Log analysis device, log analysis method, and program

Abstract

To provide a log analysis apparatus and method for utilizing attribute information of a device for log analysis.SOLUTION: In a log analysis system, a log analysis apparatus and a plurality of devices can communicate with each other over a communication network. The log analysis apparatus storing logs of events that occurred in the devices and attribute information of the devices, determines whether a first log has been stored in a log storage unit, the first log indicating a log of an abnormal event, for each predetermined time width, determines, when a determination is made that the first log has been stored, whether a second log has been stored in the log storage unit, the second log being related to an abnormal event, in predetermined time widths before and after the first log, acquires, from an attribute information storage unit, attribute information of a first device in which the abnormal event indicated by the first log occurred and attribute information of a second device in which the abnormal event indicated by the second log occurred, acquires, from the attribute information storage unit, attribute information of devices in which no abnormal event occurred, and visualizes, as a cause of the abnormal events, the attribute information obtained by removing the attribute information of the devices with no abnormal event from the common attribute information.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] This disclosure relates to a log analysis device, a log analysis method, and a program. [Background technology]

[0002] When a malfunction occurs in a device, a technique for analyzing logs collected from that device to identify the cause of the malfunction has been known for some time. For example, Patent Document 1 discloses a technique that, when a log indicating a malfunction has occurred in a certain device is obtained, determines whether logs indicating the same malfunction have occurred in multiple devices of the same model, year, and location as that device, and detects widespread cyberattacks, model defects, manufacturing lot-level failures, etc., based on the determination result. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] International Publication No. 2019 / 040009 [Overview of the Initiative] [Problems that the invention aims to solve]

[0004] However, with conventional technology, information not included in logs is not analyzed, and it was sometimes impossible to find commonalities in events occurring across multiple devices. On the other hand, device attribute information (for example, information about the environment where the device is installed) is generally not included in logs, but it is considered useful information for finding commonalities in the circumstances occurring at that device.

[0005] This disclosure is made in view of the above points and aims to provide a technology that enables the use of device attribute information for log analysis. [Means for solving the problem]

[0006] A log analysis device according to one aspect of the present disclosure includes: a log storage unit configured to store logs relating to events that have occurred in each of a plurality of devices; an attribute information storage unit configured to store attribute information of the devices; a first determination unit configured to determine whether a first log indicating a log relating to an abnormal event has been stored in the log storage unit at predetermined time intervals; a second determination unit configured to determine, if it has been determined that the first log has been stored in the log storage unit, whether a second log indicating a log relating to the abnormal event has been stored in the log storage unit at predetermined time intervals before and after the first log; a first acquisition unit configured to acquire common attribute information from the attribute information storage unit between the attribute information of the first device in which the abnormal event represented by the first log occurred and the attribute information of the second device in which the abnormal event represented by the second log occurred; a second acquisition unit configured to acquire attribute information of devices in which the abnormal event has not occurred from the attribute information storage unit; and a visualization unit configured to visualize the attribute information obtained by excluding the attribute information of devices in which the abnormal event has not occurred from the common attribute information as the cause of the abnormal event. [Effects of the Invention]

[0007] A technology is provided that allows for the use of device attribute information in log analysis. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of the overall configuration of the log analysis system according to this embodiment. [Figure 2] This figure shows an example of the hardware configuration of the log analysis device according to this embodiment. [Figure 3] This figure shows an example of the hardware configuration of the device according to this embodiment. [Figure 4] This figure shows an example of the functional configuration of the log analysis device according to this embodiment. [Figure 5] This figure shows an example of the functional configuration of the device according to this embodiment. [Figure 6]It is a diagram showing an example of a log stored in the log storage unit. [Figure 7] It is a diagram showing an example of device information stored in the device information storage unit. [Figure 8] It is a diagram for explaining an example of log creation and storage processing according to the present embodiment. [Figure 9] It is a diagram for explaining an example of log analysis and visualization of abnormal factors processing according to the present embodiment.

