Log storage system and log storage method

Abstract

To provide a log storage system capable of acquiring necessary log information while suppressing an increase in capacity of a memory for storing log information.SOLUTION: A log storage system includes a first storage part, a second storage part, a sorting part, a monitoring part, and a transfer part. The second storage part is a nonvolatile memory capable of holding a stored content even when power from the outside is stopped. The distribution part extracts priority log information satisfying a predetermined condition from input log information indicating a state of a monitoring target device, and outputs detailed log information including non-priority log information in the input log information. The detailed log information is written in the first storage part, and the priority log information is written in the second storage part. When the monitoring part detects an abnormality of the monitoring target device, the transfer part extracts related log information related to the abnormality of the monitoring target device from the detailed log information stored in the first storage part and writes the related log information into the second storage part.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a system and method for keeping logs of equipment or facilities. [Background technology]

[0002] Electrical devices (or facilities) may be equipped with a log storage system that stores log information indicating their operating status. In the log storage system, the log information is written in chronological order to a memory. When a failure occurs in the device, the log information is retrieved from the memory and analyzed to investigate the cause of the failure. Patent Document 1 describes a log storage system that can store log data when a failure occurs in the main system. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-139037 Summary of the Invention [Problem to be solved by the invention]

[0004] In order to accurately investigate the cause of a device failure, it is preferable to store detailed log information. However, since there is a limit to the memory capacity for storing log information, it is difficult to store detailed log information for a long period of time. In other words, with conventional technology, there is a trade-off between the accuracy of investigating the cause of the failure and memory capacity.

[0005] An object according to one aspect of the present invention is to provide a log storage system that can acquire necessary log information while suppressing an increase in memory capacity for storing log information. [Means for solving the problem]

[0006] A log storage system according to one aspect of the present invention comprises a first storage unit, a second storage unit capable of retaining stored contents even when external power is cut off, a log collection unit that collects log information of monitored devices, a distribution unit that extracts priority log information that meets predetermined conditions from input log information collected by the log collection unit and outputs detailed log information that includes non-priority log information other than the priority log information from the input log information, a first write control unit that writes the detailed log information to the first storage unit, a second write control unit that writes the priority log information to the second storage unit, a monitoring unit that monitors the status of the monitored devices, and a transcription unit that, when the monitoring unit detects an abnormality in the monitored devices, extracts relevant log information related to the abnormality in the monitored devices from the detailed log information stored in the first storage unit and writes the relevant log information to the second storage unit. [Effects of the Invention]

[0007] According to the above-described aspect, it is possible to acquire necessary log information while suppressing an increase in the memory capacity for storing log information. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a log storage system according to an embodiment of the present invention. [Figure 2] FIG. 10 is a diagram illustrating an example of processing by a distribution unit. [Figure 3] FIG. 10 is a diagram illustrating an example of a setting file. [Figure 4] FIG. 10 is a diagram illustrating an example of trigger condition information. [Figure 5] 10 is a flowchart illustrating an example of a method for saving log information. [Figure 6] FIG. 3 is a diagram showing a setting file used in the first embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of a transcription process in the first embodiment. [Figure 8] FIG. 10 is a diagram showing a setting file used in the second embodiment. [Figure 9]FIG. 10 is a diagram illustrating an example of a transcription process according to the second embodiment. [Figure 10] FIG. 1 illustrates an example of a hardware configuration of a log storage system. DETAILED DESCRIPTION OF THE INVENTION

[0009] FIG. 1 shows an example of a log storage system according to an embodiment of the present invention. The log storage system 10 according to the embodiment of the present invention collects and stores log information representing the status and operation of a device 20. The device 20 is a monitored device, facility, or system, and is capable of generating log information representing its own status and operation. The device 20 also includes a processor and memory, and is capable of executing one or more application programs.

[0010] The log storage system 10 includes a volatile memory 11, a non-volatile memory 12, a log collection unit 13, a distribution unit 14, a write control unit 15, a write control unit 16, a monitoring unit 17, and a transcription unit 18. Note that the log storage system 10 may further include other functions or devices not shown in FIG.

