 100 is entirely controlled by a processor 101. A memory 102 and a plurality of peripheral devices are connected to the processor 101 via a bus 114. The processor 101 may be a multiprocessor. The processor 101 is, for example, a central processing unit (CPU), a micro processing unit (MPU), or a digital signal processor (DSP). At least a part of the functions realized by the processor 101 executing a program may be realized by an electronic circuit such as an application specific integrated circuit (ASIC) or a programmable logic device (PLD).

[0027] The memory 102 is used as a main storage device of the analysis terminal 100. The memory 102 temporarily stores at least a part of the OS (Operating System) program and application programs executed by the processor 101. The memory 102 also stores various data used for processing by the processor 101. As the memory 102, for example, a volatile semiconductor storage device such as a RAM (Random Access Memory) is used.

[0028] The peripheral devices connected to the bus 114 include a storage device 103, a GPU (Graphics Processing Unit) 104, an input interface 105, and an optical drive device 106. The peripheral devices connected to the bus 114 also include a device connection interface 107 and a network interface 108.

[0029] The storage device 103 electrically or magnetically writes and reads data to and from a built-in recording medium. The storage device 103 is used as an auxiliary storage device for a computer. The storage device 103 stores an OS program, application programs, and various data. Note that, for example, a hard disk drive (HDD) or a solid state drive (SSD) can be used as the storage device 103.

[0030] The GPU 104 is connected to a monitor 31. The GPU 104 displays an image on the screen of the monitor 31 in accordance with an instruction from the processor 101. The monitor 31 may be a display device using an organic EL (Electro Luminescence) display device, a liquid crystal display device, or the like.

[0031] The input interface 105 is connected to the keyboard 32 and the mouse 33. The input interface 105 transmits signals sent from the keyboard 32 and the mouse 33 to the processor 101. Note that the mouse 33 is an example of a pointing device, and other pointing devices can also be used. Examples of other pointing devices include a touch panel, a tablet, a touch pad, a trackball, etc.

[0032] The optical drive device 106 uses a laser beam or the like to read data recorded on the optical disc 34. The optical disc 34 is a portable recording medium on which data is recorded so that it can be read by reflection of light. The optical disc 34 includes a DVD (Digital Versatile Disc), a DVD-RAM, a CD-ROM (Compact Disc Read Only Memory), a CD-R (Recordable) / RW (ReWritable), etc.

[0033] The device connection interface 107 is a communication interface for connecting peripheral devices to the analysis terminal 100. For example, a memory device 35 or a memory reader / writer 36 can be connected to the device connection interface 107. The memory device 35 is a recording medium equipped with a communication function with the device connection interface 107. The memory reader / writer 36 is a device that writes data to the memory card 37 or reads data from the memory card 37. The memory card 37 is a card-type recording medium.

[0034] The network interface 108 is connected to the network 30. The network interface 108 transmits and receives data via the network 30 to and from other computers or communication devices.

[0035] The analysis terminal 100 can realize the processing functions of the second embodiment by the above-mentioned hardware configuration. The information processing device 10 and the server 20 shown in the first embodiment, and the server 200 and the window terminals 300(a), 300(b), 300(c), ... shown in the second embodiment can also be realized by the same hardware as the analysis terminal 100 shown in FIG.

[0036] The analysis terminal 100 realizes the processing function of the second embodiment by, for example, executing a program recorded in a computer-readable recording medium. The program describing the processing contents to be executed by the analysis terminal 100 can be recorded in various recording media. For example, the program to be executed by the analysis terminal 100 can be stored in the storage device 103. The processor 101 loads at least a part of the program in the storage device 103 into the memory 102 and executes the program. The program to be executed by the analysis terminal 100 can also be recorded in a portable recording medium such as the optical disk 34, the memory device 35, or the memory card 37. The program stored in the portable recording medium becomes executable after being installed in the storage device 103 under the control of the processor 101, for example. The processor 101 can also read and execute the program directly from the portable recording medium.

[0037] Next, the function of the analysis terminal 100 will be described with reference to FIG. 4. FIG. 4 is a diagram showing an example of a functional block of the analysis terminal of the second embodiment. The analysis terminal 100 has a processing unit 120 and a storage unit 130. The processing unit 120 can be realized by the processor 101 executing a program describing required processing contents. The processing unit 120 includes an operation log acquisition unit 121, an occurrence date and time acquisition unit 122, a format specification unit 123, an analysis target extraction unit 124, and an analysis target output unit 125. The storage unit 130 can be realized by the storage device 103, and can store data including the operation log 131, the occurrence date and time 132, and the specified format 133.