Mode for Carrying Out the Invention

[0009] Hereinafter, an embodiment of the present invention will be described. In the following embodiments, a log analysis system 1 that can utilize the attribute information of devices that are log collection targets during log analysis will be described.

[0010] <Overall Configuration Example of Log Analysis System 1> An overall configuration example of the log analysis system 1 according to the present embodiment is shown in FIG. 1. As shown in FIG. 1, the log analysis system 1 according to the present embodiment includes a log analysis device 10, a plurality of devices 20, and a plurality of devices 30. The log analysis device 10 and each device 20 are communicably connected via a communication network 40 such as an inter-site network. Also, each device 20 is communicably connected to one or more devices 30 by wireless communication (or wired communication may also be used).

[0011] For example, in the example shown in FIG. 1, the log analysis device 10 is communicably connected to devices 20A to 20D. Also, device 20A is communicably connected to devices 30A-1 to 30A-2, device 20B is communicably connected to devices 30B-1 to 30B-2, device 20C is communicably connected to devices 30C-1 to 30C-2, and device 20D is communicably connected to devices 30D-1 to 30D-2, respectively. However, these are just examples, and the log analysis device 10 may be communicably connected to any number of devices 20, and similarly, each device 20 may be communicably connected to any number of devices 30.

[0012] The log analysis device 10 collects logs from each device 20 and analyzes those logs when a log indicating that an abnormality has occurred in a certain device 20 is obtained. At this time, the log analysis device 10 uses the attribute information of each device 20 to identify and visualize the attribute information that is the cause of the abnormality. As a result, the user (for example, an operator who manages and operates the device 20, etc.) can know the attribute information that is the cause of the abnormality that has occurred in the device 20.

[0013] Here, the attribute information is information representing the attributes of the device 20. Examples of the attribute information include, for example, the model number of the device 20, the version of the software installed in the device 20, the power supply source of the device 20, the type of wireless communication used by the device 20, the location on the network such as the access point or base station used by the device 20, information regarding the device 30 connected to the device 20 (hereinafter, also referred to as connection device information), etc. Note that examples of the connection device information include the number of connected devices 30, the type of the device 30, the version, etc.

[0014] However, the above attribute information is just an example, and various other attribute information can be used as long as it represents some attribute of the device 20. For example, the installation location such as the address or building name where the device 20 is installed, NW devices such as routers and gates used by the device 20, when the device 20 is installed in a production facility such as a production plant, the production target (for example, product name, etc.) and lot number, etc. can also be used as attribute information.

[0015] The device 20 is a control device (for example, a PLC (Programmable Logic Controller), etc.) that controls the device 30 connected to itself. The device 20 creates logs regarding operations on itself and the software it has, and transmits those logs to the log analysis device 10.

[0016] Device 30 is a sensor device that measures physical quantities (e.g., temperature, pressure, flow rate, etc.) of some predetermined object (e.g., production equipment, etc.), or an actuator that drives some predetermined object, etc.

[0017] The overall configuration of the log analysis system 1 shown in Figure 1 is an example and is not limited to this configuration. For example, the log analysis system 1 may include monitoring terminals used by operators who manage and operate the equipment 20.

[0018] <Example hardware configuration of log analysis device 10 and equipment 20> The following describes an example of the hardware configuration of the log analysis device 10 and equipment 20 according to this embodiment.

[0019] ≪Log Analysis Device 10≫ Figure 2 shows an example of the hardware configuration of the log analysis device 10 according to this embodiment. As shown in Figure 2, the log analysis device 10 according to this embodiment includes an input device 11, a display device 12, an external I / F 13, a communication I / F 14, a RAM (Random Access Memory) 15, a ROM (Read Only Memory) 16, an auxiliary storage device 17, and a processor 18. Each of these hardware components is connected to the others via a bus 19 so as to be able to communicate with each other.

[0020] The input device 11 is, for example, a keyboard, mouse, or touch panel. The display device 12 is, for example, a display or display panel. Note that the log analysis device 10 does not necessarily have to have at least one of the input device 11 and the display device 12.

