GENERATION PROGRAM, GENERATION METHOD, AND INFORMATION PROCESSING APPARATUS

Abstract

To efficiently extract useful parts from log data. [Solution] A computer acquires first partial log data extracted from first log data output by an information processing system. The computer inputs the first partial log data into a trained machine learning model, and generates a search program using the machine learning model to search second log data for second partial log data that has a pattern common to the first partial log data.

Description

[Technical Field]

[0001] The present invention relates to a generation program, a generation method, and an information processing device. [Background technology]

[0002] An information processing system outputs log data that records the operating status of the information processing system. The log data indicates various events such as the start and stop of devices, the start and stop of service processes, communication with other devices, access authentication, and the occurrence of errors. Log data is generally large in size because it records a variety of events. Operators, such as information processing system administrators, sometimes extract useful parts of the log data for tasks such as fault detection and fault recovery.

[0003] There is a technology that uses regular expressions to detect key words from source documents and then uses a machine learning model to determine the corresponding translations for the key words. There is also a technology that uses a machine learning model to perform syntax analysis on skill names and search for digital documents related to the skills. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2021-43955 [Patent Document 2] International Publication No. 2022 / 226646 Summary of the Invention [Problem to be solved by the invention]

[0005] For example, because the size of log data is large, manually extracting useful parts for a certain purpose, such as error events related to disaster recovery, from the log data places a heavy burden on the operator. Therefore, it is conceivable that a computer could assist in extracting parts of the log data.

[0006] However, there are various log data formats, and manually creating a program for automatic extraction by understanding the specific formats of useful sections often requires a large programming burden. Furthermore, log data may contain many context-dependent strings, such as device identifiers and event times. Therefore, simply searching for sections similar to partial logs extracted in previous work by string matching may result in low extraction accuracy. Therefore, in one aspect, the present invention aims to efficiently extract useful sections from log data. [Means for solving the problem]

[0007] In one aspect, a generation program is provided that causes a computer to execute a process of acquiring first partial log data extracted from first log data output by an information processing system, inputting the first partial log data into a trained machine learning model, and using the machine learning model to generate a search program for searching second partial log data that has a pattern common to the first partial log data from second log data. [Effects of the Invention]

[0008] In one aspect, useful parts can be extracted efficiently from log data. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an information processing apparatus according to a first embodiment. [Figure 2] FIG. 10 illustrates an example of hardware of an information processing apparatus according to a second embodiment. [Figure 3] 10A and 10B are diagrams illustrating examples of a failure report file and a log file. [Figure 4] FIG. 10 is a diagram illustrating an example of a flow of important log extraction using a large-scale language model. [Figure 5] FIG. 1 is a diagram illustrating an example of the structure of a large-scale language model. [Figure 6] FIG. 10 is a diagram illustrating an example of a partial log file. [Figure 7] FIG. 10 is a diagram illustrating an example of input text. [Figure 8] FIG. 10 is a diagram (continued) showing an example of input text. [Figure 9] FIG. 10 is a diagram illustrating an example of output text. [Figure 10] FIG. 2 is a block diagram illustrating an example of functions of the information processing device. [Figure 11] 10 is a flowchart illustrating an example of a procedure for extracting important logs. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, this embodiment will be described with reference to the drawings. (a) First embodiment FIG. 1 is a diagram illustrating an information processing device according to a first embodiment. The information processing device 10 according to the first embodiment supports the extraction of useful points from log data. For example, the information processing device 10 supports the extraction of points related to a failure in an information processing system from the log data. The information processing device 10 may be a client device or a server device. The information processing device 10 may also be called a computer or a generating device.

[0011] The information processing device 10 includes a storage unit 11 and a processing unit 12. The storage unit 11 may be a volatile memory such as a random access memory (RAM), or may be a non-volatile storage such as a hard disk drive (HDD) or a solid state drive (SSD).

[0012] The processing unit 12 is, for example, a processor such as a central processing unit (CPU), a graphics processing unit (GPU), or a digital signal processor (DSP). However, the processing unit 12 may also include an electronic circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). The processor executes a program stored in a memory such as a RAM. A processor may also be called a processor circuitry. A collection of processors may also be called a multiprocessor or simply a "processor." Different processing steps among the multiple processing steps described below may be executed by different processors.

[0013] The storage unit 11 stores partial log data 17. The partial log data 17 is extracted from the log data 15 output by the information processing system. The information processing system may include hardware elements such as a server computer, a client computer, a storage device, and a communication device as components. The information processing system may also include software elements such as application software, middleware, an operating system (OS), an authentication process, and a monitoring process.

[0014] The log data 15 is data that records the operating status of the information processing system. Typically, the log data 15 is large data. The log data 15 indicates various events that have occurred in the components of the information processing system. For example, the log data 15 indicates events such as the start and stop of a device, the start and stop of a service process, communication with other devices, access authentication, and the occurrence of an error.

