Log management server and log management program

Abstract

To provide a log management server and a log management program capable of facilitating or streamlining network management.SOLUTION: A memory 22 stores division keywords and a correspondence table 28. A division processing unit 46 divides a character string written in a log LG into two divided character strings using a division keyword as a delimiter, and determines one of the two divided character strings as an item name and the other as a value. An association processing unit 47 registers in an association table 28 the association relationships between the log LG, the item names included in the log LG, and the values corresponding to the item names. A user presentation unit 48 presents the item names and values for each log LG to a user based on the association table 28.SELECTED DRAWING: Figure 11

Description

[Technical Field]

[0001] The present invention relates to a log management server and a log management program for managing logs received via a network. [Background technology]

[0002] Patent Document 1 discloses an access log analysis device that determines an executed processing flow and the probability of occurrence of that flow based on a log of a target system. The access log analysis device is connected to an information system that has an application server that receives processing requests from user terminals and a database that responds to inquiries from the application server in response to the processing requests. The access log analysis device acquires processing requests, inquiries, and answers and performs various processes, thereby correlating the processing requests with candidate inquiries called by the processing requests and displaying them on a screen. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-6715 Summary of the Invention [Problem to be solved by the invention]

[0004] For example, a log management server may be installed on a network. The log management server collects and manages logs that indicate operation history and the like, transmitted from various devices installed on the network. A network administrator can centrally manage the network by having the log management server analyze the collected logs and referencing the analysis results. However, in order for the log management server to analyze logs of various formats transmitted from various devices, the network administrator must set analysis rules in advance. Setting these analysis rules may require a certain amount of knowledge and effort, which can be a factor that hinders the simplification and efficiency of network management.

[0005] Therefore, one object of the present invention is to provide a log management server and a log management program that can facilitate or improve the efficiency of network management.

[0006] The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]

[0007] A brief summary of a representative embodiment of the invention disclosed in this application will be given below.

[0008] A log management server according to one embodiment manages logs received via a network and includes a memory, a division processing unit, a correlation processing unit, and a user presentation unit. The memory stores a division keyword and a correlation table. The division processing unit divides a character string written in the log into two divided character strings using the division keyword as a delimiter, and designates one of the divided character strings as an item name and the other as a value. The correlation processing unit registers in the correlation table a correspondence between the log, the item name included in the log, and the value corresponding to the item name. The user presentation unit presents the item name and value for each log to a user based on the correlation table. [Effects of the Invention]

[0009] To briefly explain the effect obtained by the representative embodiments of the invention disclosed in this application, it is possible to realize simplification and efficiency of network management. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a schematic diagram illustrating an example of the configuration of a log management system including a log management server according to a first embodiment. [Figure 2] 2 is a diagram showing an example of a log received by the log management server appearing in FIG. 1; FIG. [Figure 3]2 is a schematic diagram showing an example of the configuration of a keyword setting table in FIG. 1. FIG. [Figure 4] 4 is a schematic diagram showing an example of processing contents of the log management server based on the keyword setting table shown in FIG. 3. FIG. [Figure 5] 2 is a schematic diagram showing an example of the configuration of a log table held by the log management server appearing in FIG. 1; [Figure 6] 2 is a schematic diagram showing an example of the configuration of an item name table held by the log management server appearing in FIG. 1; [Figure 7] 2 is a schematic diagram showing an example of the configuration of a value table held by the log management server appearing in FIG. 1; [Figure 8] 2 is a schematic diagram showing an example of the configuration of an association table held by the log management server appearing in FIG. 1; [Figure 9] 2 is a schematic diagram showing an example of a log analysis result presented by the log management server appearing in FIG. 1. FIG. [Figure 10] 2 is a block diagram showing an example of the hardware configuration of the main part of the log management server in FIG. 1. [Figure 11] 2 is a block diagram showing an example of the functional configuration of a main part of the log management server in FIG. 1. [Figure 12] FIG. 10 is a block diagram showing an example of a functional configuration of a main part of a log management server according to a second embodiment. [Figure 13] 13 is a schematic diagram showing an example of the configuration of a log linking setting table in FIG. 12. FIG. [Figure 14] 13 is a diagram showing an example of a log received by the log management server appearing in FIG. 12. FIG. [Figure 15] 13 is a schematic diagram showing an example of a log analysis result presented by the log management server in FIG. 12. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In all drawings for explaining the embodiments, the same components are generally designated by the same reference numerals, and repeated description thereof will be omitted.