[0021] External I / F 13 is an interface to external devices such as recording media 13a. The log analysis device 10 can read from and write to the recording media 13a via the external I / F 13. Examples of recording media 13a include flexible disks, CDs (Compact Discs), DVDs (Digital Versatile Disks), SD memory cards (Secure Digital memory cards), and USB (Universal Serial Bus) memory cards.

[0022] The communication interface 14 is an interface for connecting the log analysis device 10 to the communication network 40. The RAM 15 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 16 is a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 17 is, for example, a storage device (storage device) such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory. The processor 18 is, for example, an arithmetic unit such as a CPU (Central Processing Unit).

[0023] The log analysis device 10 according to this embodiment can perform various processes described later by having the hardware configuration shown in Figure 2. Note that the hardware configuration shown in Figure 2 is just one example, and the hardware configuration of the log analysis device 10 is not limited to this. For example, the log analysis device 10 may have multiple auxiliary storage devices 17 and multiple processors 18, it may not have some of the hardware shown, or it may have various hardware other than the hardware shown.

[0024] ≪Equipment 20≫ Figure 3 shows an example of the hardware configuration of the device 20 according to this embodiment. As shown in Figure 3, the device 20 according to this embodiment has a communication interface 21, a memory device 22, and a processor 23. Each of these hardware components is connected to each other via a bus 24 so as to be able to communicate.

[0025] The communication interface 21 is an interface for connecting the device 20 to the communication network 40 or for communicating with the device 30. The memory device 22 is a storage device such as flash memory. The processor 23 is an arithmetic unit such as an MPU (Micro Processor Unit).

[0026] The device 20 according to this embodiment can perform various processes described later by having the hardware configuration shown in Figure 3. Note that the hardware configuration shown in Figure 3 is just one example, and the device 20 may have multiple memory devices 22 and multiple processors 23, or it may not have some of the hardware shown, or it may have various hardware other than the hardware shown.

[0027] <Example of functional configuration of log analysis device 10 and equipment 20> The following describes an example of the functional configuration of the log analysis device 10 and equipment 20 according to this embodiment.

[0028] ≪Log Analysis Device 10≫ Figure 4 shows an example of the functional configuration of the log analysis device 10 according to this embodiment. As shown in Figure 4, the log analysis device 10 according to this embodiment includes a log receiving unit 101, a log storage unit 102, a log analysis unit 103, and a visualization unit 104. Each of these units is realized, for example, by processing that one or more programs installed on the log analysis device 10 cause the processor 18 to execute. The log analysis device 10 according to this embodiment also includes a log storage unit 105 and a device information storage unit 106. Each of these units is realized, for example, by an auxiliary storage device 17. However, at least one of the log storage unit 105 and the device information storage unit 106 may be realized, for example, by a storage device (for example, a database server) connected to the log analysis device 10 via a communication network 40.

[0029] The log receiving unit 101 receives logs transmitted from the device 20. The log includes, for example, a device ID that identifies the device 20 that sent the log, a date and time indicating the date and time the log was created, a log level indicating the importance of the event represented by the log, and log content indicating the content of the event. In other words, the log is represented in the format, for example, (device ID, date and time, log level, log content).

[0030] Here, various log levels are possible depending on the events that may occur in device 20, but below, as an example, we will assume that there are at least two log levels: "Information," which indicates an event during normal processing, and "Error," which indicates an abnormal event. In addition to these, other log levels such as "Caution," which indicates an event that requires attention such as exception handling, and "Warning," which indicates an event that warrants a warning, may also exist.

[0031] Furthermore, while various log contents are possible depending on the events that may occur on device 20, in the following example, we will assume that at least "Login Success," which is an event during normal processing, and "Communication Interruption," which is an abnormal event, exist. In addition to these, various other events such as "Login Failure," "Exception Handling Occurred," "Device Failure," and "Unauthorized Operation Detected" may also exist as log contents.

[0032] The log storage unit 102 stores the logs received by the log receiving unit 101 in the log storage unit 105.

