Log information analysis support device, analysis system, log information analysis support method, and program

Abstract

To solve the problem in which: as a system for supporting analysis of log information, a system is proposed determines the feature amount such as the frequency of appearance of prescribed words for each occurrence time from an enormous amount of log information, displays the feature amount as a histogram, and displays the details of the log information; however, the feature amount such as the frequency of appearance of the log information is only visualized as the histogram together with the details of the log information, and therefore, it is difficult to grasp the ratio of the log information classified according to a prescribed criteria such as a log level for each occurrence time.SOLUTION: A log information analysis support device generates a log information analysis support screen including a graph display region for displaying an accumulation graph for each prescribed time by visually discriminating log information classified according to prescribed criteria such as a log level, and presents the screen on an operation terminal to bring about an effect to facilitate a grasp of the ratio of the log information classified according to the prescribed criteria.SELECTED DRAWING: Figure 8

Description

[Technical Field]

[0001] The present disclosure relates to a log information analysis support device, an analysis system, a log information analysis support method, and a program. [Background technology]

[0002] Periodic analysis of log information is important for the operation and management of computer systems, especially for fault analysis or the detection of abnormal phenomena. In particular, in recent years, the importance of analyzing log information to detect unauthorized intrusions into computer systems has increased dramatically.

[0003] However, in information systems and monitoring and control systems, the amount of log information tends to increase due to the need to combine multiple systems, which increases the burden on analysts who analyze the log information.

[0004] Therefore, a system has been proposed to assist in the analysis of log information, which calculates features such as the frequency of occurrence of specific words for each time period from a huge amount of log information, and displays these features as a histogram along with the contents of the log information (see Patent Document 1). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2001-356939 Summary of the Invention [Problem to be solved by the invention]

[0006] However, in conventional systems, the content of the log information and the characteristic quantities such as the frequency of occurrence of the log information are only visualized in a histogram, making it difficult to grasp the proportion of log information classified by predetermined criteria such as log level for each time of occurrence.

[0007] The present invention has been made in view of the above circumstances, and has an object to make it easier to grasp the proportion of log information classified according to a predetermined criterion. [Means for solving the problem]

[0008] The invention according to claim 1 is a log information analysis support device that supports the analysis of log information, a creating means for creating a log information analysis support screen including a graph display area for visually distinguishing log information classified according to a predetermined criterion and displaying it as a stacked graph for each predetermined time period, and a log display area for displaying the contents of the log information; and a transmitting means for transmitting data of the log information analysis support screen created by the creating means to an operation terminal operated when analyzing the log information. a receiving means for receiving operation information based on an operation on the graph display area from the operation terminal, wherein the creating means changes the display mode of the log display area based on the operation information received by the receiving means, and the transmitting means transmits data of the log information analysis support screen after the change, including the log display area after the change by the creating means, to the operation terminal. The log information analysis support device is characterized by the above. [Effects of the Invention]

[0009] As described above, according to the present invention, the log information analysis support device 8 creates a log information analysis support screen including a graph display area in which log information classified according to a predetermined criterion is visually distinguished and displayed as a stacked graph for each predetermined time period, and presents the screen on the operation terminal, thereby achieving the effect of making it easier to grasp the proportion of log information classified according to the predetermined criterion. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a schematic diagram of an analysis system according to an embodiment of the present invention. [Figure 2] FIG. 2 is an electrical hardware configuration diagram of an operation terminal and a log information analysis support device. [Figure 3] FIG. 2 is a functional block diagram of an operation terminal and a log information analysis support device. [Figure 4] FIG. 10 is a diagram illustrating a log format. [Figure 5] FIG. 10 is a diagram illustrating definitions of log levels. [Figure 6] FIG. 10 is a diagram showing the flow of sending and receiving log information. [Figure 7]FIG. 10 is a sequence diagram showing a process for displaying a log information analysis support screen. [Figure 8] FIG. 10 is a diagram showing a display form of the log information analysis support screen in a first initial state. [Figure 9] FIG. 10 is a diagram showing a display form of the log information analysis support screen in a first change state. [Figure 10] FIG. 10 is a diagram showing a display form of the log information analysis support screen in a second changed state. [Figure 11] FIG. 10 is a diagram showing a display form of the log information analysis support screen in a third change state. [Figure 12] FIG. 10 is a diagram showing a display form of the log information analysis support screen in a fourth change state. [Figure 13] FIG. 10 is a diagram showing a display form of the log information analysis support screen in a second initial state. [Figure 14] FIG. 10 is a diagram showing a display form of the log information analysis support screen in a fifth change state. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] [System Configuration] The outline of the configuration of an analysis system 1 of this embodiment will be described with reference to Fig. 1. Fig. 1 is a schematic diagram of an analysis system according to an embodiment of the present invention.

