Event monitoring device and method

Abstract

This event monitoring device (2) includes: a time synchronization unit (22) that synchronizes an internal time with a reference time; a timer (21) that measures an elapsed time at the same rate as the reference time; a time stamp assignment unit (23); and a storage unit (25). When an offset value indicating a deviation of the internal time from the reference time is acquired, the time stamp assignment unit (23) resets the elapsed time to 0 and updates the sum of the offset value and the internal time as a new value of a first time stamp. When an event occurs, the time stamp assignment unit (23) additionally stores the sum of the first time stamp and the elapsed time in the storage unit (25) as a new value of a second time stamp indicating a time of event occurrence.

Description

Event monitoring device and method

[0001] The present invention relates to an event monitoring device and method for monitoring events such as packet arrival.

[0002] To measure the latency of packets transmitted between two points on a transmission path, observation devices at each point record the timestamp of each packet as it passes through, collect the observation data in one place, and calculate the difference in the timestamps of the same packet as it passes through. When using a combination of timestamps recorded by multiple observation devices in this way, it is necessary that the internal clocks of all observation devices are synchronized (Patent Document 1).

[0003] Methods for time synchronization include time synchronization via the internet and obtaining time from GPS (Global Positioning System) satellites. Protocols for time synchronization via the internet include the conventional NTP (Network Time Protocol) (Non-Patent Documents 1 and 2) and the high-precision PTP (Precision Time Protocol), which has been increasingly adopted in recent years. NTP has an accuracy of 1-10 ms, while PTP has an accuracy of 1 μs. However, even with time synchronization, accurate timestamps are not always guaranteed.

[0004] For example, in the technology disclosed in Patent Document 2, the problem is that the accuracy of the measurement time decreases due to the non-linear fluctuation of the internal clock, the variation in the time obtained from the external clock, and the error in the packet capture timing. Therefore, the terminals on the transmission side and the reception side each acquire the time of the external clock at regular intervals by the internal clock, and associate the first elapsed time, which is the elapsed time indicated by the internal clock, with the acquired external time. Further, the terminals on the transmission side and the reception side each extract a packet including the transmission number sent from the transmission device to the reception device from the network, and associate the transmission number extracted from the packet with the second elapsed time, which is the elapsed time indicated by the internal clock when the packet is extracted. The analysis device removes the high-frequency component in the error fluctuation between the first elapsed time and the external time, calculates the external time after removing the high-frequency component, and calculates the difference between the external times calculated on the transmission side and the reception side as the delay time. The technology disclosed in this Patent Document 2 calculates the corrected external time by removing a predetermined high-frequency component from the external time with the read first elapsed time on the horizontal axis and the read external time on the vertical axis after accumulating the measurement results of the first elapsed time and the external time. Therefore, even if it is accurate, there is a problem of lacking real-time performance.

[0005] As a factor for the decrease in the accuracy of the measurement time, a change in the progress of the time (internal time) indicated by the internal clock to be synchronized is also considered. For example, in NTP, there are two synchronization modes. In the Step mode, as shown in FIG. 8, the internal time T_internal to be synchronized is immediately adjusted to the reference time T_ref. On the other hand, in the Slew mode in which the internal time is gradually adjusted to the reference time, when the internal time T_internal is behind the reference time T_ref, the progress of the internal time T_internal is increased to catch up with the reference time T_ref and the internal time T_internal is adjusted to the reference time T_ref. When the internal time T_internal is ahead of the reference time T_ref, the progress of the internal time T_internal is decreased to be caught up by the reference time T_ref and the internal time T_internal is adjusted to the reference time T_ref to prevent the internal time T_internal from going back.

[0006] In Step mode, services that are supposed to run at a fixed time may not run because the internal time Tinternal is advanced by a single step, or the same service may run twice because the internal time Tinternal is moved backward. However, these problems in Step mode do not occur in Slew mode. However, Slew mode has the problem that because it raises or lowers the progress of the synchronized internal time Tinternal, it is not possible to obtain correct results when determining the time interval between an event and subsequent events. The example in Figure 9 shows that events occurred at times t1 and t2. In this case, it can be seen that the event time interval Iinternal, which is obtained from the internal time Tinternal, is inaccurate compared to the event time interval Iref, which is obtained from the reference time Tref.