[0033] The log analysis unit 103 analyzes the logs stored in the log storage unit 105 at predetermined time intervals (hereinafter referred to as "ΔT1"). At this time, if there are logs with a log level of "error" among the logs during the past ΔT1, the log analysis unit 103 refers to the device information stored in the device information storage unit 106 and identifies the attribute information that is the cause of the anomaly from that log. Hereinafter, logs with a log level of "error" will also be referred to as "error logs".

[0034] The visualization unit 104 visualizes the attribute information identified by the log analysis unit 103 as abnormal factors. The visualization unit 104 may visualize the abnormal factors on a display device 12 such as a display, or on a display provided by a monitoring terminal connected to the log analysis device 10 via a communication network 40.

[0035] The log storage unit 105 stores logs. Specific examples of logs stored in the log storage unit 105 will be described later.

[0036] The device information storage unit 106 stores device information that includes attribute information for each device 20. Specific examples of the device information stored in the device information storage unit 106 will be described later.

[0037] ≪Equipment 20≫ Figure 5 shows an example of the functional configuration of the device 20 according to this embodiment. As shown in Figure 5, the device 20 according to this embodiment has a log creation unit 201 and a log transmission unit 202. Each of these units is realized, for example, by a process that one or more programs installed on the device 20 cause the processor 23 to execute.

[0038] The log creation unit 201 creates a log related to an event when an event that is eligible for logging occurs. Examples of events eligible for logging include a predetermined operation being performed on the device 20, a predetermined process being performed by the software installed in the device 20, or a predetermined abnormality occurring in the device 20 itself or the software installed in the device 20.

[0039] The log transmission unit 202 transmits the log created by the log creation unit 201 to the log analysis device 10.

[0040] <Logs stored in log storage unit 105> A specific example of a log stored in the log storage unit 105 is shown in Figure 6. As shown in Figure 6, the log storage unit 105 stores one or more logs, and each log includes a device ID, date and time, log level, and log content.

[0041] For example, in the example shown in Figure 6, the following log is stored: (Device ID, Date and Time, Log Level, Log Content) = (C, 2022-02-09 18:30:10, Information, Login Success). Similarly, the following log is stored: (Device ID, Date and Time, Log Level, Log Content) = (B, 2022-02-09 17:30:10, Error, Communication Disconnection). Similarly, the following log is stored: (Device ID, Date and Time, Log Level, Log Content) = (A, 2022-02-09 17:29:10, Error, Communication Disconnection). Similarly, the following log is stored: (Device ID, Date and Time, Log Level, Log Content) = (D, 2022-02-08 18:30:10, Information, Login Success).

[0042] Thus, the log storage unit 105 stores one or more logs (generally a large number of logs) in the format of (device ID, date and time, log level, log content).

[0043] <Device information stored in the device information storage unit 106> Figure 7 shows a specific example of the device information stored in the device information storage unit 106. As shown in Figure 7, the device information storage unit 106 stores device information for each device 20, and each device information includes, for example, a device ID, model number, software version, power source, type of wireless communication, location on the network, and connected device information. That is, the device information storage unit 106 stores one or more pieces of device information in the format of, for example, (device ID, model number, software version, power source, type of wireless communication, location on the network, connected device information). Of the information included in the device information, the information other than the device ID (i.e., model number, software version, power source, type of wireless communication, location on the network, and connected device information) is attribute information.

[0044] For example, in the example shown in Figure 7, (device ID, model number, software version, power source, type of wireless communication, network location, connected device information) = (A, TypeA, 1.0, system A, LTE, base station A, ...) is stored. Similarly, (device ID, model number, software version, power source, type of wireless communication, network location, connected device information) = (B, TypeA, 1.0, system B, wireless LAN, access point A, ...) is stored. Similarly, (device ID, model number, software version, power source, type of wireless communication, network location, connected device information) = (C, TypeA, 1.2, system B, LTE, base station A, ...) is stored. Similarly, (device ID, model number, software version, power source, type of wireless communication, network location, connected device information) = (D, TypeB, 1.0, system B, LTE, base station B, ...) is stored.