[0011] The volatile memory 11 is composed of a semiconductor memory such as a DRAM (Dynamic RAM (Random Access Memory)). The volatile memory 11 loses its stored contents when the external power supply is stopped, but it has a large number of writable times and a long life as a storage medium. Therefore, in the log storage system 10, the volatile memory 11 is used as a "buffer" that temporarily stores log information.

[0012] The nonvolatile memory 12 is configured, for example, by semiconductor memory such as an EEPROM (Electrically Erasable Programmable ROM (Read Only Memory)) or flash memory. The nonvolatile memory 12 can retain its stored contents even when the supply of external power is stopped, but the number of times it can be written to is relatively small. Therefore, in the log storage system 10, the nonvolatile memory 12 is used as a "file" for storing information with high priority or importance. Note that the nonvolatile memory 12 is not limited to semiconductor memory, and may also be realized using a magnetic storage device, optical disk, or the like.

[0013] The log collection unit 13 collects log information that indicates the state and operation of the device 20. Here, the device 20, for example, periodically generates log information that indicates its own state and operation. Furthermore, the device 20 generates log information in response to the occurrence of an event. In this case, the log collection unit 13 may periodically access the device 20 to acquire the log information. Furthermore, when the device 20 periodically outputs log information or when the device 20 outputs log information in response to the occurrence of an event, the log collection unit 13 receives the log information output from the device 20. Note that, in the following description, the log information that the log collection unit 13 collects from the device 20 may be referred to as "input log information."

[0014] The log information may include, but is not limited to, log information related to the execution status of user applications, log information related to kernel operations, log information related to daemons, or log information related to cron. Furthermore, the multiple logs that make up the log information may be classified into multiple log levels according to priority (or importance or urgency). In this embodiment, the log levels are defined as follows, in descending order of priority: emergency (emerg), alert (alert), error (err), warning (warning), information (info), and debug (debug).

[0015] "Emergency" and "Alert" indicate a serious problem that makes it impossible to continue service, and an immediate response is required. "Error" indicates an error that has occurred, and an action is required. "Warning" indicates an expected error (for example, a recoverable error) that has occurred, and the progress must be monitored. "Information" indicates normal operation. "Debug" is detailed log information that is output when the system is being debugged.

[0016] Each log is output, for example, from a process executed in the device 20. Therefore, for example, each log constituting log information relating to the execution status of a user application includes a process ID that identifies the process of that user application.

[0017] Here, a configuration file is provided to the log saving system 10 by a user or administrator of the device 20. The configuration file includes distribution condition information that indicates the distribution conditions, trigger condition information that indicates the trigger conditions, and transcription condition information that indicates the transcription conditions.

[0018] The distribution unit 14 extracts priority log information that meets predetermined conditions from the input log information collected by the log collection unit 13 in accordance with the distribution condition information in the configuration file. The priority log information is composed of high-priority logs, and in this embodiment, is extracted based on the log level assigned to each log that constitutes the input log information. For example, the distribution unit 14 extracts logs with a log level of "emergency," "alert," or "error" as priority log information.

[0019] 2 shows an example of the processing of the distribution unit 14. Here, the input log information collected by the log collection unit 13 from the device 20 includes all logs generated in the device 20. That is, the input log information includes all logs regardless of the log level. In the example shown in FIG. 2, the input log information includes logs with a log level of "information," logs with a log level of "error," and logs with a log level of "debug."

[0020] The distribution unit 14 then extracts high-priority logs from this input log information. Specifically, logs with a log level of "emergency," "alert," or "error" are extracted. As a result, the priority log information shown in FIG. 2 is created. In the following description, logs with a log level of "emergency," "alert," or "error" may be collectively referred to as "error logs."

[0021] In addition, the distribution unit 14 outputs non-priority log information consisting of other logs remaining after extracting priority log information from the input log information. For example, when an error log (i.e., a log with a log level of "emergency," "alert," or "error") is extracted from the input log information according to the distribution conditions, non-priority log information consisting of logs with a log level lower than "error" among the input log information is output. In this example, non-priority log information consisting of logs with a log level of "warning," "information," or "debug" is output.