[0007] For the reasons explained in Figure 9, even if the actual time interval between two events measured by a single device is 1 second, increasing the rate of advance of the device's internal clock will result in a measurement result indicating that the event time interval is longer than 1 second. Conversely, decreasing the rate of advance of the internal clock will result in a measurement result indicating that the event time interval is shorter than 1 second. Therefore, for example, the packet monitoring device disclosed in Patent Document 3 will be unable to calculate the correct packet reception interval.

[0008] Furthermore, even if the time interval between an event occurring earlier in one device and an event occurring later in the other device is actually constant, increasing the clock rate of the other device will result in measurement results that make it appear as if the time interval between events is gradually lengthening. Conversely, decreasing the clock rate of the other device will result in measurement results that make it appear as if the time interval between events is gradually shortening. Thus, when determining time intervals, not only the difference from the reference time but also the rate of the reference clock is a relevant factor.

[0009] Japanese Patent Publication No. 2011-82860, Japanese Patent Publication No. 2008-118270, International Publication WO2024 / 134755

[0010] David L. Mills, “RFC 1305: Network Time Protocol (Version 3) Specification, Implementation and Analysis”, Internet Engineering Task Force (IETF), March 1992, <https: / / datatracker.ietf.org / doc / html / rfc1305> D. Mills, J. Martin, Ed., J. Burbank, W. Kasch, “RFC 5905: Network Time Protocol Version 4: Protocol and Algorithms Specification”, Internet Engineering Task Force (IETF), June 2010, <https: / / datatracker.ietf.org / doc / rfc5905 / >

[0011] The present invention has been made to solve the above problems and aims to provide an event monitoring device and method capable of saving a correct timestamp indicating the time an event occurred.

[0012] The event monitoring device of the present invention comprises an internal clock configured to measure time, a time synchronization unit configured to synchronize the internal time indicated by the internal clock with a reference time distributed from an external time source, a timer configured to measure elapsed time at the same rate as the reference time, an event occurrence detection unit configured to detect the occurrence of an event, a timestamp assignment unit configured to obtain two timestamps: a first timestamp for correcting the discrepancy in the event occurrence time due to the internal time, and a second timestamp indicating the event occurrence time, and a storage unit configured to store the second timestamp. The timestamp assignment unit is characterized in that, when it obtains an offset value indicating the discrepancy of the internal time with respect to the reference time, it resets the elapsed time to 0, updates the sum of the offset value and the internal time at the time the offset value was obtained as a new value for the first timestamp, and when the event occurs, it adds the sum of the first timestamp and the elapsed time to the storage unit as a new value for the second timestamp.

[0013] Furthermore, the event monitoring method of the present invention is characterized by including: a first step of synchronizing the internal time indicated by an internal clock with a reference time distributed from an external time source; a second step of resetting a timer that measures elapsed time at the same rate as the reference time when an offset value indicating the difference between the internal time and the reference time is obtained, and updating the sum of the offset value and the internal time at the time the offset value was obtained as a new value for the first timestamp; a third step of detecting the occurrence of an event; and a fourth step of adding and saving the sum of the first timestamp and the elapsed time as a new value for the second timestamp indicating the time the event occurred when the event occurs.

[0014] According to the present invention, by providing a timer, an event detection unit, and a timestamp assignment unit, a correct second timestamp can be saved even if the progress of the internal clock is changed. Therefore, the present invention makes it possible to correctly calculate the event occurrence time interval.

[0015] Figure 1 is a block diagram showing the configuration of an event monitoring system according to the first embodiment of the present invention. Figure 2 is a flowchart illustrating the operation of the time synchronization unit of the event monitoring device according to the first embodiment of the present invention. Figure 3 is a flowchart illustrating the operation of the time stamp assignment unit of the event monitoring device according to the first embodiment of the present invention. Figure 4 is a flowchart illustrating the operation of the event occurrence detection unit of the event monitoring device according to the first embodiment of the present invention. Figure 5 is a diagram showing an example of the relationship between internal time, offset value, elapsed time and time stamp. Figure 6 is a block diagram showing the configuration of an event monitoring system according to the second embodiment of the present invention. Figure 7 is a block diagram showing an example of the configuration of a computer realizing an event monitoring device according to the first to fourth embodiments of the present invention. Figure 8 is a diagram illustrating the Step mode of NTP. Figure 9 is a diagram illustrating the problems of the Slew mode of NTP.

[0016] [First Embodiment] Hereinafter, embodiments of the present invention will be described with reference to the drawings. Figure 1 is a block diagram showing the configuration of an event monitoring system according to the first embodiment of the present invention. The event monitoring system consists of a time source 1 and an event monitoring device 2.