[0045] Thus, for each device 20, the device information storage unit 106 stores device information including the device ID of that device 20 in the format (device ID, model number, software version, power source, type of wireless communication, network location, connected device information). However, as mentioned above, attribute information is not limited to the model number, software version, power source, type of wireless communication, network location, and connected device information. Generally, when using N attribute information, the device information storage unit 106 stores device information including the device ID of each device 20 in the format (device ID, attribute information 1, attribute information 2, ..., attribute information N).

[0046] <Log creation and storage process> The log creation and storage process according to this embodiment will be described below with reference to Figure 8. Steps S101 to S104 below will be repeatedly executed each time an event that is subject to log creation occurs in each device 20. In the following description, we will assume that an event that is subject to log creation has occurred in a certain device 20.

[0047] The log creation unit 201 of the device 20 creates a log related to the event (step S101).

[0048] Next, the log transmission unit 202 of the device 20 transmits the log created in step S101 to the log analysis device 10 (step S102).

[0049] The log receiving unit 101 of the log analysis device 10 receives the log transmitted from the device 20 (step S103).

[0050] The log storage unit 102 of the log analysis device 10 stores the logs received in step S103 into the log storage unit 105 (step S104). As a result, logs of predetermined events that occurred in each device 20 are stored in the log storage unit 105.

[0051] <Log analysis and visualization of abnormal factors> The log analysis and anomaly cause visualization processes according to this embodiment will be described below with reference to Figure 9. Steps S201 to S211 below are repeatedly executed at predetermined time intervals ΔT1. The value of the predetermined time interval ΔT1 is set arbitrarily in advance, but for example, it can be a value of several tens of seconds to several minutes. In the following, the current time will be represented by t.

[0052] The log analysis unit 103 of the log analysis device 10 determines whether or not an error log exists among the logs stored in the log storage unit 105 during the past ΔT1 (step S201). That is, the log analysis unit 103 determines whether or not an error log exists among the logs stored in the log storage unit 105 during the period from t-ΔT1 to t. Hereafter, error logs during the period from t-ΔT1 to t will be referred to as "candidate logs for analysis".

[0053] If, in step S201 above, it is determined that no error logs exist in the logs between t-ΔT1 and t (i.e., no candidate logs for analysis exist), the log analysis unit 103 of the log analysis device 10 terminates the log analysis and abnormality cause visualization process. This is because, in this case, no abnormalities occurred in any of the devices 20 between t-ΔT1 and t.

[0054] On the other hand, if step S201 determines that an error log exists in the log between t-ΔT1 and t (i.e., a candidate log for analysis exists), the log analysis unit 103 of the log analysis device 10 acquires one error log from the candidate logs that has not yet been targeted for analysis as the log to be analyzed (step S202).

[0055] Next, the log analysis unit 103 of the log analysis device 10 obtains attribute information of the device ID included in the log to be analyzed, which was obtained in step S202 above, from the device information storage unit 106 (step S203). That is, the log analysis unit 103 identifies the device information that contains the same device ID as the device ID included in the log to be analyzed from the device information stored in the device information storage unit 106, and obtains the attribute information included in this identified device information. Hereinafter, the set of attribute information obtained in this step will be referred to as the "first attribute information set".

[0056] For example, if the device ID included in the log to be analyzed is "A", then the nth (where 1 ≤ n ≤ N) attribute information of device ID "A" is a n (A) Therefore, the first attribute information set is E1={a n (A) It can be expressed as |n=1,···,N}.

[0057] Next, the log analysis unit 103 of the log analysis apparatus 10 identifies the error type from the log content included in the analysis target log acquired in step S202 above (step S204). Here, the error type refers to the type (or kind) of event (i.e., abnormal event) represented by a log with a log level of "error" or higher. The log analysis unit 103 can identify the error type from the log content by referring to, for example, a table or the like in which the log content and the error type are associated in advance. In addition to this, the log analysis unit 103 may, for example, identify the log content itself as the error type. For example, when the log content itself is used as the error type, if the log content is "communication interruption", the error type is also "communication interruption".