[0012] (First embodiment) <Outline of the log management system> Fig. 1 is a schematic diagram showing an example of the configuration of a log management system including a log management server according to a first embodiment. The log management system shown in Fig. 1 includes a log management server 20 and various devices connected to an internal network (NW) 10. The internal network 10 is, for example, an in-house network. The log management server 20 analyzes and manages logs sent from the various devices and received via the internal network 10. In this example, the various devices provided include an authentication switch (SW) 15, an authentication server 16, a proxy server 17, an intrusion prevention system (IPS) 18, and a firewall (FW) 19.

[0013] Terminal devices TM1-TMn used by users UR1-URn are connected to ports P1-Pn of the authentication switch 15, respectively. In this specification, the multiple terminal devices TM1-TMn are collectively referred to as terminal devices TM. The authentication switch 15 relays communications between the terminal devices TM or between the terminal devices TM and the internal network 10.

[0014] The authentication switch 15 is also, for example, a RADIUS (Remote Authentication Dial In User Service) client. On the other hand, the authentication server 16 is, for example, a RADIUS server. The authentication server 16 holds an authentication database (DB) 31 in the memory 30. The authentication database 31 stores information related to whether authentication is permitted or not, such as accounts that are permitted to be authenticated, i.e., user IDs and passwords, and MAC addresses that are permitted to be authenticated.

[0015] For example, in response to a network login request including an account from the terminal device TM, the authentication switch 15 transmits an authentication decision request for the account to the authentication server 16. The authentication server 16 determines whether authentication is permitted or not for the requested account based on the authentication database 31, and returns the authentication decision result to the authentication switch 15. If the authentication decision result is permitted, the authentication switch 15 permits free communication via the internal network 10 from the terminal device TM that has made the network login request, for example.

[0016] The intrusion prevention system 18 and firewall 19 are provided at the boundary between the internal network 10 and the external network 11, and detect or block unauthorized communications between the internal network 10 and the external network 11. The external network 11 is, for example, the Internet. The firewall 19 controls whether packets are allowed to pass, be rejected, or discarded, mainly based on information in the IP header and TCP header. On the other hand, the intrusion prevention system (IPS) 18 detects or blocks unauthorized communications mainly based on pre-registered attack patterns, i.e., signatures.

[0017] The proxy server 17 functions as a relay server when the terminal device TM accesses a server on the external network 11. The proxy server 17 can also detect or block unauthorized communications by being equipped with, for example, a WAF (Web Application Firewall). The WAF mainly analyzes the content of communications at the web application layer and detects or blocks attacks on web applications.

[0018] Here, the authentication switch 15, authentication server 16, proxy server 17, intrusion prevention system 18, and firewall 19 each transmit logs LGa, LGb, LGc, LGd, and LGe representing their own operation history, etc., to the log management server 20. As an example, log LGa may be generated in response to a network login request. Log LGb may be generated in response to an authentication decision. Logs LGc, LGd, and LGe may be generated in response to the detection or blocking of unauthorized communication. In this specification, various logs represented by logs LGa-LGe are collectively referred to as logs LG.

[0019] The log LG is not limited to the devices exemplified in Fig. 1, but may be transmitted from various devices, such as a Dynamic Host Configuration Protocol (DHCP) server, a mail server, and a router within the internal network 10 (not shown). The log LG is, for example, a Syslog that uses UDP port 514. However, the log LG is not limited to a Syslog, and may also be an SNMP (Simple Network Management Protocol) trap that uses UDP ports 161 and 162.

[0020] The log management server 20 analyzes the logs LG in various formats from various devices, converts them into a display format that is easy for users, such as a network administrator, to read, and then presents them to the network administrator. By referring to the presented information, the network administrator can centrally manage the network, including security management.

[0021] In association with the analysis of such a log LG, the log management server 20 stores in the memory 22 a keyword setting table 24, a log table 25, an item name table 26, a value table 27, and a correspondence table 28. The log management server 20 also stores in the memory 22 the data of the received log LG itself.

[0022] <Log management server operation> FIG. 2 is a diagram showing an example of a log LG received by the log management server 20 in FIG. 1. FIG. 2 shows four logs LG1-LG4 received in sequence. Logs LG1, LG3, and LG4 relate to, for example, network login "login" and correspond to log LGa in FIG. 1. Log LG2 relates to, for example, authentication "auth" and corresponds to log LGb in FIG. 1. Logs LG1-LG4 may include MAC address information "mac=", IP address information "ip=", user ID information "user=", authentication method information "web", "mac", VLAN-ID information "vid=", etc., as appropriate.