[0013] As shown in FIG. 1, the analysis system 1 of this embodiment includes a log analysis target 2, a log information storage device 7, and a log information analysis support device 8.

[0014] The log analysis target 2 periodically transmits log information of its own device (log analysis target 2) to the log information accumulation device 7. The log analysis target 2 further includes a field device 3, a control device manager 4, a monitoring control system 5, and an operation terminal 6.

[0015] Of these, the field devices 3 are devices such as sensors and actuators, and are used for measurement and control in plant facilities such as energy plants and water treatment plants, as well as manufacturing factories. The control device manager 4 is a device that controls a plurality of field devices 3. In FIG. 1, for the sake of simplicity, a single field device 3 is connected to the control device manager 4, but a plurality of field devices may be connected.

[0016] The monitoring and control system 5 is a system that collects and stores data while monitoring and controlling devices and sensors based on the data sent from the devices and sensors. Note that the log analysis target 2 may be an information system that manages information on each terminal instead of the monitoring and control system 5, but in this case, the field devices 3 and the control device manager 4 will not be subject to analysis. Below, we will explain the case where a monitoring and control system is used.

[0017] The operation terminal 6 is a computer terminal operated by an operator (analyst) to perform processing on the log information storage device 7 and the log information analysis support device 8. The operation terminal 6 is a desktop PC (Personal Computer), a notebook PC, a tablet PC, a smartphone, or the like.

[0018] The control device manager 4, the monitoring and control system 5, the operation terminal 6, the log information storage device 7, and the log information analysis support device 8 are communicatively connected via a communication network 100. The communication network 100 includes a LAN (Local Area Network), the Internet, etc. The communication network 100 may be connected wirelessly or wired.

[0019] [Hardware configuration] Next, the electrical hardware configuration of the operation terminal 6 and the log information analysis support device 8 will be described with reference to Fig. 2. Fig. 2 is a diagram showing the electrical hardware configuration of the operation terminal and the log information analysis support device. Note that only the operation terminal 6 and the log information analysis support device 8 that appear in the functional block diagram of Fig. 3 described below will be described here.

[0020] As shown in FIG. 2, the operation terminal 6 includes an arithmetic processing unit 601, a ROM (Read Only Memory) 602, a RAM (Random Access Memory) 603, a storage device 604, an external device I / F 605, a display 606, a communication unit 607, and a bus line 610.

[0021] Of these, the arithmetic processing unit 601 is configured by a CPU (Central Processing Unit) and may include a GPGPU (General-purpose computing on graphics processing units). The arithmetic processing unit 601 controls the overall operation of the operation terminal 6.

[0022] The ROM 602 stores the arithmetic processing unit 601 and programs such as IPL used to drive the arithmetic processing unit 601. The RAM 603 is used as a work area for the arithmetic processing unit 601.

[0023] The storage device 604 is configured by an SSD (Solid State Drive), an HDD (Hard Disk Drive), or a flash memory. The storage device 604 reads or writes various data such as programs for the operation terminal under the control of the arithmetic processing unit 601.

[0024] The external device I / F 605 is an interface for connecting various external devices. In this case, the external devices are an external display as an example of a display means, a mouse, a keyboard, or a microphone as an example of an input means, a printer or a speaker as an example of an output means, a USB (Universal Serial Bus) memory as an example of a storage means, etc.

[0025] The display 606 is a type of display means such as a liquid crystal display or organic EL (Electro Luminescence) display that displays an image of a subject, various icons, and the like.

[0026] The communication unit 607 is composed of a network I / F, a communication circuit, an antenna of the communication circuit, etc. The communication unit 607 performs communication using Ethernet (registered trademark), Wi-Fi (IEEE802.11, etc.), etc. For example, the network I / F performs data communication with operation terminals other than the operation terminal 6 and a server via the communication network 100. Furthermore, the communication circuit uses an antenna to perform data communication with other devices using short-range wireless communication technologies such as Wi-Fi, NFC (Near Field Communication), Bluetooth (registered trademark), etc.