[0058] Next, the log analysis unit 103 of the log analysis apparatus 10 determines whether there is an error log of the same error type as the error type identified in step S204 above among the logs stored in the log storage unit 105 within a time period of ΔT2 before and after the date and time included in the analysis target log acquired in step S202 above (step S205). Here, ΔT2 is a preset time interval. The value of this time interval ΔT2 is set to an arbitrary value in advance, but it is assumed that ΔT2 > ΔT1. Note that ΔT2 is preferably a value that is somewhat larger than ΔT1, and for example, it is preferably a value that is several to more than a dozen times that of ΔT1.

[0059] That is, when the date and time of the analysis target log is t', the log analysis unit 103 determines whether there is an error log of the same error type as the analysis target log among the logs stored in the log storage unit 105 that are within the time period from t' - ΔT2 to t (< t' + ΔT2). Hereinafter, an error log that is within the time period from t' - ΔT2 to t (< t' + ΔT2) and has the same error type as the analysis target log will be referred to as an "error log of the same type". Note that there may be multiple error logs of the same type. In particular, in the case of an abnormality caused by the attributes of the device 20, the same error type of abnormality may occur in multiple devices 20 having the same attribute, so there may be multiple error logs of the same type.

[0060] If, in step S205 described above, among the logs from t'-ΔT2 to t, it is determined that there is no error log of the same error type as the error type of the analysis target log (that is, when there is no error log of the same type), the log analysis unit 103 of the log analysis device 10 ends the log analysis and the abnormal factor visualization process. In this case, it is because, among devices 20 other than the device 20 with the device ID included in the analysis target log, no abnormality of the same error type as the analysis target log has occurred from t'-ΔT2 to t.

[0061] On the other hand, if, in step S205 described above, among the logs from t'-ΔT2 to t, it is determined that there is an error log of the same error type as the error type of the analysis target log (that is, when there is an error log of the same type), the log analysis unit 103 of the log analysis device 10 specifies the device information including the same device ID as the device ID included in the error log of the same type among the device information stored in the device information storage unit 106, and acquires the attribute information included in this specified device information (step S206). Hereinafter, the set of attribute information obtained in this step will be referred to as the "second set of attribute information".

[0062] For example, if the device ID included in the error log of the same type is "i", and the nth (where 1≦n≦N) attribute information of the device ID "i" is a n (i) then the second set of attribute information is E2={a n (i) |n = 1,···,N,i∈D A}. However, D A is the set of device IDs included in the error log of the same type.

[0063] Next, the log analysis unit 103 of the log analysis device 10 acquires the common part of the first set of attribute information and the second set of attribute information as the third set of attribute information (step S207). That is, the log analysis unit 103 acquires E3 = E1∩E2 as the third set of attribute information.

[0064] For example, let's assume E1 = {Model number = Type A, Software version = 1.0, Power source = System A, Wireless communication type = LTE, Network location = Base station A, Connected device information = Ver1.5}. Also, for example, let's assume E2 = {Model number = Type A, Software version = 1.0, Power source = System B, Wireless communication type = Wireless LAN, Network location = Access point A, Connected device information = Ver1.5, Model number = Type A, Software version = 1.3, Power source = System B, Wireless communication type = Wireless LAN, Network location = Access point A, Connected device information = Ver1.5}. In this case, E3 = {Model number = Type A, Software version = 1.0, Connected device information = Ver1.5}.

[0065] In this way, attribute information common to all devices 20 experiencing the same type of error is obtained as a third set of attribute information.

[0066] Next, the log analysis unit 103 of the log analysis device 10 identifies the logs of equipment 20 in which no abnormalities have occurred from among the logs stored in the log storage unit 105, and obtains the attribute information contained in the equipment information of the equipment ID included in the identified logs (step S208). For example, the log analysis unit 103 can identify logs with a log level less than "Error" (i.e., logs with log levels such as "Information," "Caution," or "Warning") as logs of equipment 20 in which no abnormalities have occurred. Hereafter, the set of attribute information obtained in this step will be referred to as the "fourth attribute information set."