[0015] Typically, the log data 15 is written in a natural language and includes character strings in that natural language. The log data 15 may include the time of event occurrence, the type of event, a message briefly describing the content of the event, and the like. The log data 15 may include multiple records corresponding to multiple events in chronological order. The log data 15 may be output for each component of the information processing system. Different log data output from different types of components may be written in different formats.

[0016] The partial log data 17 is a portion of the log data 15 that is determined to be useful for a certain purpose. The partial log data 17 may be a portion that has been referenced or extracted by a user in the past. For example, the partial log data 17 is a portion that an engineer has determined to be related to a failure when a failure occurs in an information processing system. The partial log data 17 may be a portion that has been referenced by failure report data that indicates a past failure.

[0017] The partial log data 17 may be stored in a state where it has been extracted from the log data 15. Furthermore, the information processing device 10 may extract the partial log data 17 from the accumulated log data 15, or may extract the partial log data 17 from data indicating past operations, such as fault report data. Furthermore, the information processing device 10 may accept the partial log data 17 from a user, or may receive the partial log data 17 from another information processing device.

[0018] The processing unit 12 generates a search program 14 using the trained machine learning model 13. The machine learning model 13 may be stored in the storage unit 11 or in another information processing device. In the latter case, the processing unit 12 may transmit input data to the other information processing device and receive output data of the machine learning model 13 from the other information processing device.

[0019] Typically, the machine learning model 13 is a natural language processing model that generates output text including natural language character strings from input text including natural language character strings. This natural language processing model is sometimes called a large language model (LLM). The machine learning model 13 may be a neural network with trained parameter values. The machine learning model 13 may be a recurrent neural network (RNN) or a neural network with an attention mechanism such as a transformer.

[0020] The search program 14 is a program capable of searching for partial log data 18 having a common pattern with partial log data 17 from among log data 16 that is different from log data 15. The log data 16 is, for example, output after the log data 15. The information processing systems that output the log data 15 and 16 may be the same or different.

[0021] Typically, the common pattern is a common character string pattern. It can also be said that the partial log data 18 is similar to the partial log data 17. However, the partial log data 18 does not have to be an exact match with the partial log data 17. For example, the partial log data 18 is a portion of the log data 16 that shares a keyword or format indicating an event type with the partial log data 17. However, the log data 15 and 16 may contain character strings unique to each event, such as an identifier of a component element or an event time. The identifiers and event times of the partial log data 18 may be different from those of the partial log data 17.

[0022] The search program 14 may be source code expressed as a character string. For example, the search program 14 includes a regular expression that defines a character string pattern. The processing unit 12 generates the search program 14 by inputting partial log data 17 to the machine learning model 13. The processing unit 12 may cause the machine learning model 13 to generate the search program 14 and use the output of the machine learning model 13 as the search program 14. The processing unit 12 may input, in addition to the partial log data 17, a directive that instructs the generation of a search program. The processing unit 12 may also generate the search program 14 by processing the output of the machine learning model 13.

[0023] The processing unit 12 may store the search program 14 in a nonvolatile storage, may display it on a display device, or may transmit it to another information processing device. The processing unit 12 may also execute the search program 14 to extract partial log data 18 from the log data 16. In this case, the processing unit 12 may store the partial log data 18 in a nonvolatile storage, may display it on a display device, or may transmit it to another information processing device.

[0024] The generated search program 14 can be used for various log data. For example, in a single failure, the search program 14 is executed for log data of different components. Also, for example, in multiple failures, the search program 14 is commonly used. The search program 14 may be executed by another information processing device. Note that, if the search program 14 is a regular expression itself, the search program 14 may be executed on platform software for interpreting the regular expression.

[0025] As described above, the information processing device 10 of the first embodiment acquires partial log data 17 extracted from log data 15 output by an information processing system. By inputting the partial log data 17 to the trained machine learning model 13, the information processing device 10 generates a search program 14 for searching the log data 16 for partial log data 18 having a pattern common to the partial log data 17, using the machine learning model 13.

[0026] This reduces the workload of extracting useful parts related to a certain purpose from the log data 16, and improves the efficiency of extracting useful parts from the log data 16. For example, when a failure occurs in an information processing system, parts related to the failure can be efficiently extracted.

[0027] It is conceivable that an operator could analyze the log data 15, understand the specific format of the partial log data 17, and manually create the search program 14 through programming. However, since the log data format varies depending on the components of the information processing system, such programming would be a heavy burden. In contrast, the information processing device 10 can generate the search program 14 from the partial log data 17.