[0023] Fig. 3 is a schematic diagram showing an example of the configuration of the keyword setting table 24 in Fig. 1. Fig. 4 is a schematic diagram showing an example of the processing content of the log management server 20 based on the keyword setting table 24 shown in Fig. 3. In the keyword setting table 24, analysis target keywords (KWa), delimiting keywords (KWb), and division keywords (KWc) can be registered. These keywords are registered in advance by a user, for example, a network administrator.

[0024] The analysis target keyword KWa is used to define the log LG to be analyzed. The network administrator can register, for example, multiple keywords using AND or OR conditions as the analysis target keyword KWa. The log management server 20 defines the log LG that meets the registered conditions as the analysis target. For example, if the network administrator wants to analyze a certain range of Syslogs from among the various Syslogs, he or she can register a keyword that can limit the range as the analysis target keyword KWa.

[0025] The delimiter keyword KWb is used to delimit character strings written in the log LG. As shown in FIG. 4, the log management server 20 divides the character string SG written in the log LG into a plurality of substrings SBSG using the delimiter keyword KWb as a delimiter. In the example shown in FIGS. 3 and 4, "(space)" is registered as the delimiter keyword KWb. For example, the log management server 20 divides the log LG1 at the "(space)" to divide it into a first substring "login", a second substring "mac=x:x:x:x:x:x", and a third substring "ip=XXXX".

[0026] The division keyword KWc is used to divide the character string SG, specifically the substring SBSG, written in the log LG into an item name and a value. As shown in Fig. 4, the log management server 20 divides the substring SBSG into two divided strings SPSGi and SPSGv using the division keyword KWc as a delimiter. Then, the log management server 20 determines one of the two divided strings, in this case the first half of the divided string SPSGi, as the item name, and the other, in this case the second half of the divided string SPSGv, as the value.

[0027] 3 and 4, "=" is registered as the division keyword KWc. For example, the log management server 20 divides the second substring "mac=x:x:x:x:x:x" into the item name "mac" and the value "x:x:x:x:x:x" using "=" as a delimiter. The same applies to the third substring "ip=XXXX".

[0028] On the other hand, there may also be a substring SBSG that does not include the dividing keyword "=", such as the first substring "login." In this case, the log management server 20 sets the substring "login" as a value and automatically generates an item name corresponding to the set value. In the example shown in FIG. 4, "others1" is generated as the item name. "others1" means that this is the item name generated for the first substring SBSG. Note that the log management server 20 also performs the same processing for logs LG2-LG4 shown in FIG. 2 as for log LG1 shown in FIG. 4.

[0029] Fig. 5 is a schematic diagram showing an example of the configuration of the log table 25 held by the log management server 20 in Fig. 1. Fig. 6 is a schematic diagram showing an example of the configuration of the item name table 26 held by the log management server 20 in Fig. 1. Fig. 7 is a schematic diagram showing an example of the configuration of the value table 27 held by the log management server 20 in Fig. 1. Fig. 8 is a schematic diagram showing an example of the configuration of the association table 28 held by the log management server 20 in Fig. 1.

[0030] 5, the log table 25 defines a correspondence relationship between a log ID (IDg), a reception date and time, and identification information of a source device, such as an IP address. Every time the log management server 20 receives a log LG, it associates the reception date and time of the log LG and the identification information of the source device of the log LG with an individually defined log ID (IDg) and registers them in the log table 25. The identification information of the source device of the log LG, such as an IP address, can be obtained from the source IP address of the received packet that stores the log LG.

[0031] 5, the information on the reception date and time and source IP address of the four logs LG1-LG4 shown in FIG. 2 is associated with four log IDs [1]-[4] and registered. For example, IP address IPA1 is the IP address of authentication switch 15. IP address IPA2 is the IP address of authentication server 16.

[0032] 6, the item name table 26 defines the correspondence between item name IDs (IDi) and item names. In addition, in this example, the item name table 26 is configured so that the network administrator can input settings regarding whether to display each of the multiple item names and the display order of the multiple item names. These settings are reflected when the analysis results of the log LG are displayed, as will be described in detail later.

[0033] 4, the log management server 20 associates a newly generated item name from among the item names determined using the division keyword KWc with an individually determined item name ID (IDi) and registers it in the item name table 26. That is, the log management server 20 determines whether the target item name has already been registered and registers only unregistered item names in the item name table 26.