[0067] For example, let "j" be the device ID included in the log of device 20, which has not experienced any abnormalities, and let a be the nth (where 1 ≤ n ≤ N) attribute information of device ID "j". n (j) Therefore, the fourth attribute information set is E4={a n (j) This can be expressed as |n=1,···,N,j∈D}, where D is the set of device IDs for the 20 devices that have not experienced any abnormalities.

[0068] In step S208 described above, logs of equipment 20 that did not experience any abnormalities were identified from all logs stored in the log storage unit 105. However, it is also possible to identify logs of equipment 20 that did not experience any abnormalities from logs from the past ΔT3 (where ΔT3 ≥ ΔT2).

[0069] Next, the log analysis unit 103 of the log analysis device 10 obtains the fifth attribute information by deleting the fourth attribute information set from the third attribute information set (step S209). That is, the log analysis unit 103 obtains E5 = E3 \ E4 as the fifth attribute information set.

[0070] For example, let's assume E3 = {Model number = Type A, Software version = 1.0, Connected device information = Ver1.5}. Also, for example, let's assume E4 = {Model number = Type A, Software version = 1.2, Power source = System B, Wireless communication type = LTE, Network location = Base station A, Connected device information = Ver1.1, Model number = Type B, Software version = 1.0, Power source = System B, Wireless communication type = LTE, Network location = Base station B, Connected device information = Ver1.1}. In this case, E5 = {Connected device information = Ver1.5}.

[0071] In this way, by deleting the attribute information of devices 20 that are not experiencing the same type of error from the attribute information common to devices 20 experiencing the same error type, attribute information specific to that error is obtained as a fifth set of attribute information. This is because attribute information specific to the error is highly likely to be the cause of that error.

[0072] Next, the visualization unit 104 of the log analysis device 10 visualizes the attribute information included in the fifth attribute information set obtained in step S209 as anomaly factors (step S210). For example, if E5 = {connection device information = Ver1.5}, the visualization unit 104 visualizes information indicating that the anomaly factor for device 20 with device ID "A" is "connection device information = Ver1.5". This allows the user to know the attribute information that is the cause of the anomaly represented by the log being analyzed (more precisely, the attribute information that may be the cause of that anomaly).

[0073] Next, the log analysis unit 103 of the log analysis device 10 determines whether or not there are any error logs among the candidate logs that have not yet been analyzed (step S211).

[0074] If step S211 determines that there are error logs among the candidate logs that have not yet been analyzed, the log analysis unit 103 of the log analysis device 10 returns to step S202. As a result, steps S202 to S210 are repeatedly executed until there are no more candidate logs that have not yet been analyzed.

[0075] On the other hand, if step S211 above does not determine that there are any error logs among the candidate logs that have not yet been analyzed, the log analysis unit 103 of the log analysis device 10 terminates the log analysis and abnormal cause visualization process.

[0076] <Summary> As described above, when an abnormality occurs in a certain device 20, the log analysis device 10 according to this embodiment can analyze the log of that device 20 and visualize attribute information common to other devices 20 experiencing the same abnormality as that device 20 as the cause of the abnormality. Moreover, at this time, the log analysis device 10 according to this embodiment can visualize attribute information common to other devices 20 as the cause of the abnormality, even if that attribute information is not necessarily included in the log.

[0077] Therefore, by using the log analysis device 10 according to this embodiment, users can learn about the common cause of the anomaly in multiple devices 20 that are experiencing the same anomaly, and take various measures to resolve the anomaly or prevent its recurrence.