[0028] Alternatively, the worker may input the entire log data 16 into the machine learning model 13 and have the machine learning model 13 directly extract important parts of the log data 16. However, because the size of the log data 16 is large, the machine learning model 13 may not accept the log data 16. Furthermore, the log data 16 may contain many special words and special formats that do not appear in everyday sentences, which may result in low summarization accuracy of the machine learning model 13. In response to this, the search program 14 can extract parts similar to the partial log data 17.

[0029] Alternatively, the worker may search for a portion of the log data 16 that corresponds to the partial log data 17 by directly matching strings between the log data 16 and the partial log data 17. However, the log data 16 and the partial log data 17 may contain strings that are unique to each event, such as identifiers of components or event times. Therefore, it is not easy to search for a portion similar to the partial log data 17 by simple string matching. In response to this, the information processing device 10 can use the generalization ability of the machine learning model 13 to generate a search program 14 that searches for a portion of the partial log data 17 that has a characteristic pattern.

[0030] Alternatively, the operator may input the log data 16 and the partial log data 17 into the machine learning model 13 and have the machine learning model 13 directly extract portions of the log data 16 that are similar to the partial log data 17. However, due to limitations on the input data size, the machine learning model 13 may not accept the log data 16 and the partial log data 17. Furthermore, calling the machine learning model 13 for each combination of the log data 16 and the partial log data 17 requires a large amount of calculation and a long execution time. In contrast, the search program 14 itself requires a small amount of calculation and a short execution time. Once the information processing device 10 generates the search program 14, the search program 14 can be used for various log data.

[0031] (b) Second embodiment FIG. 2 is a diagram illustrating an example of hardware of an information processing device according to the second embodiment. The information processing device 100 according to the second embodiment supports troubleshooting work when a failure occurs in an information processing system. The information processing system includes various devices such as server computers, storage devices, and communication devices. These devices output log files according to the type of device and the type of software running on the device. An engineer performing troubleshooting work searches the log files for important points related to the failure. The information processing device 100 corresponds to the information processing device 10 according to the first embodiment.

[0032] The information processing device 100 includes a CPU 101, a RAM 102, a HDD 103, a GPU 104, an input interface 105, a medium reader 106, and a communication interface 107. The CPU 101 corresponds to the processing unit 12 in the first embodiment. The RAM 102 or the HDD 103 corresponds to the storage unit 11 in the first embodiment.

[0033] The CPU 101 is a processor that executes program instructions. The CPU 101 loads programs and data from the HDD 103 into the RAM 102 and executes the programs. The information processing device 100 may have multiple processors.

[0034] The RAM 102 is a volatile semiconductor memory that temporarily stores programs executed by the CPU 101 and data used in calculations by the CPU 101. The information processing device 100 may have a type of volatile memory other than a RAM.

[0035] The HDD 103 is a non-volatile storage that stores software programs such as an operating system, middleware, and application software, as well as data. The information processing device 100 may also have other types of non-volatile storage, such as an SSD or flash memory.

[0036] The GPU 104 performs image processing in cooperation with the CPU 101 and outputs an image to a display device 111 connected to the information processing device 100. The display device 111 is, for example, a CRT (Cathode Ray Tube) display, a liquid crystal display, an organic EL (Electro Luminescence) display, or a projector.

[0037] The GPU 104 may also be used as a general purpose computing on graphics processing unit (GPGPU). The GPU 104 may execute a program in response to an instruction from the CPU 101. The information processing device 100 may include a volatile semiconductor memory other than the RAM 102 as a GPU memory.

[0038] The input interface 105 receives an input signal from an input device 112 connected to the information processing device 100. The input device 112 is, for example, a mouse, a touch panel, or a keyboard. A plurality of input devices may be connected to the information processing device 100.

[0039] The medium reader 106 is a reading device that reads programs and data recorded on the recording medium 113. The recording medium 113 is, for example, a magnetic disk, an optical disk, or a semiconductor memory. Magnetic disks include flexible disks (FDs) and HDDs. Optical disks include compact discs (CDs) and digital versatile discs (DVDs). The medium reader 106 copies the programs and data read from the recording medium 113 to other recording media such as the RAM 102 or the HDD 103. The read programs may be executed by the CPU 101.

[0040] The recording medium 113 may be a portable recording medium. The recording medium 113 may be used to distribute programs and data. The recording medium 113 and the HDD 103 may also be referred to as computer-readable recording media.

[0041] The communication interface 107 communicates with other information processing devices via the network 114. The communication interface 107 may be a wired communication interface connected to a wired communication device such as a switch or a router, or may be a wireless communication interface connected to a wireless communication device such as a base station or an access point.

[0042] 3 is a diagram showing examples of a failure report file and a log file. The information processing device 100 stores a plurality of failure report files, including a failure report file 131, in a database. The failure report file 131 indicates the failure response work for a single past failure. Typically, the failure report file 131 is a text file written in natural language.