[0038] The operation log acquisition unit 121 acquires an operation log (log data) generated by an application running on the server 200. The storage unit 130 records the acquired operation log as the operation log 131. The occurrence date and time acquisition unit 122 acquires the occurrence date and time of an event to be analyzed from the operation log (for example, the date and time of a failure). The storage unit 130 records the acquired occurrence date and time as the occurrence date and time 132. The format identification unit 123 identifies the format of date and time information in the operation log for each application acquired from the server 200. The storage unit 130 records the identified format of date and time information as the identified format 133. The analysis target extraction unit 124 extracts a range to be analyzed (analysis log) from the operation log for each application acquired from the server 200. The analysis target output unit 125 enables the extracted analysis log to be output.

[0039] Next, the log collection process executed by the analysis terminal 100 will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of a flowchart of the log collection process of the second embodiment. The log collection process is a process executed by the analysis terminal 100 in the cause investigation and operation verification when a failure occurs in the sales office system 50, and is triggered by the operator.

[0040] [Step S11] The processing unit 120 acquires an operation log generated by an application to be analyzed. When there are two or more applications to be analyzed, the processing unit 120 acquires an operation log from each application. The processing unit 120 records the acquired operation log as an operation log 131 in the storage unit 130. The operation log acquired by the processing unit 120 may not include date and time information.

[0041] [Step S12] The processing unit 120 acquires the failure occurrence date and time. The failure occurrence date and time may be acquired by inputting the failure occurrence time or failure occurrence period by an operator, or may be automatically input upon failure detection. The failure occurrence date and time acquired by the processing unit 120 is input in a known date and time format.

[0042] [Step S13] The processing unit 120 executes a format analysis process to analyze the format of the date and time information of the acquired operation log. The format of the date and time information of the operation log is analyzed for each operation log generated by an application. The details of the format analysis process will be described later with reference to FIG. 6.

[0043] [Step S14] The processing unit 120 extracts, from the operation logs whose format of date and time information has been analyzed, operation logs within the range to be analyzed based on the acquired date and time of the failure, as analysis logs. The extracted analysis logs are recorded in the storage unit 130 as one of the operation logs 131.

[0044] [Step S15] The processing unit 120 generates a format definition for the operation log whose format of the date and time information has been analyzed, and records the generated format definition in the storage unit 130 as the identified format 133. The processing unit 120 makes the generated format definition available for operation logs generated by the same application for which the format definition has already been generated, without performing format analysis processing.

[0045] [Step S16] The processing unit 120 corrects the date and time information in the analysis log to a predetermined format (standard format). [Step S17] The processing unit 120 outputs (or enables to output) the extracted operation log, and ends the log collection process.

[0046] Next, the format analysis process executed by the analysis terminal 100 will be described with reference to Figs. 6 to 8. Fig. 6 is a diagram showing an example of a flowchart of the format analysis process of the second embodiment. Fig. 7 is a diagram showing an example of a date-specific update mode table of the second embodiment. Fig. 8 is a diagram showing an example of a month-specific update mode table of the second embodiment. The format analysis process is a process executed by the analysis terminal 100 in step S13 of the log collection process.

[0047] [Step S21] The processor 120 searches for the date update location in the operation log to be analyzed. The date update location is identified by the change in the information indicating the hour, minute, and second from "23" to "00." Note that the hour, minute, and second in the date and time information of the operation log can usually be uniquely identified without any definition data. Also, since the hour can only take values ​​from "00" to "23," it can be clearly distinguished from the minutes and seconds, which can take values ​​from "00" to "59."

[0048] [Step S22] The processing unit 120 searches for a specific update mode (date specific update mode) of the year, month, and day in the date update location, and identifies the day (date information) from the date specific update mode. The date specific update mode table 150 shown in FIG. 7 defines combinations of the date before the update and the date after the update that correspond to the date specific update mode. The date specific update mode table 150 shows a combination of "31 (day)" before the update and "01 (day)" after the update, a combination of "30 (day)" before the update and "01 (day)" after the update, a combination of "29 (day)" before the update and "01 (day)" after the update, and a combination of "28 (day)" before the update and "01 (day)" after the update. These combinations are specific modes that do not appear in the year or month updates, and therefore make it possible to identify the date.

[0049] [Step S23] The processing unit 120 identifies the month (monthly information) from the specific update mode (monthly specific update mode). The month change location matches the date update location searched for in step S22. The monthly specific update mode table 152 shown in FIG. 8 defines combinations of the month before the update and the month after the update, which correspond to the monthly specific update mode. The monthly specific update mode table 152 indicates a combination of "01 (Mon)" before the update and "02 (Mon)" after the update, a combination of "02 (Mon)" before the update and "03 (Mon)" after the update, a combination of "03 (Mon)" before the update and "04 (Mon)" after the update, ..., and a combination of "12 (Mon)" before the update and "01 (Mon)" after the update. These combinations make it possible to identify the month because there are no simultaneous year updates except for the combination of "12 (Month)" before the update and "01 (Month)" after the update, and the combination of "12 (Month)" before the update and "01 (Month)" after the update does not appear in the year updates.