[0034] In the example shown in FIG. 6, the three item names "others1", "mac", and "ip" determined from the log LG1 shown in FIG. 4 are registered in association with three item name IDs [1], [2], and [3], respectively. Also, three item names "others1", "mac", and "user" are determined from the log LG2 shown in FIG. 2. Of these, the item names "others1" and "mac" have already been registered. Therefore, "user" is registered in association with the item name ID [4].

[0035] The same applies to logs LG3 and LG4. For example, the item name "others2" shown in Fig. 6 is an item name generated for the second substring "web" in log LG3. Note that, in the default state, the log management server 20 may set the display / hide status of each of the multiple item names to "display" for all, and set the display order to the same order as the item name ID (IDi).

[0036] The value table 27 defines the correspondence between the value ID (IDv) and the value, as shown in Fig. 7. During the process described in Fig. 4, the log management server 20 associates a newly generated value from among the values ​​determined using the division keyword KWc with an individually determined value ID (IDv) and registers it in the value table 27. That is, the log management server 20 determines whether the target value has already been registered, and registers only unregistered values ​​in the value table 27.

[0037] In the example shown in FIG. 7, three values ​​"login", "x:x:x:x:x:x", and "XXXX" determined from the log LG1 shown in FIG. 4 are linked to three value IDs [1], [2], and [3] and registered. Also, three values ​​"auth", "y:y:y:y:y:y", and "001" are determined from the log LG2 shown in FIG. 2. These are linked to three value IDs [4]-[6] and registered.

[0038] Furthermore, five values, "login", "web", "002", "YYYY", and "VDx", are determined from log LG3 shown in Figure 2. Of these, "login" has already been registered. Therefore, the remaining four values ​​are registered in association with value IDs [7]-

[10] , respectively. The same applies to log LG4.

[0039] 8, the correspondence table 28 defines the correspondence between a log ID (IDg), an item name ID (IDi), and a value ID (IDv). While the log management server 20 performs registration in the log table 25, the item name table 26, and the value table 27 described above, it also performs registration in the correspondence table 28 in parallel. That is, the log management server 20 registers in the correspondence table 28 the correspondence between a log ID (IDg), one or more item name IDs (IDi) corresponding to the log ID (IDg), and one or more value IDs (IDv) corresponding to the one or more item name IDs (IDi), respectively.

[0040] 8, three item name IDs [1], [2], and [3], and therefore three item names "others1", "mac", and "ip", are associated with the log ID [1]. Three value IDs [1], [2], and [3], and therefore three values ​​"login", "x:x:x:x:x:x", and "XXXX" are associated with the three item names "others1", "mac", and "ip", respectively.

[0041] Furthermore, three item name IDs [1], [2], and [4], and therefore three item names "others1", "mac", and "user", are associated with log ID [2]. Three value IDs [4], [5], and [6], and therefore three values ​​"auth", "y:y:y:y:y:y", and "001", are associated with the three item names "others1", "mac", and "user", respectively. The same is true for log IDs [3] and [4].

[0042] Fig. 9 is a schematic diagram showing an example of a log analysis result presented by the log management server 20 in Fig. 1. The log management server 20 presents the item names and values ​​for each log LG to a user, for example, a network administrator, based on the correspondence table 28 shown in Fig. 8. That is, the log management server 20 presents the multiple item names for each log LG and the values ​​for each of the multiple item names to the network administrator, as shown in Fig. 9.

[0043] For example, the line "No. 1" in Figure 9 presents the date and time of receipt and the IP address IPA1 of the sending device based on log ID [1], as well as the values ​​"login", "x:x:x:x:x:x", and "XXXX" for the three item names "others1", "mac", and "ip" associated with log ID [1]. The line "No. 2" presents the date and time of receipt and the IP address IPA2 of the sending device based on log ID [2], as well as the values ​​"auth", "y:y:y:y:y:y", and "001" for the three item names "others1", "mac", and "user" associated with log ID [2].

[0044] 9, the item names are presented, or in other words, displayed, in the order of item name IDs [1], [5], [2], [3], [4], [6], and [7]. This display order is determined by reflecting the registered contents of the display order in the item name table 26 shown in FIG. 6. Furthermore, the item name ID [7] is hidden, and in this example, it is shaded for convenience of description. The non-display of this item name ID [7] is determined by reflecting the registered contents of display / non-display in the item name table 26 shown in FIG. 6. In this way, the network administrator can flexibly change the display contents so that the log analysis results are easier to interpret.