[0022] Here, a log with a log level of "information" represents the state or operation of the device 20 when the device 20 is operating normally. A log with a log level of "debug" represents the state or operation of the device 20 when debugging or maintenance is being performed on the device 20. Therefore, the amount of logs contained in the non-priority log information is sufficiently larger than that of the error log, and represents the state or operation of the device 20 in detail. Therefore, in the following description, log information composed of other logs remaining after extracting the priority log information from the input log information may be referred to as "detailed log information."

[0023] In the above case, the detailed log information is composed of other logs remaining after extracting the priority log information from the input log information, and therefore does not include the priority log information. However, the embodiment of the present invention is not limited to this configuration. For example, the detailed log information may include the priority log information. In other words, the detailed log information may be substantially the same as the input log information. In this way, the detailed log information output from the distribution unit 14 may be log information composed of other logs remaining after excluding the priority log information from the input log information, or may be log information including all logs in the input log information.

[0024] The write control unit 15 writes the detailed log information output from the distribution unit 14 into the volatile memory 11. At this time, the write control unit 15 writes the logs in the detailed log information into the volatile memory 11 in chronological order. However, the capacity of the volatile memory 11 is limited. Therefore, after the free space in the volatile memory 11 runs out, the oldest logs are discarded in order. In other words, the oldest logs are overwritten by new logs.

[0025] The volatile memory 11 loses its stored contents when the external power supply is stopped. For this reason, for example, if a power outage occurs in a configuration in which the log storage system 10 does not have a backup power supply, all log information will be lost. In this case, it will be impossible to analyze the state or operation of the device 20. Therefore, the log storage system 10 is configured to retain high-priority (or high-importance or high-urgency) log information even when the external power supply is stopped.

[0026] The write control unit 16 writes the priority log information created by the distribution unit 14 to the nonvolatile memory 12. That is, the error log in the input log information is written to the nonvolatile memory 12. At this time, the write control unit 16 writes the priority log information created by the distribution unit 14 to the nonvolatile memory 12 in chronological order. In addition, logs with low priority (that is, logs with a log level of "warning," "information," or "debug") are not written to the nonvolatile memory 12.

[0027] During normal operation of the device 20, error logs are rarely output, and most of the log information is logs with a log level of "information" or "debug." Therefore, the amount of data of log information (i.e., priority log information) written to the nonvolatile memory 12 by the write control unit 16 is small, and the nonvolatile memory 12 does not become full. Furthermore, high-priority logs are stored in the nonvolatile memory 12, which can retain its contents even if the supply of external power is stopped. In other words, even if a power outage occurs in a configuration in which the log storage system 10 does not have a backup power supply, the priority log information stored in the nonvolatile memory 12 will not be lost. Therefore, in this case, the status or operation of the device 20 can be analyzed based on the remaining log information, although the accuracy is not necessarily high.

[0028] In this embodiment, the monitoring unit 17 monitors the state of the device 20 in accordance with trigger condition information in the configuration file. Here, the monitoring unit 17 may directly monitor the state of the device 20 based on metrics information or the like. For example, the monitoring unit 17 may periodically detect the usage rate of the memory and / or processor implemented in the device 20. The monitoring unit 17 may also indirectly monitor the state of the device 20. For example, the monitoring unit 17 may monitor the state of the device 20 based on log information collected from the device 20 by the log collection unit 13. Note that, as will be described later in an embodiment, the trigger condition information specifies an event for which the monitoring unit 17 should output an abnormality detection signal.

[0029] When an abnormality detection signal is output from the monitoring unit 17, the transcription unit 18 extracts logs related to the abnormality detection signal from the detailed log information stored in the volatile memory 11 in accordance with the transcription condition information in the configuration file. That is, when an event specified by the trigger condition information occurs, the transcription unit 18 extracts logs related to the trigger condition from the volatile memory 11. In the following description, information extracted by the transcription unit 18 from the volatile memory 11 and consisting of logs related to the trigger condition may be referred to as "related log information." Here, the related log information includes not only high-priority logs but also low-priority logs ("warning," "information," and "debug"), and describes in detail the state or operation of the device 20 related to the trigger condition.