[0027] The operation terminal 6 also includes a bus line 610. The bus line 610 is an address bus, a data bus, or the like for electrically connecting the components such as the arithmetic processing unit 601 shown in FIG.

[0028] The electrical hardware configuration of the log information analysis support device 8 is the same as that of the operation terminal 6, and therefore in Fig. 2, the reference numerals in the 600s are simply replaced with reference numerals in the 800s. Therefore, a description of the electrical hardware configuration of the log information analysis support device 8 will be omitted.

[0029] [Functional configuration] Next, the functional configuration of the operation terminal 6 and the log information analysis support device 8 will be described with reference to Fig. 3. Fig. 3 is a functional configuration diagram of the operation terminal and the log information analysis support device in an embodiment of the present invention. Note that here, the operation terminal 6 and the log information analysis support device 8 that perform main processing in the analysis system 1 will be described.

[0030] <Functional configuration of the operation terminal> First, we will explain the functional configuration of the operation terminal 6. As shown in Fig. 3, the operation terminal 6 has a transmission / reception unit 61, a reception unit 62, and a display control unit 64. Each of these units is a function or means realized when any of the components shown in Fig. 2 operates in response to an instruction from the arithmetic processing unit 601 in accordance with a program loaded from the storage device 604 onto the RAM 603.

[0031] Of these, the transmitting / receiving unit 61 is mainly realized by the processing of the arithmetic processing unit 601 for the communication unit 607, and transmits and receives various data (or information) to and from other devices via the communication network 100.

[0032] The reception unit 62 is realized mainly by the processing of the arithmetic processing unit 601 in response to input operations using a keyboard, mouse, or the like connected to the external device I / F 605, and receives various selections or inputs from the operator.

[0033] The display control unit 64 is realized by the processing of the arithmetic processing unit 601, and causes the display 606 to display various images.

[0034] <Functional configuration of the log information analysis support device> Next, the functional configuration of the log information analysis support device 8 will be described. As shown in Fig. 3, the log information analysis support device 8 has a transmitting / receiving unit 81, a creating unit 83, and a storing / reading processing unit 89. Each of these units is a function or means realized when any of the components shown in Fig. 2 operates in response to an instruction from the processing unit 801 in accordance with a program loaded from the storage device 804 onto the RAM 803. The log information analysis support device 8 also has a storage unit 80 constructed by at least one of the RAM 803 and the storage device 804 shown in Fig. 2.

[0035] Of these, the transmitting / receiving unit 81 is mainly realized by the processing of the arithmetic processing unit 801 for the communication unit 807, and transmits and receives various data (or information) to and from other devices via the communication network 100.

[0036] The creation unit 83 is realized by the processing of the calculation processing unit 801, and creates a log information analysis support screen, etc., which will be described later.

[0037] The storage / readout processing unit 89 is mainly realized by the processing of the calculation processing unit 801, and performs processing such as storing various data (or information) in the memory unit 80 and reading out various data (or information) from the memory unit 80.

[0038] [Explanation of log information] Next, the log information handled in this embodiment will be described with reference to Fig. 4 and Fig. 5. Fig. 4 is a diagram showing a log format, and Fig. 5 is a diagram showing definitions of log levels.

[0039] The log format shown in Figure 4 is a typical format. The log format is defined by the log occurrence date and time, log format version, log level, service application name, instance ID, thread name, thread ID (Identification), and message. Note that hereafter, "application" will be abbreviated to "app."

[0040] Also, since classification is typically based on log level, it is sufficient if the log level is defined, but it is desirable to have all the information in order to display graphs for each application or messages containing specific characters. Also, it is possible to handle messages in different formats, such as existing applications or external libraries, by converting them as appropriate.

[0041] 5 shows three types of log levels: INFO, WARN, and ERROR. Five types of log levels, ERROR, WARN, INFO, DEBUG, and TRACE, are shown in FIG. 3, but DEBUG and TRACE are not included in the analysis target in this embodiment because they do not represent warnings or abnormalities. For example, the same event may generate different log levels, such as ERROR in the control equipment manager 4 but WARN in the monitoring and control system 5, and therefore a log level is determined in advance for each log analysis target 2.