[0043] The failure report file 131 includes the date and time when the failure occurred. The failure report file 131 also includes details of the failure, such as a communication error, and details of the work performed to resolve the failure. The failure report file 131 also includes partial logs that are determined to be important sections related to the failure, from the logs included in the log file at the time the failure occurred. Typically, the partial logs included in the failure report file 131 are text data excerpted from the log file. However, these partial logs may also be image data that captures a portion of the log file.

[0044] When a new failure is detected, an engineer managing the information processing system searches for important parts related to the failure from multiple log files, including log file 132. Log file 132 is the latest log file saved at the time of the failure response work, and includes logs from at least a certain period of time before the time of the failure response work.

[0045] Each component of an information processing system outputs a log file. For example, an authentication process on a server computer outputs an authentication log. For example, a database management process on a server computer outputs a database access log. For example, a communication process or communication device on a server computer outputs a communication log.

[0046] Log files for different types of components may be written in different formats. Log file 132 contains multiple records in chronological order, each of which associates an event occurrence time with the event content. Events may indicate, for example, the start of a process, the success of a request, the failure of a request, a timeout, etc.

[0047] An engineer working to handle the failure will extract important logs that indicate important points related to the current failure from the log file 132. The information processing device 100 of the second embodiment supports the extraction of important logs from the log file 132. The information processing device 100 estimates that a log similar to a past partial log included in the failure report file 131 is an important log, and presents the estimated important log to the engineer.

[0048] 4 is a diagram showing an example of the flow of important log extraction using a large-scale language model. The information processing device 100 uses a large-scale language model 150 to extract important logs. The large-scale language model 150 is a machine learning model trained using large-scale training data, and is a natural language processing model that generates output text from input text. The large-scale language model 150 is an interactive model that outputs character strings in accordance with directives included in the input text.

[0049] The large-scale language model 150 may be trained by the information processing device 100 or by another information processing device. Furthermore, the large-scale language model 150 may be stored in the information processing device 100 or may be stored in another information processing device. The other information processing device may provide a service that causes the large-scale language model 150 to generate text. The information processing device 100 may transmit input text to the other information processing device and receive output text corresponding to the input text from the other information processing device.

[0050] The information processing device 100 reads out the failure report files 141a, 141b, and 141c from the failure report database. The information processing device 100 extracts the partial logs cited by the failure report file 141a from the failure report file 141a and generates the partial log file 142a indicating the extracted partial logs. Similarly, the information processing device 100 extracts the partial logs from the failure report file 141b to generate the partial log file 142b, and extracts the partial logs from the failure report file 141c to generate the partial log file 142c.

[0051] However, if the partial logs have already been separated and accumulated, the information processing device 100 may omit extracting the partial logs. Furthermore, if a partial log included in a certain failure report file is image data, the information processing device 100 converts the image data into text data using character recognition technology. The information processing device 100 may also convert the image data into text data using an image recognition model, which is a trained machine learning model. Furthermore, if the large-scale language model 150 has a character recognition function, the information processing device 100 may also convert the image data into text data using the large-scale language model 150.

[0052] The information processing device 100 generates input text including a partial log indicated by the partial log file 142a, and inputs the input text to the large-scale language model 150. This input text further includes an instruction, sometimes called a prompt. The instruction instructs the generation of a regular expression for searching for a string similar to the specified partial log. As a result, the large-scale language model 150 outputs the regular expression 143a as output text. The information processing device 100 saves the output regular expression 143a.

[0053] Similarly, the information processing device 100 generates input text including the partial log indicated by the partial log file 142b, and inputs the input text to the large-scale language model 150. The information processing device 100 saves the regular expression 143b output by the large-scale language model 150. The information processing device 100 generates input text including the partial log indicated by the partial log file 142c, and inputs the input text to the large-scale language model 150. The information processing device 100 saves the regular expression 143c output by the large-scale language model 150.

[0054] When a failure is detected, the information processing device 100 obtains the latest log file 144. The regular expressions 143a, 143b, and 143c may be generated and saved before the failure is detected, or may be generated after the failure is detected. The information processing device 100 executes the regular expression 143a on the log file 144 to search for a character string matching the regular expression 143a from the log file 144. If a matching character string is detected, the information processing device 100 extracts the character string and adds it to the extraction result text 145.

[0055] Similarly, the information processing device 100 searches the log file 144 for a character string that matches regular expression 143b, and if a corresponding character string is detected, extracts the character string and adds it to extraction result text 145. The information processing device 100 searches the log file 144 for a character string that matches regular expression 143c, and if a corresponding character string is detected, extracts the character string and adds it to extraction result text 145. The information processing device 100 outputs extraction result text 145 to an engineer who will perform the troubleshooting work.