[0045] As a comparative example, when using a general log management server, a network administrator must manually set analysis rules in advance to analyze the log LG. The analysis rules define the format of the log LG, such as what information is arranged in what order within the log LG, using specialized character string expressions, symbolic expressions, etc. Setting the analysis rules involves, for example, setting item names and the position of values ​​for each item name. However, setting the analysis rules requires a certain degree of specialized knowledge, such as knowledge of representation methods and knowledge about networks, and may also require a certain amount of effort.

[0046] On the other hand, by using the log management server 20 according to the embodiment described above, it is possible to automatically extract item names and values ​​corresponding to the item names without requiring much specialized knowledge or effort. That is, instead of setting rules for analysis, the network administrator can have the log management server 20 perform analysis by simply registering the keywords in the keyword setting table 24 as shown in FIG. 3. As a result, it is possible to achieve easier and more efficient network management. Furthermore, by inputting settings for display / hide and display order as shown in FIG. 6, it is possible to further improve the readability of the log analysis results, thereby further achieving easier and more efficient network management.

[0047] <About various modified examples> 1, the log management server 20 is provided on the internal network 10. However, the log management server 20 may be provided as a cloud server on the external network 11. In this case, for example, the authentication server 16 and the like may also be provided as cloud servers.

[0048] In the example shown in FIG. 3, the network administrator registers keywords in the keyword setting table 24. At this time, the log management server 20 may, for example, count the number of times symbols appear in multiple logs LG received in the past, and present the results to the network administrator as a ranking table. Based on the ranking table, the network administrator can determine, for example, separator keywords KWb and division keywords KWc. Alternatively, the log management server 20 may automatically determine separator keywords KWb and division keywords KWc based on the ranking table.

[0049] In the example shown in Fig. 4, the log management server 20 automatically assigns the item name "others1" to the substring SBSG that does not include the division keyword KWc, based on the order of the substring SBSG. However, the method for assigning the item name is not limited to this. For example, the log management server 20 may assign the item name to a unique value for each source device.

[0050] <Log management server configuration> Fig. 10 is a block diagram showing an example of the hardware configuration of the main parts of the log management server 20 in Fig. 1. The log management server 20 shown in Fig. 10 is configured by a computer and includes a processor 35, a memory 22, a communication interface (IF) 36, and a bus 37 connecting these. The memory 22 includes a random access memory (RAM) and a nonvolatile storage medium. The nonvolatile storage medium may be configured by, for example, a solid state drive (SSD) or a hard disk drive (HDD).

[0051] The communication interface 36 is an interface connected to a network, which in the case of FIG. 1 is the internal network 10. The memory 22, for example, a nonvolatile storage medium, holds a log management program 38. The processor 35 executes the log management program 38, which has been loaded from the nonvolatile storage medium to RAM in the memory 22. In this way, the log management program 38 causes a computer such as that shown in FIG. 10 to function as the log management server 20.

[0052] The log management server 20 may also have a display 39 and a user interface 40, as appropriate. The user interface 40 is a keyboard, mouse, or the like that accepts operational input from a user, for example, a network administrator. However, the display 39 and the user interface 40 may also be realized using, for example, a terminal device TM that can operate the log management server 20 via the internal network 10, for example, a terminal device TM of the network administrator.

[0053] Fig. 11 is a block diagram showing an example of the functional configuration of the main parts of the log management server 20 in Fig. 1. The log management server 20 shown in Fig. 11 includes a storage unit realized by the memory 22, as well as a user setting unit 45, a division processing unit 46, an association processing unit 47, and a user presentation unit 48. That is, the computer shown in Fig. 10 functions as the storage unit (22), the user setting unit 45, the division processing unit 46, the association processing unit 47, and the user presentation unit 48 shown in Fig. 11 by the processor 35 executing the log management program 38.

[0054] 1, the storage unit, i.e., memory 22, stores the received log LG data as well as the keyword setting table 24, log table 25, item name table 26, value table 27, and association table 28. A user setting unit 45 accepts setting inputs to the keyword setting table 24 and item name table 26 by a user, for example, a network administrator.

[0055] With regard to the keyword setting table 24, the user setting unit 45 accepts setting inputs of analysis target keywords KWa, delimiting keywords KWb, and division keywords KWc, as described in Fig. 3. With regard to the item name table 26, the user setting unit 45 accepts setting inputs regarding display / non-display for each of the registered multiple item names, and setting inputs regarding the display order of the multiple item names, as described in Figs.