[0042] [Processing or Operation of the Embodiment] Next, the processing or operation of this embodiment will be described with reference to Fig. 6 to Fig. 14. Fig. 6 is a sequence diagram showing the flow of sending and receiving log information.

[0043] As shown in Fig. 6, the log information generated by the field device 3 is transmitted to the log information storage device 7 via the control device manager 4 (S11). If the field device 3 is a simple measurement device such as a thermo-hygrometer, it cannot generate log information by itself. In such a case, the field device 3 transmits measurement data to the control device manager 4, and the control device manager 4 determines whether there is an abnormality based on a predetermined threshold and generates log information. As a result, the log information is transmitted from the control device manager 4 to the log information storage device 7.

[0044] Furthermore, the log information generated by the control device manager 4 is transmitted to the log information storage device 7 (S12). The log information generated by the monitoring and control system 5 is transmitted to the log information storage device 7 (S13). The log information generated by the operation terminal 6 is also transmitted to the log information storage device 7 (S14). As a result, the log information storage device 7 stores and manages each piece of log information.

[0045] Next, in the operation terminal 6, when the operator performs an operation such as inputting the log generation date, the reception unit 62 receives a request to display a log information analysis support screen, and the transmission / reception unit 61 transmits a request to create a log information analysis support screen to the log information analysis support device 8 (S16). This creation request includes information indicating the log generation date input by the operator. As a result, the transmission / reception unit 81 of the log information analysis support device 8 receives the request to create a log information analysis support screen.

[0046] Next, the transmitting / receiving unit 81 of the log information analysis support device 8 transmits a request for each piece of log information to the log information accumulation device 7 (S17). This request includes information indicating the creation date of the log transmitted in step S16.

[0047] Next, the log information accumulation device 7 transmits each piece of log information corresponding to the information indicating the log generation date received in step S17 to the log information analysis support device 8 (S18). As a result, the transmitting / receiving unit 81 of the log information analysis support device 8 receives each piece of log information.

[0048] As described above, in the log information analysis support device 8, the storage / read processing unit 89 temporarily stores each piece of log information in the storage unit 80.

[0049] Next, the process of displaying the log information analysis support screen will be described with reference to Fig. 7. Fig. 7 is a sequence diagram showing the process of displaying the log information analysis support screen.

[0050] 7, the creation unit 83 creates a log information analysis support screen using each piece of log information stored in the storage unit 80 (S21). Then, the transmission / reception unit 81 transmits data of the log information analysis support screen created by the creation unit 83 to the operation terminal 6 (S22). As a result, the transmission / reception unit 61 of the operation terminal 6 receives the data of the log information analysis support screen.

[0051] Next, in the operation terminal 6, the display control unit 64 displays the log information analysis support screen 10 as shown in FIG. 8 on the display 606 (S23).

[0052] Here, each display mode of the log information analysis support screen will be described below.

[0053] <First initial state> FIG. 8 is a diagram illustrating a display mode of the log information analysis support screen in a first initial state. In the first initial state, the log information analysis support screen 10 includes a graph display area 11 at the top and a log display area 12 at the bottom. The graph display area 11 visually distinguishes log information classified by log level and displays it as a stacked (vertical) bar graph for each predetermined time. In this example, the predetermined time is one hour, but it may be any number of hours or minutes. The log display area 12 displays the contents of the log information. The contents of the log information include the date and time of log generation, the log level, the application name, and a message. The date and time indicates the log generation date entered by the operator in step S16. In this case, the log generation date (here, 2021 / 04 / 01) is displayed at the top of the log information analysis support screen 10. The display position of the log generation date may be anywhere on the log information analysis support screen 10. The log information classified by log level is an example of log information classified according to a predetermined criterion.

[0054] Next, when the operator performs a drag operation with the mouse, the reception unit 62 receives the operation of the operator (S24). Specifically, as shown in Fig. 9 described later, when the operator moves the pointer 9 by dragging the mouse to specify a range of a predetermined time period using the range frame 111, the reception unit 62 receives the range of the predetermined time period. Note that if the operation terminal 6 is a tablet PC or a smartphone, the operation may be performed with a touch pen or a finger instead of a mouse.