[0030] The transcription unit 18 writes the related log information acquired from the volatile memory 11 to the nonvolatile memory 12. That is, the abnormality detection signal causes the related log information to be transcribed from the volatile memory 11 to the nonvolatile memory 12. In this manner, the abnormality detection signal is used as a transcription instruction. Here, the related log information is log information related to the trigger condition. Therefore, when an event specified by the trigger condition information occurs, the related log information related to the event is stored in the nonvolatile memory 12.

[0031] As described above, according to the embodiment of the present invention, detailed log information relating to the state or operation of the device 20 is temporarily stored in the volatile memory 11. Then, when an event specified by the trigger condition information occurs, the log relating to the event is extracted from the volatile memory 11 and transcribed into the non-volatile memory 12. Therefore, detailed log information (i.e., related log information) relating to a failure or the like of the device 20 can be stored in the non-volatile memory 12.

[0032] Here, the nonvolatile memory 12 can retain its stored contents even when the external power supply is stopped, but the number of times it can be written is relatively small. However, according to this embodiment, only the priority log information extracted by the allocation unit 14 or the related log information extracted from the volatile memory 11 by the transcription unit 18 is written to the nonvolatile memory 12. In other words, the number of times data is written to the nonvolatile memory 12 is significantly smaller than the number of times data is written to the volatile memory 11. Therefore, the nonvolatile memory 12 can store detailed related log information related to a failure or the like of the device 20 for a long period of time. Then, the user or administrator of the device 20 can use this related log information to accurately investigate the cause of the failure of the device 20.

[0033] FIG. 3 shows an example of a configuration file. In this embodiment, a configuration file is created that detects an abnormality in the device 20 based on the memory usage rate of the device 20. Description (1) is distribution condition information and is set in the distribution unit 14. Furthermore, description (1) indicates that an error log (i.e., a log with a log level of "emergency," "alert," or "error") is extracted from the input log information and stored in the non-volatile memory 12. Descriptions (2) to (5) are trigger condition information and are set in the monitoring unit 17. Description (2) indicates that the monitoring parameter is the memory usage rate of the device 20. Description (3) indicates that the cycle for obtaining the value of the monitoring parameter (i.e., the memory usage rate) is 30 seconds. Description (4) indicates that the threshold for the memory usage rate is 80 percent. Description (5) indicates that an abnormality detection signal is output when the memory usage rate exceeds the threshold for 300 consecutive seconds. Description (6) is transcription condition information and is set in the transcription unit 18. This transcription condition information indicates that transcription of the related log information is to be executed only once.

[0034] When the setting file shown in FIG. 3 is given, the distribution unit 14 extracts logs with a log level of "error" or higher (i.e., error logs) from the input log information and creates priority log information. The priority log information is written to the non-volatile memory 12, and other log information (i.e., detailed log information) is written to the volatile memory 11. The monitoring unit 17 detects the memory usage rate of the device 20 at 30-second intervals. When the memory usage rate exceeds 80 percent for 300 seconds or more, the monitoring unit 17 outputs an abnormality detection signal. In response, the transcription unit 18 acquires the relevant log information from the volatile memory 11 and transcribes it into the non-volatile memory 12.

[0035] 3, memory usage is set as the trigger condition, but other metrics information may also be set. For example, CPU usage and / or network interface usage may be set as the trigger condition instead of or in addition to memory usage.

[0036] Furthermore, instead of or in addition to metrics information, elements of log information may be used as triggers. For example, in the example shown in FIG. 4, trigger conditions are set using the log type and log level. Specifically, "user application" is selected as the log type. Also, "emergency," "alert," and "error" are selected as the log levels. In this case, the monitoring unit 17 monitors log information related to user applications, and outputs an anomaly detection signal when it detects a log with a log level of "emergency," "alert," or "error."