[0056] As described in Fig. 3, each time the division processing unit 46 receives a log LG, the division processing unit 46 determines whether the received log LG is to be analyzed based on the analysis target keyword KWa. Then, for the log LG to be analyzed, the division processing unit 46 divides the character string SG written in the log LG into a plurality of sub-character strings SBSG using the delimiting keyword KWb as a delimiter, as described in Fig. 4.

[0057] Furthermore, the division processing unit 46 divides each of the multiple substrings SBSG into two divided strings SPSGi and SPSGv using the division keyword KWc as a delimiter, and sets one of them (SPSGi) as the item name and the other (SPSGv) as the value. At this time, if there is a substring SBSG that does not include the division keyword KWc, the division processing unit 46 sets the substring SBSG as the value and automatically generates an item name corresponding to the set value.

[0058] After determining the item names and values ​​in this manner, the division processing unit 46 registers them in various tables. Specifically, as described in Fig. 5, the division processing unit 46 links the reception date and time of the log LG and the identification information of the device that sent the log LG to an individually determined log ID (IDg) and registers them in the log table 25. Also, as described in Fig. 6, the division processing unit 46 links a new item name generated from the determined item names to an individually determined item name ID (IDi) and registers it in the item name table 26. Also, as described in Fig. 7, the division processing unit 46 links a new value generated from the determined values ​​to an individually determined value ID (IDv) and registers it in the value table 27.

[0059] The association processing unit 47 registers the correspondence between the log LG, the item name included in the log LG, and the value corresponding to the item name in the association table 28. In this example, the division processing unit 46, in parallel with the registration process in the various tables described above, sequentially outputs combination information of the log ID (IDg), the item name ID (IDi), and the value ID (IDv) to the association processing unit 47. The association processing unit 47 sequentially registers the correspondence between the log ID (IDg), the item name ID (IDi), and the value ID (IDv) in the association table 28 based on the combination information.

[0060] The user presentation unit 48 presents the item names and values ​​for each log LG to a user, for example, a network administrator, as shown in Fig. 9 based on the correspondence table 28, and more precisely, based on the log table 25, the item name table 26, and the value table 27. That is, the user presentation unit 48 displays the log analysis results as shown in Fig. 9 on the display 39. At this time, the user presentation unit 48 also determines whether to display or hide the multiple item names and the values ​​for each of the multiple item names for each log LG and the display order based on the setting input to the item name table 26 by the user setting unit 45.

[0061] <Major Effects of the First Embodiment> As described above, the log management server according to the first embodiment can automatically determine the item names and values ​​by dividing the character strings written in the log into two parts using the dividing keyword. As a result, it is no longer necessary to set rules for analysis, which requires a certain degree of specialized knowledge and effort, and it is possible to achieve easier and more efficient network management.

[0062] (Second embodiment) <Log management server configuration> Fig. 12 is a block diagram showing an example of the functional configuration of the main parts of a log management server according to the second embodiment. Fig. 13 is a schematic diagram showing an example of the configuration of the log linking setting table 50 in Fig. 12. The log management server 20a shown in Fig. 12 is also applied to the log management system shown in Fig. 1. The log management server 20a differs from the configuration example shown in Fig. 11 in the following two points.

[0063] The first difference is that the storage unit, i.e., memory 22, further holds a log linking setting table 50. Accordingly, a user setting unit 45a accepts setting inputs to the log linking setting table 50. The second difference is that the log management server 20a further includes a related log linking unit 51. That is, the log management program 38 shown in FIG. 10 causes the processor 35 to further function as the related log linking unit 51.

[0064] In the log linking setting table 50, a linking value type LT and a sharing value type ST, as shown in FIG. 13, can be registered via the user setting unit 45a. The linking value type LT and the sharing value type ST are provided in advance as multiple options for value types that can be determined by the log management server 20a. Examples of the determineable value types include IP addresses, MAC addresses, and URLs (Uniform Resource Locators). These types have unique data formats. Therefore, the log management server 20a can determine these types based on the unique data formats.

[0065] The user setting unit 45a allows a user, for example, a network administrator, to select a predetermined type from multiple options, i.e., multiple types, as the linking value type LT and / or additionally as the sharing value type ST. The related log linking unit 51 detects values ​​belonging to the predetermined type set as the linking value type LT from among the multiple logs LG based on the log analysis results generated by the user presentation unit 48. Then, the related log linking unit 51 links two or more logs LG containing the same value as related logs.