[0050] [Step S24] Having identified the month and day of the year, month, and date, the processing unit 120 identifies the remainder as the year (year information). [Step S25] The processing unit 120 records the identified format of the date and time information of the action log to be analyzed in the storage unit 130 as the identified format 133, and ends the format analysis process.

[0051] Next, the format analysis executed by the analysis terminal 100 will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of an operation log of the second embodiment. The operation log 154 has date update points 156 in the consecutive logs "31-07-22 23:59:59 AAAA START" and "01-08-22 00:00:00 AAAA END".

[0052] Date update location 156 can be identified because the information indicating the time in log "31-07-22 23:59:59 AAAA START" is "23", and the information indicating the time in log "01-08-22 00:00:00 AAAA END" is "00".

[0053] Since the date and time information in the log "31-07-22 23:59:59 AAAA START" is "31-07-22", and the date and time information in the log "01-08-22 00:00:00 AAAA END" is "01-08-22", it is understood that the specific update mode 158 is a date specific update mode from the date specific update mode table 150. Also, it is understood that the specific update mode 160 is a monthly specific update mode from the monthly specific update mode table 152. From this, it is specified that the format of the date and time information in the operation log 154 is "day-month-year (dd-mm-yy)".

[0054] Next, the specification of an excerpt range of the operation log (analysis log) extracted in step S14 of the log collection process will be described with reference to Fig. 10. Fig. 10 is a diagram showing an example of an excerpt range specification based on the occurrence of a failure in the second embodiment. The analysis log is extracted from the operation log with a certain margin in order to grasp the range of the failure, because the failure occurrence date and time may not be specified at the time of failure response, the cause of the failure may have occurred before the failure occurred, etc. The processing unit 120 can accept the specification of an excerpt range of the operation log, and extracts the analysis log from the operation log based on the excerpt range specification.

[0055] The excerpt range specification 162 may be input by an operator or may be automatically input based on the time of occurrence of a failure. The date and time information in the excerpt range specification 162 is input in a known format. For example, the excerpt range specification 162 specifies an excerpt range with 2022 / 08 / 01 10:00:00 (August 1, 2022, 10:00:00) as the start time and 2022 / 08 / 01 13:00:00 (August 1, 2022, 13:00:00) as the end time.

[0056] Next, the operation log extracted in step S14 of the log collection process will be described with reference to Fig. 11. Fig. 11 is a diagram showing an example of an analysis log in the second embodiment. The analysis log 164 is extracted from the operation log 154. Note that the analysis log 164 may be extracted from outside the illustrated range of the operation log 154 shown in Fig. 9.

[0057] Since the format of the date and time information in the operation log 154 is specified, the processing unit 120 can specify the analysis log 164 to be extracted by the excerpt range specification 162. Since the format of the date and time information in the operation log 154 is specified as "day-month-year (dd-mm-yy)", the processing unit 120 can specify that the log "01-08-22 12:34:56 AAAA START" is within the range of the excerpt range specification 162. This allows the processing unit 120 to extract the analysis log 164 from the operation log 154 without a definition file that defines the format of the date and time information in advance.

[0058] Next, the format definition obtained as a result of analyzing the format of date and time information will be described with reference to Fig. 12. Fig. 12 is a diagram showing an example of a date and time information definition table of the second embodiment. The date and time information definition table 166 is one of the format definitions obtained as a result of analyzing the format of date and time information. When it is identified that the source of the operation log 154 is application D and the format of the date and time information is "dd-mm-yy (day-month-year)", the processing unit 120 records the date and time information definition table 166 in the storage unit 130 as the identified format 133.

[0059] As a result, the analyzing terminal 100 can specify the format of date and time information for the operation log output by application D by referring to the specified format 133 in the storage unit 130 without analyzing the format of the date and time information. The analyzing terminal 100 may set an expiration date for the specified format 133 to prevent erroneous date and time information from being specified from old information. The analyzing terminal 100 may also initialize the specified format 133 stored in the storage unit 130 when an application operating on the server 200 is updated, not limited to application D. In this way, the analyzing terminal 100 can reflect the latest application operating environment of the server 200 in the specification of the format of date and time information.

[0060] Next, the format correction of the date and time information of the analysis log will be described with reference to FIG. 13. FIG. 13 is a diagram showing an example of the format-corrected analysis log of the second embodiment. The format-corrected analysis log 168 is generated from the analysis log 164. The format-corrected analysis log 168 corrects the format of the date and time information of the analysis log 164 to one predetermined format (standard format). The standard format is, for example, the format of the date and time information "year-month-day (yy-mm-dd)". This allows the analysis terminal 100 to change the log "01-08-22 12:34:56 AAAA START" of the analysis log 164 to the log "22-08-01 12:34:56 AAAA START" in the format-corrected analysis log 168.