[0037] When the transcription unit 18 receives an abnormality detection signal from the monitoring unit 17, it transcribes related information from the volatile memory 11 to the non-volatile memory 12 in accordance with the transcription condition information in the configuration file. The transcription condition information is not particularly limited, but for example, it may be "transcribe the log output from the process that output the error log." In this case, the transcription unit 18 extracts "the log output from the process that output the error log" from the log information stored in the volatile memory 11 and writes it to the non-volatile memory 12. In other words, the transcription condition information acts as a filter for the log information stored in the volatile memory 11. Therefore, by changing the description of the transcription condition, it is also possible to transcribe logs related to processes other than the process that output the error log to the non-volatile memory 12.

[0038] 5 is a flowchart showing an example of a method for storing log information by the log storage system 10. In this embodiment, it is assumed that a configuration file including distribution condition information, trigger condition information, and transcription condition information is provided to the log storage system 10. The processing of this flowchart is not particularly limited, but is executed repeatedly at a predetermined interval, for example.

[0039] In S1, the log collection unit 13 collects log information of the device 20. Alternatively, the log collection unit 13 receives log information output from the device 20. In S2, the log storage system 10 acquires metrics information of the device 20. The metrics information to be acquired is specified by, for example, a user or administrator of the device 20. In this embodiment, the metrics information to be acquired is the memory usage rate of the device 20.

[0040] In S3, the distribution unit 14 creates priority log information and detailed log information from the input log information. At this time, the distribution unit 14 extracts priority log information from the input log information in accordance with the distribution condition information in the configuration file. The distribution unit 14 also outputs detailed log information that includes log information other than the priority log information from the input log information. Note that the detailed log information may include the priority log information. In other words, the detailed log information may be substantially the same as the input log information.

[0041] In S4, the write control unit 15 writes the detailed log information output from the distribution unit 14 into the volatile memory 11. In addition, the write control unit 16 writes the priority log information extracted by the distribution unit 14 into the non-volatile memory 12.

[0042] In S5, the monitoring unit 17 monitors the state of the device 20 in accordance with the trigger condition information in the configuration file. If an event that satisfies the trigger condition is detected, the processing of the log saving system 10 proceeds to S6. On the other hand, if an event that satisfies the trigger condition is not detected, the processing of S6 to S7 is skipped.

[0043] In S6, the transcription unit 18 acquires related log information by filtering the detailed log information stored in the volatile memory 11 in accordance with the transcription condition information in the setting file. In S7, the transcription unit 18 writes the related log information acquired in S6 to the non-volatile memory 12. That is, when an event that satisfies the trigger condition is detected, a log related to the detected event is transcribed from the detailed log information stored in the volatile memory 11 to the non-volatile memory 12.

[0044] As described above, in the log storage method according to the embodiment of the present invention, log information including important logs and log information required only in the event of a failure in device 20 are sorted onto different recording media. Log information including important logs (priority log information in the above case) is extracted by sorting unit 14 and written to non-volatile memory 12. On the other hand, log information required only in the event of a failure in device 20 (detailed log information in the above case) is temporarily stored in volatile memory 11, and when a failure occurs in device 20, only the log corresponding to that failure is transcribed to non-volatile memory 12.

[0045] Therefore, even in cases where detailed log information is lost due to a sudden power outage or the like, high-priority log information can be left in non-volatile memory 12. Alternatively, flexible operation is possible, such as storing only important data such as payment history in non-volatile memory 12 when device 20 is operating normally, and transcribing detailed log information to non-volatile memory 12 when an abnormality in device 20 is detected. In addition, detailed log information may be transcribed from volatile memory 11 to non-volatile memory 12 using metrics information (memory usage rate, CPU usage rate, etc.) of device 20 as a trigger. In this case, a sign of a failure can be detected and detailed log information can be stored in non-volatile memory 12 even before a failure actually occurs.

[0046] 1, the log storage system 10 is provided independently of the device 20, but the embodiment of the present invention is not limited to this configuration. For example, the log storage system 10 may be implemented within the device 20.