[0078] The present invention is not limited to the embodiments specifically disclosed above, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of Symbols]

[0079] 1. Log Analysis System 10 Log analysis device 11 Input devices 12 Display device 13 External I / F 13a Recording medium 14 Communication I / F 15 RAM 16 ROM 17 Auxiliary storage 18 processors 19 bus 20 equipment 21 Communication I / F 22 Memory devices 23 processors 24 buses 30 devices 40 Communication Networks 101 Log receiving unit 102 Log storage section 103 Log Analysis Department 104 Visualization section 105 Log storage unit 106 Device information storage section 201 Log Creation Department 202 Log transmission section

Claims

1. A log storage unit configured to store logs of events that occurred on each of multiple devices, An attribute information storage unit configured to store attribute information of the aforementioned device, A first determination unit is configured to determine whether a first log indicating a log related to an abnormal event has been stored in the log storage unit at predetermined time intervals, If it is determined that the first log has been stored in the log storage unit, the second determination unit is configured to determine whether or not a second log indicating the abnormal event is stored in the log storage unit within a predetermined time interval before and after the first log. The first acquisition unit is configured to acquire common attribute information from the attribute information storage unit, which includes attribute information of the first device where the abnormal event represented by the first log occurred and attribute information of the second device where the abnormal event represented by the second log occurred. A second acquisition unit is configured to acquire attribute information of equipment in which the aforementioned abnormal event has not occurred from the attribute information storage unit, A visualization unit is configured to visualize attribute information obtained by excluding the attribute information of equipment in which the abnormal event has not occurred from the aforementioned common attribute information, as the cause of the abnormal event. A log analysis device having the following features.

2. The first determination unit is, A predetermined time width ΔT １ Each time, it is configured to determine whether or not the first log has been stored in the log storage unit. The second determination unit described above is: If it is determined that the first log has been stored in the log storage unit, a predetermined time width ΔT before and after the first log is determined. ２ (However, ΔT ２ >ΔT １ The log analysis device according to claim 1, further configured to determine whether the second log is stored in the log storage unit.

3. The log analysis device according to claim 1 or 2, wherein the attribute information is information representing the attributes of the device and includes information not included in the log.

4. The log analysis device according to claim 3, wherein the attribute information includes at least one of the following: the model number of the device, the version of the software installed in the device, the power source of the device, the type of wireless communication used by the device, the access point or base station used by the device, information about devices connected to the device, the address where the device is installed, the name of the building where the device is installed, and information about a production target related to the device.

5. A log analysis device comprising a log storage unit that stores logs of events that occurred in each of multiple devices, and an attribute information storage unit that stores attribute information of the devices, A first determination procedure for determining whether a first log indicating a log related to an abnormal event has been stored in the log storage unit at predetermined time intervals, If it is determined that the first log has been stored in the log storage unit, a second determination procedure is performed to determine whether a second log indicating the abnormal event is stored in the log storage unit within a predetermined time interval before and after the first log, A first acquisition procedure for acquiring common attribute information from the attribute information storage unit between the attribute information of the first device where the abnormal event represented by the first log occurred and the attribute information of the second device where the abnormal event represented by the second log occurred, A second acquisition procedure for acquiring attribute information of equipment in which the aforementioned abnormal event has not occurred from the attribute information storage unit, A visualization procedure for visualizing attribute information obtained by excluding the attribute information of equipment in which the abnormal event has not occurred from the aforementioned common attribute information, as the cause of the abnormal event, A log analysis method for performing this task.

6. A log analysis device comprising a log storage unit that stores logs of events occurring in each of multiple devices, and an attribute information storage unit that stores attribute information of the devices, A first determination procedure for determining whether a first log indicating a log related to an abnormal event has been stored in the log storage unit at predetermined time intervals, If it is determined that the first log has been stored in the log storage unit, a second determination procedure is performed to determine whether a second log indicating the abnormal event is stored in the log storage unit within a predetermined time interval before and after the first log, A first acquisition procedure for acquiring common attribute information from the attribute information storage unit between the attribute information of the first device where the abnormal event represented by the first log occurred and the attribute information of the second device where the abnormal event represented by the second log occurred, A second acquisition procedure for acquiring attribute information of equipment in which the aforementioned abnormal event has not occurred from the attribute information storage unit, A visualization procedure for visualizing attribute information obtained by excluding the attribute information of equipment in which the abnormal event has not occurred from the aforementioned common attribute information, as the cause of the abnormal event, A program that executes the command.

Images