[0055] Next, the transmitting / receiving unit 61 of the operation terminal 6 transmits operation information indicating the operation accepted in step S24 to the log information analysis support device 8 (S25). This operation information includes information indicating a predetermined time range. As a result, the transmitting / receiving unit 81 of the log information analysis support device 8 receives the operation information.

[0056] Next, in the log information analysis support device 8, the creation unit 83 changes the log information analysis support screen based on the operation information received in step S25 (S26). Then, the transmission / reception unit 81 transmits data of the changed log information analysis support screen to the operation terminal 6 (S27). As a result, the transmission / reception unit 61 of the operation terminal 6 receives the data of the changed log information analysis support screen.

[0057] Next, in the operation terminal 6, the display control unit 64 displays the changed log information analysis support screen 10a on the display 606 (S28).

[0058] (First change state) Here, the display mode of the first change state will be described with reference to Fig. 9. Fig. 9 is a diagram showing the display mode of the first change state on the log information analysis support screen.

[0059] The log information analysis support screen 10a after the change includes a graph display area 11a at the top and a log display area 12a at the bottom, as a first change state relative to the first initial state. The graph display area 11a displays a stacked graph for all time periods (bands) of one day in the first initial state, and also displays a range frame 111 for a predetermined time period specified by the operator. The log display area 12a displays the contents of the log information for the specified predetermined time period.

[0060] As described above, when the operator performs an operation to specify a predetermined time range with the pointer 9, the contents of the log information to be displayed can be narrowed down in conjunction with this operation.

[0061] (Second change state) Next, the display mode of the second change state will be described with reference to Fig. 10. Fig. 10 is a diagram showing the display mode of the second change state on the log information analysis support screen.

[0062] As a modification of the first change state, the log information analysis support screen 10b after the change includes a graph display area 11b at the top and a log display area 12b at the bottom. The graph display area 11b displays an enlarged view of a stacked graph for a predetermined time period specified by the operator and the range of the predetermined time period. Similarly to the log display area 12a, the log display area 12b displays the contents of the log information for the specified range of time.

[0063] In this way, the operator can specify a predetermined time range with the pointer 9, and in conjunction with this operation, the contents of the log information to be displayed can be narrowed down. Also, by enlarging the graph, the operator can easily view the graph.

[0064] (Third Modification) Next, the display mode of the third change state will be described with reference to Fig. 11. Fig. 11 is a diagram showing the display mode of the third change state on the log information analysis support screen.

[0065] In step S24 described above, when the operator uses the mouse to designate a specific log level portion of a specific graph with the pointer 9, operation information indicating the specific log level portion is transmitted in step S25. As a result, the log information analysis support screen is changed in step S26, and data for the changed log information analysis support screen is transmitted in step S27. Then, in step S28, the display control unit 64 displays the changed log information analysis support screen 10c on the display 606.

[0066] The log information analysis support screen 10c after the change includes a graph display area 11c at the top and a log display area 12c at the bottom, as a third change state. The graph display area 11c displays a stacked graph for all hours of the day in the first initial state, and classification information 113 indicating the log level is displayed in a balloon near a specific log level portion of the specific stacked graph specified by the operator. Furthermore, the log display area 12c displays the contents of log information related to a specific log level in the specified specific stacked graph. Here, not only the contents of log information related to a specific log level in a specified time period, but also the contents of log information related to the same specific log level in different time periods on the same day are displayed. Note that the contents of log information related to the same specific log level in different time periods on the same day do not necessarily need to be displayed.

[0067] In this way, the operator can narrow down the content of the log information to be displayed in conjunction with the operation of specifying a specific log level portion with the pointer 9. Furthermore, even in the case of a stacked graph in which the name of the log level is not displayed, classification information 113 indicating the specific log level is displayed in a balloon, so the user can easily understand the type of log level.

[0068] (4th change state) Next, the display mode of the fourth change state will be described with reference to Fig. 12. Fig. 12 is a diagram showing the display mode of the fourth change state on the log information analysis support screen.

[0069] In step S24 described above, when the operator operates the mouse to specify a specific time with the pointer 9, operation information indicating the specific time (time period) is transmitted in step S25. As a result, the log information analysis support screen is changed in step S26, and data for the changed log information analysis support screen is transmitted in step S27. Then, in step S28, the display control unit 64 displays the changed log information analysis support screen 10d on the display 606.