[0056] In this way, the information processing device 100 reads out from the failure report database a plurality of partial logs that have been determined to be important parts of past failures. The information processing device 100 generates a plurality of regular expressions from these plurality of partial logs using the large-scale language model 150. The information processing device 100 searches the log of the current failure for character strings that correspond to each of the plurality of regular expressions.

[0057] Note that, in relation to the current failure, the information processing device 100 can also execute the regular expressions 143a, 143b, and 143c on log files other than the log file 144. Furthermore, the information processing device 100 can reuse the regular expressions 143a, 143b, and 143c for subsequent failures. Furthermore, the information processing device 100 may generate a regular expression that combines the regular expressions 143a, 143b, and 143c. For example, the information processing device 100 may generate a combined regular expression that combines the regular expressions 143a, 143b, and 143c with a logical sum, and execute the combined regular expression on the log file 144.

[0058] The large-scale language model 150 may be a neural network or may be implemented using a transformer with an attention mechanism. Transformers are described in the following non-patent document: Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, and Lukasz Kaiser, "Attention Is All You Need," Proc. of the 31st International Conference on Neural Information Processing Systems (NIPS 2017), pages 6000-6010, December 2017. An example of the structure of the large-scale language model 150 will be described below.

[0059] 5 is a diagram showing an example of the structure of a large-scale language model. The large-scale language model 150 is an encoder-decoder type neural network. The large-scale language model 150 has embedding layers 151 and 152, positional coding layers 153 and 154, an encoder 155, a decoder 156, a linear layer 157, and a softmax layer 158.

[0060] The embedding layer 151 converts each of the multiple words included in the input text into a word vector called an embedding or distributed representation. A word vector is a numerical vector with a certain number of dimensions, such as 512 or 1024. Words used in similar contexts are assigned similar word vectors. The correspondence between words and word vectors is determined by a neural network. The embedding layer 151 may be trained together with other layers of the large-scale language model 150 or may be trained in advance.

[0061] The embedding layer 152 converts one or more words that have been determined so far among the words to be included in the output text into word vectors. In the large-scale language model 150, words to be included in the output text are determined one by one in order from the beginning. The correspondence between words and word vectors is the same as that in the embedding layer 151.

[0062] The position coding layer 153 adds a position vector corresponding to the position of the word to the word vector output by the embedding layer 151. The addition of position vectors is sometimes called position encoding. The position vector is a numerical vector with the same number of dimensions as the word vector. For each of the multiple words included in the input text, the position coding layer 153 calculates the numerical value of each dimension included in the position vector using a sine function or cosine function from a non-negative integer indicating the word's position from the beginning.

[0063] The position coding layer 154 adds a position vector according to the position of the word to the word vector output by the embedding layer 152. The method of calculating the position vector is the same as that of the position coding layer 153. For each of one or more words included in the output text, the position coding layer 154 calculates the numerical value of each dimension included in the position vector using a sine function or cosine function from a non-negative integer indicating the ordinal number of the word from the beginning.

[0064] The encoder 155 converts multiple vectors corresponding to multiple words. The encoder 155 includes a self-attention layer 155a, a normalization layer 155b, a feedforward layer 155c, and a normalization layer 155d, in that order. The large-scale language model 150 may have multiple encoders 155 stacked in series. In this case, the first encoder receives vectors from the positional coding layer 153, and the last encoder outputs vectors to the decoder 156.

[0065] The self-attention layer 155a transforms the vectors using an attention mechanism. The self-attention layer 155a has a query matrix, a key matrix, and a value matrix as trained parameter values. The self-attention layer 155a selects one word to focus on from multiple words included in the input text.

[0066] The self-attention layer 155a converts the vector of a word of interest using a query matrix to calculate a vector called a query. The self-attention layer 155a also converts the vector of each of multiple words using a key matrix to calculate a vector called a key. The self-attention layer 155a calculates the inner product of the query and the key as the attention score of each word. The attention score indicates the degree of relevance between the word of interest and each word.

[0067] The self-attention layer 155a converts the vectors of each of the multiple words using a value matrix to calculate a vector called a value. The self-attention layer 155a uses the attention score as a weight to calculate a weighted sum of the values ​​between the multiple words, and outputs the calculated weighted sum as a converted vector for the focused word. The self-attention layer 155a repeats the above process while changing the focused word.

[0068] The normalization layer 155b normalizes the vectors output by the self-attention layer 155a so that the numerical values ​​for each dimension follow a certain distribution. The feedforward layer 155c is a forward neural network. The feedforward layer 155c individually transforms vectors for multiple words using trained parameter values. The normalization layer 155d normalizes the vectors output by the feedforward layer 155c in the same way as the normalization layer 155b.