[0066] The related log linking unit 51 adds information indicating the related log to the log analysis result. That is, the related log linking unit 51 adds information to the log analysis result to allow the network administrator to recognize the related log. Furthermore, the related log linking unit 51 detects values ​​belonging to a predetermined type set in the shared value type ST from the related log. Then, the related log linking unit 51 processes the log analysis result so that the detected value is shared in each row representing the analysis result of the related log. Note that the network administrator can omit registering the shared value type ST and have the related log linking unit 51 only link the logs LG.

[0067] <Log management server operation> FIG. 14 is a diagram showing an example of a log LG received by the log management server 20a in FIG. 12. FIG. 14 shows five logs LG1-LG5 received in order. Of these, logs LG1-LG4 are the same as those in FIG. 2. Log LG5, for example, relates to unauthorized access directed to "URL1" from a terminal device TM having an IP address "XXXX." Log LG5 corresponds, for example, to log LGc in FIG. 1.

[0068] Fig. 15 is a schematic diagram showing an example of a log analysis result presented by the log management server 20a in Fig. 12. The log management server 20a performs the analysis process described in the first embodiment, and presents the log analysis result shown in Fig. 15 to the network administrator using the user presentation unit 48. In the log analysis result shown in Fig. 15, a line "No. 5" associated with the analysis process of log LG5 has been added to Fig. 9.

[0069] In the row "No. 5," the IP address IPA3 is, for example, the IP address of the proxy server 17 in Figure 1. Also, the value corresponding to the item name ID[1], i.e., the item name "others1," is "XXXX." The value corresponding to the item name ID[9], i.e., the item name "others4," is "URL1."

[0070] Here, it is assumed that "IP address" and "URL" are registered in the linking value type LT and the sharing value type ST, respectively. In this case, the related log linking unit 51 detects the IP address "XXXX" based on the linking value type LT, and links two or more logs LG containing the "XXXX", i.e., the row "No. 1" and the row "No. 5", as related logs. Then, the related log linking unit 51 adds, as information representing the related logs, for example, a link LK to the row "No. 5" to the row "No. 1" and a link LK to the row "No. 1" to the row "No. 5".

[0071] Furthermore, the related log linking unit 51 detects "URL1", which is a URL, from the related logs based on the sharing value type ST. Then, the related log linking unit 51 shares the detected "URL1" with each row corresponding to the related logs. In this example, "URL1" is added to the row "No. 1", which does not originally contain a URL.

[0072] Using such log analysis results, a network administrator can recognize, for example, by referring to line "No. 5," that unauthorized access to "URL1" has occurred from terminal device TM having IP address "XXXX." However, the network administrator cannot obtain information such as the MAC address of the terminal device TM or how the terminal device TM was logged in.

[0073] 15, by linking the "No. 5" line with the "No. 1" line as related logs, the network administrator can easily obtain necessary information such as the MAC address of the target terminal device TM, the login history, etc. Also, by referring to only the "No. 1" line, for example, the network administrator can recognize to some extent that unauthorized access to "URL1" has been made from the terminal device TM having the IP address "XXXX" and MAC address "x:x:x:x:x:x".

[0074] <Major Effects of the Second Embodiment> As described above, by using the log management server according to the second embodiment, it is possible to obtain the same effects as those described in the first embodiment. Furthermore, by linking related logs and presenting them to the user, it is possible to further simplify or streamline network management.

[0075] The invention made by the inventor has been specifically described above based on the embodiments, but the present invention is not limited to the above embodiments and can be modified in various ways without departing from the spirit of the invention. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0076] For example, the various programs described above may be stored in a non-transitory, tangible, computer-readable recording medium and then supplied to a computer device. Examples of such recording media include magnetic recording media such as hard disk drives, optical recording media such as DVDs (Digital Versatile Discs) and Blu-ray Discs (registered trademarks), and semiconductor memories such as flash memories. [Explanation of symbols]

[0077] 10...internal network, 11...external network, 20...log management server, 22...memory, 24...keyword setting table, 25...log table, 26...item name table, 27...value table, 28...association table, 38...log management program, 45...user setting section, 46...splitting processing section, 47...association processing section, 48...user presentation section, 50...log linking setting table, 51...related log linking section, IDg: log ID, IDi: item name ID, IDv: value ID, KWb...separating keyword, KWc...splitting keyword, LG...log, LT...value type for linking, SBSG...substring, SG...string, SPSGi, SPSGv...split string

Claims

1. A log management server that manages logs received via a network, a memory for storing division keywords and a correspondence table; a division processing unit that divides a character string written in the log into two divided character strings using the division keyword as a delimiter, and determines one of the two divided character strings as an item name and the other as a value; an association processing unit that registers, in the association table, a correspondence relationship between the log, the item name included in the log, and the value corresponding to the item name; a user presentation unit that presents the item name and the value for each log to a user based on the association table; Equipped with Log management server.