[0047] <Example> 6 shows a configuration file used by the log saving system 10 in the first embodiment. The distribution condition indicates that the log level is "warning" or higher. The trigger condition indicates that the log level is "error" or higher. The transcription condition indicates that the process ID matches the ID of the process that output the error log.

[0048] FIG. 7 shows an example of transcription processing in the first embodiment. In this embodiment, detailed log information shown in FIG. 7A is stored in the volatile memory 11. Each log consists of a time, a log type, a log level, a process name / process ID, and a message. In this example, the log type is a log related to a user application. The log level indicates "emergency," "alert," "error," "warning," "information," or "debug." In this example, the process name is "app1" or "app2." In this example, the process ID uniquely corresponds to the process name. The message indicates the contents of the log.

[0049] The monitoring unit 17 monitors input log information in accordance with the trigger conditions shown in FIG. 6. When the monitoring unit 17 detects that an abnormality (or an error) has occurred in the device 20, it outputs an abnormality detection signal. Specifically, when the monitoring unit 17 detects an error log whose log level is "error" or higher, it outputs the abnormality detection signal. Then, the transcription unit 18 extracts logs related to the abnormality that has occurred in the device 20 in accordance with the transcription conditions shown in FIG. 6. Here, the transcription condition indicates that "the process ID matches the ID of the process that output the error log." The error log was output from the process identified by "process ID=1540." Therefore, the transcription unit 18 extracts only logs related to "process ID=1540" from the detailed log information shown in FIG. 7A. As a result, the related log information shown in FIG. 7B is created. The transcription unit 18 then stores this related log information in the nonvolatile memory 12.

[0050] In this way, only logs related to abnormalities that have occurred in the device 20 are stored in the nonvolatile memory 12. This reduces the amount of nonvolatile memory 12 used, and also makes it easier to analyze abnormalities that have occurred.

[0051] 8 shows a configuration file used by the log storage system 10 in the second embodiment. In the second embodiment, the transcription condition indicates that the log message includes the ID of the sensor where the error occurred. Note that the allocation condition / trigger condition is the same in the first and second embodiments.

[0052] 9A shows an example of a transcription process in the second embodiment. In this embodiment, the detailed log information shown in FIG.

[0053] The monitoring unit 17 monitors input log information in accordance with the trigger conditions shown in Fig. 8. When the monitoring unit 17 detects that an abnormality (or an error) has occurred in the device 20, it outputs an abnormality detection signal. Specifically, when the monitoring unit 17 detects an error log whose log level is "error" or higher, it outputs the abnormality detection signal. Then, the transcription unit 18 extracts logs related to the abnormality that has occurred in the device 20 in accordance with the transcription conditions shown in Fig. 8. Here, the transcription condition indicates that "the log message includes the ID of the sensor in which the error has occurred." In this case, the transcription unit 18 acquires the ID of the sensor in which the error has occurred as a search keyword from the message of the detected error log. In this example, the message in the error log includes "sensor ID=1122." Therefore, the transcription unit 18 extracts only logs whose messages include "sensor ID=1122" from the detailed log information shown in FIG. 9A. This creates the related log information shown in FIG. 9B. The transcription unit 18 then stores this related log information in the non-volatile memory 12.

[0054] In this way, only logs related to abnormalities (or errors) that have occurred in the device 20 are saved in the nonvolatile memory 12. This reduces the amount of usage in the nonvolatile memory 12 and also makes it easier to analyze the abnormalities that have occurred. In the example shown in FIG. 9B, the sensor settings were changed at 17:10:01 on December 30, 2023, and a sensor error was recorded immediately thereafter. Therefore, it is estimated that the change in the sensor settings was the cause of the error.

[0055] <Hardware configuration> 10 shows an example of the hardware configuration of the log saving system 10. The log saving system 10 is realized by a computer 200 including a processor 201, a memory 202, a storage device 203, an input / output device 204, a recording medium reader 205, and a communication interface 206.

[0056] Processor 201 controls the operation of log storage system 10 by executing a log management program stored in storage device 203. The log management program includes program code that describes the procedures of the flowchart shown in Fig. 5. Therefore, when processor 201 executes this program, the functions of log collection unit 13, distribution unit 14, write control units 15 and 16, monitoring unit 17, and transcription unit 18 shown in Fig. 1 are provided.