[0069] The decoder 156 converts vectors of one or more words that have been determined to be included in the output text. The decoder 156 includes, in order, a self-attention layer 156a, a normalization layer 156b, an attention layer 156c, a normalization layer 156d, a feedforward layer 156e, and a normalization layer 156f. The large-scale language model 150 may have multiple decoders 156 stacked in series. In this case, the first decoder receives vectors from the positional encoding layer 154, and the last encoder outputs vectors to the linear layer 157.

[0070] The self-attention layer 156a transforms the vectors using the same attention mechanism as the self-attention layer 155a. The query, key, and value are calculated from the vectors of the words in the output text. The normalization layer 156b normalizes the vectors output by the self-attention layer 156a in the same way as the normalization layer 155b.

[0071] The attention layer 156c converts the word vectors of the output text using an attention mechanism. However, the attention layer 156c calculates queries from the word vectors of the output text and calculates keys and values ​​from the word vectors of the input text. This determines the relevance between the words of the output text and the words of the input text.

[0072] The attention layer 156c selects one word of interest from one or more words included in the output text. The attention layer 156c calculates a query by transforming the vector of the word of interest using a query matrix. The attention layer 156c also receives vectors for each of the multiple words included in the input text from the encoder 155. The attention layer 156c transforms the vector of each word using a key matrix to calculate a key, and transforms the vector of each word using a value matrix to calculate a value.

[0073] The attention layer 156c calculates the inner product of the query and the key as an attention score for each word in the input text. The attention score indicates the degree of relevance between a word in the output text of interest and each word in the input text. The attention layer 156c uses the attention score as a weight to calculate a weighted sum of values ​​between multiple words in the input text. The attention layer 156c outputs the calculated weighted sum as a transformed vector for the word in the output text of interest.

[0074] Normalization layer 156d normalizes the vectors output by attention layer 156c in the same way as normalization layer 155b. Feedforward layer 156e transforms the vectors of words in the output text individually using trained parameter values. Normalization layer 156f normalizes the vectors output by feedforward layer 156e in the same way as normalization layer 155b.

[0075] The linear layer 157 calculates scores for various words listed in the dictionary using the numerical values ​​included in the vectors output by the decoder 156. The words listed in the dictionary are words to which word vectors are assigned by the embedding layers 151 and 152. For example, the word vectors in the embedding layers 151 and 152 are referenced in calculating the scores.

[0076] The softmax layer 158 converts the scores of various words into probabilities between 0 and 1. The large-scale language model 150, for example, selects the word with the highest probability and adds the selected word to the end of the output text. The large-scale language model 150 generates the output text by repeating the above-described process of the decoder 156. Next, an example of input and output to the large-scale language model 150 when generating a regular expression using the large-scale language model 150 will be described.

[0077] 6 is a diagram showing an example of a partial log file. Partial log file 133 shows a partial log included in a certain failure report file. This partial log was previously extracted from the log file by an engineer as an important section.

[0078] Partial log file 133 includes, in order, a line with a heading "Fault State," a line with 63 hyphens, a line with a heading "Fault Active List," and another line with 63 hyphens. Following this, partial log file 133 includes multiple lines that indicate pairs of item names and states.

[0079] 7 is a diagram showing an example of input text. The information processing device 100 generates input text 134 from a partial log file 133. The input text 134 is input to a large-scale language model 150. The input text 134 includes directives, notes, and data. The data is the partial log itself included in the partial log file 133.

[0080] The directive indicates that a block similar to the specified data is to be extracted from the log, and that a regular expression to perform this extraction is to be generated. The directive also indicates that specified precautions must be observed, and that only the regular expression needs to be output, and that no explanatory text is necessary. The directive also instructs the user to refer to a sample of the block and an example of a generated regular expression to extract the block. The sample and the example are described below. The directive may be a formula that is common to input text generated from various partial log files.

[0081] The notes indicate conditions imposed on the generated regular expression to prevent the regular expression from becoming overly specific and losing its versatility. The notes may be general notes based on properties common to various logs, or may be boilerplate text common to input text generated from various partial log files.

[0082] For example, the notes indicate that item names are fixed, but item values ​​are variable and are either strings or numbers. The notes also indicate that when an item name has a number or alphabetic index attached, the corresponding multiple items are arranged in ascending or descending order. The notes also indicate that the number of digits for numbers is not fixed except for date and time, that date and time and identification numbers are variable, and that numbers may be expressed in hexadecimal. The notes also indicate that a blank space may be inserted at the beginning of each line.

[0083] FIG. 8 is a diagram (continued) showing an example of input text. As described above, the input text 134 further includes a sample of a block and an example of a regular expression for extracting the block. The sample and example may be a common phrase used in input texts generated from various partial log files. If the large-scale language model 150 can inherit context between multiple input texts, the second and subsequent input texts may omit the sample and example. The large-scale language model 150 may be able to generate an appropriate regular expression even if the sample and example are not input. In this case, the input text 134 may not include the sample and example.