2. 2. The log management server according to claim 1, The memory holds delimiting keywords; the division processing unit divides the character string described in the log into a plurality of sub-character strings using the delimiting keyword as a delimiter, and determines the item name and the value for each of the plurality of sub-character strings using the delimiting keyword; Log management server.

3. 3. The log management server according to claim 2, When there is a substring that does not include the division keyword among the plurality of substrings, the division processing unit sets the substring as the value and automatically generates the item name corresponding to the set value. Log management server.

4. 3. The log management server according to claim 2, the memory holds a log table, an item name table, and a value table; The division processing unit The date and time of receipt of the log and the identification information of the device that transmitted the log are linked to an individually determined log ID and registered in the log table; a newly generated item name from among the item names determined using the division keyword is associated with an individually determined item name ID and registered in the item name table; a value newly generated from the values ​​determined using the division keyword is associated with an individually determined value ID and registered in the value table; the association processing unit registers the association relationship between the log ID, the item name ID, and the value ID in the association table; Log management server.

5. 5. The log management server according to claim 4, a user setting unit that receives setting input regarding display / non-display of each of the plurality of item names registered in the item name table and setting input regarding a display order of the plurality of item names; the user presentation unit presents to the user the plurality of item names for each log and the values ​​for each of the plurality of item names based on setting input in the user setting unit; Log management server.

6. 2. The log management server according to claim 1, a user setting unit that allows a user to select a predetermined type from a plurality of options that are provided in advance as types of the distinguishable value; a related log linking unit that detects the value belonging to the predetermined type from among the plurality of logs and links two or more logs including the same value as each other as related logs; Equipped with Log management server.

7. A log management program that manages logs received via a network, Computer, a storage unit for storing division keywords and a correspondence table; a division processing unit that divides the character string described in the log into two divided character strings using the division keyword as a delimiter, and determines one of the two divided character strings as an item name and the other as a value; a correspondence processing unit that registers, in the correspondence table, a correspondence relationship between the log, the item name included in the log, and the value corresponding to the item name; a user presentation unit that presents the item name and the value for each log to a user based on the correspondence table; A log management program to function as a

8. 8. The log management program according to claim 7, The storage unit holds delimiting keywords, the division processing unit divides the character string described in the log into a plurality of sub-character strings using the delimiting keyword as a delimiter, and determines the item name and the value for each of the plurality of sub-character strings using the delimiting keyword; Log management program.

9. 9. The log management program according to claim 8, When there is a substring that does not include the division keyword among the plurality of substrings, the division processing unit sets the substring as the value and automatically generates the item name corresponding to the set value. Log management program.

10. 9. The log management program according to claim 8, the storage unit holds a log table, an item name table, and a value table; The division processing unit The date and time of receipt of the log and the identification information of the device that transmitted the log are linked to an individually determined log ID and registered in the log table; a newly generated item name from among the item names determined using the division keyword is associated with an individually determined item name ID and registered in the item name table; a value newly generated from the values ​​determined using the division keyword is associated with an individually determined value ID and registered in the value table; the association processing unit registers the association relationship between the log ID, the item name ID, and the value ID in the association table; Log management program.

11. 11. The log management program according to claim 10, the computer is further caused to function as a user setting unit that receives setting input regarding display / non-display of each of the plurality of item names registered in the item name table and setting input regarding the display order of the plurality of item names; the user presentation unit presents to the user the plurality of item names for each log and the values ​​for each of the plurality of item names based on setting input in the user setting unit; Log management program.

12. 8. The log management program according to claim 7, The computer further comprises: a user setting unit that allows a user to select a predetermined type from a plurality of options that are provided in advance as types of the distinguishable value; a related log linking unit that detects the value belonging to the predetermined type from among the plurality of logs and links two or more logs including the same value as each other as related logs; A log management program to function as a

Images