[0061] Such an analysis terminal 100 can unify the formats of the date and time information when acquiring multiple operation logs with different formats of date and time information from the server 200 and outputting multiple analysis logs. This allows the analysis terminal 100 to easily verify a fault using multiple analysis logs.

[0062] Third embodiment Next, a third embodiment will be described. The third embodiment is an embodiment that is a modified example of the format analysis process of the second embodiment. The format analysis process of the third embodiment will be described with reference to Figs. 14 and 15. Fig. 14 is a diagram showing an example of a flowchart of the format analysis process of the third embodiment. Fig. 15 is a diagram showing an example of a format candidate table of the third embodiment. The format analysis process of the third embodiment is also a process executed by the analysis terminal 100 in step S13 of the log collection process.

[0063] [Step S31] The processor 120 searches for the date update location in the operation log to be analyzed. The date update location is identified by the change in the information indicating the hour, minute, and second from "23" to "00." Note that the hour, minute, and second in the date and time information of the operation log can usually be uniquely identified without any definition data. Also, since the hour can only take values ​​from "00" to "23," it can be clearly distinguished from the minutes and seconds, which can take values ​​from "00" to "59."

[0064] [Step S32] The processing unit 120 searches for the specific update mode (date-specific update mode) of the date in the date update location, and identifies the day (date information) from the date-specific update mode shown in the date-specific update mode table 150 (see FIG. 7).

[0065] [Step S33] The processing unit 120 identifies the format of the date information from the date information identified in step S32 and the date and time information format candidates defined in the format candidate table 170 shown in Fig. 15. The format candidates for date and time information defined in the format candidate table 170 are "mm-dd-yy (month-day-year)", "dd-mm-yy (day-month-year)", and "yy-mm-dd (year-month-day)", and the positions of the date information are different. Therefore, the processing unit 120 can identify one format of date and time information from the date and time information format candidates in the format candidate table 170 by identifying the position of the date information in the operation log to be analyzed.

[0066] The format candidate "mm-dd-yy (month-day-year)" is a format that is often used in the United States, the format candidate "dd-mm-yy (day-month-year)" is a format that is often used in the United Kingdom, and the format candidate "yy-mm-dd (year-month-day)" is a format that is often used in Japan. Generally, many applications output operation logs in these three formats, so the format candidate table 170 is useful in practice.

[0067] [Step S34] The processing unit 120 records the identified format of the date and time information of the operation log to be analyzed in the storage unit 130 as the identified format 133, and ends the format analysis process. Such an analyzing terminal 100 can more quickly identify the format of the date and time information of the operation log to be analyzed.

[0068] It should be noted that the disclosed embodiments are illustrative in all respects and should not be considered as limiting. In addition, the above-mentioned embodiments and each configuration of the modified examples may be combined and applied. The scope of the present invention is indicated by the claims, not the above description, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0069] 1. Operation log analysis system 10. Information processing device 20 Servers 21, 22, 23, 24, 25 Operation log

Claims

1. Acquire an operation log for a predetermined period generated by a predetermined application in which the format of date and time information is not specified; Acquire the occurrence date and time of the event to be analyzed in the operation log; Identifying a specific period in which a date is updated from the operation log for the predetermined period; Identifying a format of date and time information from the date and time information included in the operation log for the specific period; a processing unit that extracts an operation log for an analysis target period including the occurrence date and time from the operation log for the predetermined period; An information processing device having the above configuration.

2. The processing unit includes: Identifying a period in which a date is updated with a change of month as the specific period; 2. The information processing device according to claim 1.

3. The processing unit includes: Identifying the format of the date and time information by fitting it into any one of a first format in which information is arranged in the order of month, day, and year, a second format in which information is arranged in the order of day, month, and year, and a third format in which information is arranged in the order of year, month, and day.

2. The information processing device according to claim 1.

4. The processing unit includes: generating definition information that enables identification of a format of the date and time information in the specified application when the format of the date and time information in the specified application is identified; 2. The information processing device according to claim 1.

5. The processing unit includes: Converting the date and time information into a predetermined format to enable output of the extracted operation log for the analysis target period.

5. The information processing device according to claim 1.

6. On the computer, Acquire an operation log for a predetermined period generated by a predetermined application in which the format of date and time information is not specified; Acquire the occurrence date and time of the event to be analyzed in the operation log; Identifying a specific period in which a date is updated from the operation log for the predetermined period; Identifying a format of date and time information from the date and time information included in the operation log for the specific period; extracting an operation log for an analysis target period including the occurrence date and time from the operation log for the predetermined period; An information processing program that executes processing.

Images