[0070] The log information analysis support screen 10d after the change includes a graph display area 11d at the top and a log display area 12d at the bottom as a fourth change state. The graph display area 11d displays a stacked graph for all hours of the day in the first initial state, and also displays an indication that a specific time period (time slot) has been specified by the operator. The log display area 12d displays the contents of the log information for the specified specific time period.

[0071] As described above, when the operator performs an operation to specify a specific time with the pointer 9, the contents of the log information to be displayed can be narrowed down in conjunction with this operation.

[0072] <Second initial state> Next, the second initial state of the log information analysis support screen will be described with reference to Fig. 13. Fig. 13 is a diagram showing the display mode of the log information analysis support screen in the second initial state. In the second initial state, the log information analysis support screen 20 includes a graph display area 21 at the top and a log display area 22 at the bottom. The log generation date is displayed at the top of the log information analysis support screen 20. Up to this point, the display mode is the same as in the first initial state.

[0073] In the second initial state, a pull-down menu 23 for specifying a display period is also displayed. In step S24 described above, when the operator uses the mouse to specify a desired display period (here, two days) with the pointer 9 from the pull-down menu 23, operation information indicating the specified display period is transmitted in step S25. As a result, the log information analysis support screen is changed in step S26, and data for the changed log information analysis support screen is transmitted in step S27. Then, in step S28, the display control unit 64 displays the changed log information analysis support screen 20a as shown in FIG. 14 on the display 606.

[0074] (5th change state) Here, the display mode of the fifth change state will be described with reference to Fig. 14. Fig. 14 is a diagram showing the display mode of the log information analysis support screen in the fifth change state.

[0075] The log information analysis support screen 20a after the change includes a graph display area 21a at the top and log display areas 22a and 22b at the bottom, as a fifth change state relative to the second initial state.

[0076] The graph display area 21a displays a stacked graph for the entire time period (band) for the specified display period (here, two days). Similarly to the first initial state (see FIG. 8), the log display areas 22a and 22b display the contents of the log information for all hours for each specified day. Here, because each log display area 22a and 22b is displayed small, the time period (band) is displayed in two-hour increments. However, it may also be displayed in one-hour increments.

[0077] 14, the log display areas 22a and 22b are displayed side by side, but they may be displayed side by side vertically. In this case, the graph display area 21a displays a stacked bar graph.

[0078] In this state, if the operator again uses the mouse to specify a specific time on a specific day with the pointer 9 in step S24, and also, for example, while pressing the shift key on the keyboard, specifies a specific time on another day with the pointer 9, operation information indicating the two specific times is transmitted in step S25. As a result, the log information analysis support screen is changed in step S26, and data for the changed log information analysis support screen is transmitted in step S27. Then, in step S28, the display control unit 64 displays the changed log information analysis support screen 20a on the display 606.

[0079] The log information analysis support screen 10d after the change includes a graph display area 11d at the top and a log display area 12d at the bottom, as a fifth change state. The graph display area 21a displays a stacked graph of all time for two days, and also displays an indication that a specific time has been specified by the operator. The log display area 22a displays the content of the log information at the specified specific time, and the log display area 22b also displays the content of the log information at the specified specific time.

[0080] As described above, when the operator performs an operation to specify multiple specific time periods (time zones) with the pointer 9, the contents of the log information to be displayed can be narrowed down in conjunction with this operation so that log information for multiple time periods can be easily compared. Note that, although two time periods (time zones) are specified for two days in Fig. 14, three or more days may be specified, or three or more time periods (time zones) may be specified. When four or more days can be specified, the number of days in the display period of the pull-down menu shown in Fig. 13 will be four or more days.

[0081] [Major Effects of the Embodiments] As described above, according to this embodiment, the log information analysis support device 8 creates a log information analysis support screen 10 including a graph display area 11 that displays log information classified according to predetermined criteria such as log level in a stacked graph for each predetermined time period, and a log display area 12 that displays the contents of the log information, thereby making it easier for the operator to grasp the proportion of log information classified according to predetermined criteria.

[0082] In addition, the log information analysis support device 8 has the effect of further improving support for the analysis of log information by narrowing down the content of the log information displayed in the log display area 12 in conjunction with operations on the graph display area 11 by the operator.