[0057] The memory 202 is used as a working area for the processor 201. The storage device 203 stores a log management program and other programs. The volatile memory 11 is realized using the memory 202 and / or the storage device 203. The non-volatile memory 12 is realized using the storage device 203.

[0058] The input / output device 204 includes input devices such as a keyboard, a mouse, a touch panel, and a microphone. The input / output device 204 also includes output devices such as a display device and a speaker. The recording medium reader 205 can acquire data and information recorded on the recording medium 210. The recording medium 210 is a removable recording medium that can be attached to or detached from the computer 200. The recording medium 210 can be realized by, for example, a semiconductor memory, a medium that records signals optically, or a medium that records signals magnetically. The log management program may be provided to the computer 200 from the recording medium 210. The communication interface 206 provides a function for connecting to a network. When the log management program is stored in the program server 220, the computer 200 may acquire the log management program from the program server 220. [Explanation of symbols]

[0059] 10 Log Storage System 11 Volatile Memory 12 Non-volatile memory 13 Log collection unit 14 Distribution Section 15, 16 Write control section 17 Monitoring Department 18 Transcription Department 20 equipment

Claims

1. a first storage unit; a second storage unit capable of retaining stored contents even when external power is cut off; a log collection unit that collects log information of the monitored device; a distribution unit that extracts priority log information that satisfies a predetermined condition from the input log information collected by the log collection unit, and outputs detailed log information that includes non-priority log information other than the priority log information from the input log information; a first write control unit that writes the detailed log information to the first storage unit; a second write control unit that writes the priority log information to the second storage unit; a monitoring unit that monitors the status of the monitored device; a transcription unit that, when the monitoring unit detects an abnormality in the monitored device, extracts relevant log information related to the abnormality in the monitored device from the detailed log information stored in the first storage unit and writes the relevant log information to the second storage unit; A log storage system comprising:

2. The first storage unit is a volatile memory whose stored contents are lost when external power is cut off.

2. The log storage system according to claim 1.

3. The detailed log information includes the priority log information and the non-priority log information.

2. The log storage system according to claim 1.

4. the input log information is composed of a plurality of logs, A log level indicating a priority level is assigned to each of the plurality of logs, When the monitoring unit detects a log having a log level of a predetermined priority or higher in the input log information, the monitoring unit notifies the transcription unit that an abnormality has occurred in the monitored device.

2. The log storage system according to claim 1.

5. When the metrics information for the monitored device exceeds a predetermined threshold, the monitoring unit notifies the transcription unit that an abnormality has occurred in the monitored device.

2. The log storage system according to claim 1.

6. the input log information is composed of a plurality of logs, A log level indicating a priority level is assigned to each of the plurality of logs, The transcription unit extracts, as the related log information, logs output from the same process as the output source process of a log to which a log level of a predetermined priority or higher has been assigned from the detailed log information stored in the first storage unit, and writes the extracted logs to the second storage unit.

2. The log storage system according to claim 1.

7. the input log information is composed of a plurality of logs, A log level indicating a priority level is assigned to each of the plurality of logs, The transcription unit Obtain search keywords from messages in logs that have a log level of a given priority or higher, As the related log information, a log whose message contains the search keyword is extracted from the detailed log information stored in the first storage unit, and written to the second storage unit.

2. The log storage system according to claim 1.

8. A log storage method for storing log information using a first storage unit and a second storage unit capable of retaining stored contents even when external power is stopped, comprising: extracting priority log information that satisfies a predetermined condition from input log information that indicates the state of the monitored device, and outputting detailed log information that includes non-priority log information other than the priority log information from the input log information; writing the detailed log information to the first storage unit; writing the priority log information to the second storage unit; When an abnormality in the monitored device is detected, relevant log information relating to the abnormality in the monitored device is extracted from the detailed log information stored in the first storage unit and written to the second storage unit. A log storage method comprising:

Images