[0084] 9 is a diagram showing an example of output text. Large-scale language model 150 generates output text 135 from input text 134. Since input text 134 instructs that only regular expressions be output, output text 135 is the regular expressions themselves.

[0085] Output text 135 specifies regular expressions for searching for strings that meet the following conditions: The first line contains the string "Fault State" followed by zero or more spaces, which may be followed by any string of characters separated by zero or more spaces; the second line contains 63 hyphens followed by zero or more spaces, which may be followed by any number of spaces; and the third line contains the string "Fault Active List" followed by zero or more spaces, which may be followed by any number of spaces.

[0086] The fourth line contains zero or more spaces followed by 63 hyphens, which may be followed by any number of spaces. From the fifth line onwards, there are one or more consecutive lines that satisfy the following conditions. Therefore, the number of lines containing strings that match this regular expression is variable. After zero or more spaces, there is a string of one or more characters using alphabets, spaces, parentheses, and hyphens. Furthermore, there is a colon separated by zero or more spaces. Furthermore, there may be any string of characters separated by zero or more spaces, which may be followed by any number of spaces.

[0087] In this way, once the information processing device 100 generates a regular expression from the fault report database, it can extract important logs by executing the regular expression in subsequent fault response work. Therefore, the information processing device 100 can extract important logs more efficiently.

[0088] For example, assume that the fault report database contains 100 partial logs and that the average response time of the large-scale language model 150 is one minute. Also assume that the execution time of one regular expression is one second. In this case, in the second embodiment, important logs are extracted in approximately 100 seconds by generating regular expressions in advance. On the other hand, in a method in which the large-scale language model 150 directly extracts portions similar to the partial logs, it takes approximately 100 minutes to extract important logs. In this way, in the second embodiment, the execution time for important log extraction is significantly reduced. Next, the functions and processing procedures of the information processing device 100 will be described.

[0089] 10 is a block diagram showing an example of functions of an information processing device. Information processing device 100 has failure report storage unit 121, partial log storage unit 122, language model storage unit 123, regular expression storage unit 124, partial log extraction unit 125, regular expression generation unit 126, and important log extraction unit 127. Failure report storage unit 121, partial log storage unit 122, language model storage unit 123, and regular expression storage unit 124 are implemented using, for example, RAM 102 or HDD 103. Partial log extraction unit 125, regular expression generation unit 126, and important log extraction unit 127 are implemented using, for example, CPU 101 and a program.

[0090] The fault report storage unit 121 is a database that stores a plurality of fault report files such as fault report files 131, 141a, 141b, and 141c. Every time a fault occurs, a new fault report file is created and stored in the fault report storage unit 121. The fault report database may be located outside the information processing device 100.

[0091] The partial log storage unit 122 is a database that stores a plurality of partial log files such as the partial log files 133, 142a, 142b, and 142c. A partial log file may be saved in the partial log storage unit 122 each time a failure occurs, or a plurality of partial log files may be generated collectively by batch processing from a failure report database at a certain point in time. The partial log database may be located outside the information processing device 100.

[0092] The language model storage unit 123 stores the large-scale language model 150. However, the large-scale language model 150 may be stored outside the information processing device 100. The regular expression storage unit 124 stores a plurality of regular expressions corresponding to a plurality of partial log files. However, a plurality of regular expressions may be integrated into one or a small number of regular expressions.

[0093] The partial log extraction unit 125 reads a failure report file from the failure report storage unit 121 and extracts the partial logs included in the failure report file. If the data format of the partial logs included in the failure report file is an image format, the partial log extraction unit 125 converts the image data into text data using a character recognition model. The partial log extraction unit 125 generates a partial log file including the extracted partial logs and stores the file in the partial log storage unit 122.

[0094] The regular expression generation unit 126 reads the partial log file from the partial log storage unit 122 and generates input text including the partial log included in the partial log file and standard phrases such as directives and precautions. The standard phrases are, for example, input to the information processing device 100 in advance. The regular expression generation unit 126 inputs the input text to the large-scale language model 150 and obtains output text corresponding to the input text from the large-scale language model 150. The regular expression generation unit 126 saves the regular expression, which is the output text, in the regular expression storage unit 124.

[0095] The important log extraction unit 127 receives one or more log files when a failure occurs. The important log extraction unit 127 executes a plurality of regular expressions stored in the regular expression storage unit 124 against each of the received log files, and searches for important logs that match the regular expressions. The important log extraction unit 127 extracts the detected important logs from the log files, and outputs extraction result text that includes one or more important logs. The important log extraction unit 127 may store the extraction result text in nonvolatile storage such as the HDD 103, may display it on the display device 111, or may transmit it to another information processing device.