[0083] 〔supplement〕 The present invention is not limited to the above-described embodiment, and may have the following configurations or processes (operations).

[0084] For example, the log information analysis support device 8 can be realized by a computer and a program, but this program can also be recorded on a recording medium or provided via a communication network.

[0085] In the above embodiment, the log information classified by log level is described as an example of the log information classified by a predetermined criterion, but the present invention is not limited to this. For example, the log information classified by the type of application may be used as an example of the log information classified by a predetermined criterion. [Explanation of symbols]

[0086] 1. Analysis System 2. Log analysis targets 3 Field devices 4 Control Equipment Management Unit 5. Monitoring and Control System 6 Operation terminal 7. Log information storage device 8 Log information analysis support device 61 Transmitter / Receiver 62 Reception Department 64 Display control unit 80 Storage section 81 Transmitting / receiving unit (an example of a transmitting means, an example of a receiving means) 83 Creation unit (an example of creation means) 89 Storage and readout processing section 100 Communication Network 606 Display (an example of a display means)

Claims

1. A log information analysis support device that supports analysis of log information, a creating means for creating a log information analysis support screen including a graph display area for visually distinguishing log information classified according to a predetermined criterion and displaying it as a stacked graph for each predetermined time period, and a log display area for displaying the contents of the log information; a transmission means for transmitting data of the log information analysis support screen created by the creation means to an operation terminal operated when analyzing the log information; a receiving means for receiving operation information based on an operation on the graph display area from the operation terminal; and the creation means changes the display mode of the log display area based on the operation information received by the reception means; The transmission means transmits data of the log information analysis support screen after the change, including the log display area after the change by the creation means, to the operation terminal. A log information analysis support device characterized by the above.

2. the operation information indicates a specific graph among the graphs displayed in the graph display area, The change in the display mode of the log display area is a change from the content of the log information in the log display area to the content of the log information related to the specific graph indicated by the operation information.

2. The log information analysis support device according to claim 1.

3. The creation means changes the display mode of the graph display area by enlarging the specific graph indicated by the operation information. The transmission means transmits data of the log information analysis support screen after the change, including the graph display area after the change by the creation means, to the operation terminal.

3. The log information analysis support device according to claim 2, wherein:

4. the operation information indicates a specific portion of the graph displayed in the graph display area, the specific portion being classified according to the predetermined criteria; The change in the display mode of the log display area is a change from the content of the log information in the log display area to the content of the log information related to a specific part classified according to the predetermined criteria indicated by the operation information.

2. The log information analysis support device according to claim 1.

5. 5. The log information analysis support device according to claim 4, wherein said creating means includes specific classified information classified according to said predetermined criteria in said graph display area.

6. the operation information indicates a specific time period related to a specific graph among the graphs displayed in the graph display area, The change in the display mode of the log display area is a change from the content of the log information in the log display area to the content of the log information for the specific time period indicated by the operation information.

2. The log information analysis support device according to claim 1.

7. the operation information indicates a plurality of specific time periods related to a plurality of the specific graphs, The change in the display mode of the log display area is a change from the content of the log information in the log display area to the content of the log information for the plurality of specific time periods indicated by the operation information.

7. The log information analysis support device according to claim 6.

8. The log information analysis support device according to any one of claims 1 to 7, characterized in that the log information classified according to the specified criteria is log information classified by log level or log information classified by type of application executed on the log analysis target that generates the log information.

9. The log information analysis support device according to any one of claims 1 to 8, the operation terminal; An analytical system having:

10. A log information analysis support method executed by a log information analysis support device that supports analysis of log information, comprising: a creating step of creating a log information analysis support screen including a graph display area for visually distinguishing log information classified according to a predetermined criterion and displaying the log information in a stacked graph for each predetermined time period, and a log display area for displaying the contents of the log information; a transmission step of transmitting data of the log information analysis support screen created in the creation step to an operation terminal operated when analyzing the log information; a receiving step of receiving, from the operation terminal, operation information based on an operation on the graph display area; Run the creating step includes a process of changing a display mode of the log display area based on the operation information received in the receiving step, The sending step includes a process of sending data of the log information analysis support screen after the change, including the log display area after the change made in the creating step, to the operation terminal. A log information analysis method comprising:

11. A program causing a computer to execute the method according to claim 10.

Images