[0096] 11 is a flowchart showing an example of a procedure for extracting important logs. In step S10, the partial log extraction unit 125 extracts multiple partial logs from multiple failure report files stored in the failure report database. Typically, one partial log is extracted from one failure report file. However, there may be a failure report file that does not include a partial log, or there may be a failure report file that includes two or more partial logs. Note that if a partial log database already exists, step S10 may be omitted.

[0097] In step S11, the regular expression generation unit 126 reads the trained large-scale language model 150. Alternatively, the regular expression generation unit 126 accesses another information processing device that provides a service that uses the large-scale language model 150. In step S12, the regular expression generation unit 126 generates input text that includes the i-th partial log (i=1, 2, ...) of the multiple partial logs extracted in step S10 and a directive that requests a regular expression.

[0098] In step S13, the regular expression generation unit 126 inputs input text to the large-scale language model 150, causing the large-scale language model 150 to generate a regular expression that can search for a character string similar to the partial log. In step S14, the regular expression generation unit 126 determines whether regular expressions have been generated from all the partial logs extracted in step S10. If regular expressions have been generated from all the partial logs, the process proceeds to step S15. If there are any partial logs for which regular expressions have not been generated, the process returns to step S12. Note that steps S10 to S14 may be executed in advance before a new failure occurs.

[0099] In step S15, the important log extraction unit 127 accepts a log file when a failure occurs. In step S16, the important log extraction unit 127 initializes the extraction result text to an empty string. In step S17, the important log extraction unit 127 searches the log file of step S15 for a string that corresponds to the i-th regular expression (i=1, 2, ...) of the multiple regular expressions generated in step S13.

[0100] In step S18, if a character string corresponding to the regular expression is detected, the important log extraction unit 127 extracts the corresponding character string from the log file. The important log extraction unit 127 adds the extracted character string to the end of the extraction result text. In step S19, the important log extraction unit 127 determines whether all regular expressions generated in step S13 have been used. If all regular expressions have been used, the process proceeds to step S20. If there is an unused regular expression, the process returns to step S17. In step S20, the important log extraction unit 127 outputs the extraction result text as a response to the log file.

[0101] As described above, the information processing device 100 according to the second embodiment automatically extracts important logs that are likely to be related to a failure from a log file output by an information processing system. This allows the information processing device 100 to improve the efficiency of failure response work. Furthermore, the information processing device 100 extracts character strings from the current log file that are similar to partial logs manually extracted in past failure response work. This improves the accuracy of extracting important logs.

[0102] Furthermore, the information processing device 100 generates regular expressions in the large-scale language model 150 based on past partial logs, and executes the generated regular expressions on the current log file. This eliminates the need to manually create a program for extracting important logs, reducing the programming burden. Furthermore, the information processing device 100 does not need to call the large-scale language model 150 for each failure, and can quickly extract important logs from the log file.

[0103] Furthermore, the information processing device 100 generates highly versatile regular expressions that do not depend on event-specific character strings such as event dates and device identifiers included in partial logs, by utilizing the generalization capability of the large-scale language model 150. This improves the accuracy of extracting important logs. [Explanation of symbols]

[0104] 10. Information processing equipment 11 Storage section 12 Processing section 13 Machine Learning Models 14 Search Programs 15,16 Log data 17,18 Partial log data

Claims

1. acquiring first partial log data extracted from the first log data output by the information processing system; inputting the first partial log data into a trained machine learning model, and generating a search program for searching second partial log data having a common pattern with the first partial log data from among second log data using the machine learning model; A generating program that causes a computer to execute a process.

2. the search program includes a regular expression that represents the pattern; The generating program according to claim 1.

3. the machine learning model is a natural language processing model that generates an output text from an input text, the generating process includes a process of inputting the first partial log data and an instruction statement instructing the machine learning model to generate the search program, to cause the machine learning model to output the search program; The generating program according to claim 1.

4. the generating process includes a process of further inputting sample data in which the third partial log data is associated with another search program capable of searching the third partial log data into the machine learning model. The generating program according to claim 3.

5. the first partial log data is a quoted portion of the first log data that is cited by failure report data indicating a failure of the information processing system; The generating program according to claim 1.

6. causing the computer to further execute a process of executing the search program on the second log data and extracting the second partial log data from the second log data; The generating program according to claim 1.

7. acquiring first partial log data extracted from the first log data output by the information processing system; inputting the first partial log data into a trained machine learning model, and generating a search program for searching second partial log data having a common pattern with the first partial log data from among second log data using the machine learning model; A method of generating data in which processing is performed by a computer.

8. a storage unit that stores first partial log data extracted from the first log data output by the information processing system; a processing unit that generates a search program for inputting the first partial log data into a trained machine learning model, and using the machine learning model to search for second partial log data having a common pattern with the first partial log data from among second log data; An information processing device having the above.

Images