[0017] An example of a time source 1 is an NTP server that distributes accurate time (reference time Tref). The event monitoring device 2 (NTP client) includes an internal clock 20, a timer 21, a time synchronization unit 22, a timestamp assignment unit 23, an event occurrence detection unit 24, a storage unit 25, and a time interval calculation unit 26.

[0018] The internal clock 20 is the system clock of the event monitoring device 2. In this embodiment, the time indicated by the internal clock 20 is defined as the internal time Tinternal. The difference between the internal time Tinternal and the reference time Tref is defined as the offset value ΔT. The timer 21, which is specifically called the "internal time Toffset at offset acquisition" when the internal time Tinternal is acquired, measures the elapsed time Ttimer at the same rate as the reference time Tref, independently of the internal clock 20, in the event monitoring device 2. The timer 21 is capable of measuring a time sufficiently longer than the expected interval between events. Furthermore, because it is necessary to measure the elapsed time Ttimer at the same rate as the reference time Tref, the timer 21 does not raise or lower its progress, unlike the internal clock 20 which is controlled by the time synchronization unit 22 described later. Ideally, timer 21 should advance with high precision at exactly the same rate as the reference time Tref. However, in reality, it is not easy to make them advance at exactly the same rate, so it is unavoidable that the discrepancy between the actual elapsed time (the amount of change in reference time Tref from the point when the elapsed time Ttimer is reset to 0) and the elapsed time Ttimer will widen over time.

[0019] The time synchronization unit 22 synchronizes the internal time Tinternal with the reference time Tref in the event monitoring device 2 so that the offset value ΔT becomes 0. The time synchronization unit 22 does not perform simple instantaneous synchronization, but rather adjusts the progress of the internal clock 20 to gradually bring the internal time Tinternal closer to the reference time Tref. In other words, the time synchronization unit 22 performs time synchronization using the NTP Slew mode method.

[0020] The event detection unit 24 transmits an event detection flag indicating the occurrence of an event and event information to the timestamp assignment unit 23. An example of an event is when an RTP (Real-time Transport Protocol) packet of a specific flow arrives at the event monitoring device 2. An example of event information is a sequence number extracted from the header of the RTP packet.

[0021] When the timestamp assignment unit 23 obtains an offset value ΔT from the time synchronization unit 22, it resets the elapsed time Ttimer measured by the timer 21 to 0, and updates the stored reset timestamp Treset with the sum of the obtained offset value ΔT and the internal time Toffset at the time the offset value was obtained as the new reset timestamp Treset. It is unavoidable that the discrepancy between the actual elapsed time (the amount of change in the reference time Tref from the time the elapsed time Ttimer was reset to 0) and the elapsed time Ttimer will increase over time, but if the offset value ΔT is updated and the elapsed time Ttimer is reset to 0 while the discrepancy is small enough that it does not become a problem, the expansion of the discrepancy can be suppressed. Therefore, the interval between obtaining the offset value ΔT and resetting the elapsed time Ttimer to 0 must be sufficiently longer than the expected event occurrence interval, and sufficiently shorter than the time required for the discrepancy between the actual elapsed time and the elapsed time Ttimer to expand to a problematic extent.

[0022] The timestamp assignment unit 23 has a function to send an offset value acquisition request command to the time synchronization unit 22. The time synchronization unit 22 sends the offset value ΔT to the timestamp assignment unit 23 in response to the offset value acquisition request command. As described above, the timer 21 is reset to 0 when the offset value ΔT is acquired, so the timestamp assignment unit 23 needs to acquire the offset value ΔT before the timer 21 rolls over. Also, as described above, the interval between acquiring the offset value ΔT and resetting the elapsed time Ttimer to 0 needs to be sufficiently longer than the expected event occurrence interval, and sufficiently shorter than the time required for the discrepancy between the actual elapsed time and the elapsed time Ttimer to widen to a problematic extent. As long as these conditions are met, the timing of sending the offset value acquisition request command does not necessarily need to be at equal intervals.

[0023] Furthermore, when the event detection unit 24 detects an event and sets the event detection flag, the timestamp assignment unit 23 calculates the sum of the reset timestamp Treset stored in its own memory and the current elapsed time Ttimer measured by the timer 21, and stores the calculated time as the event occurrence timestamp Tenvent in the storage unit 25 along with the event information.

[0024] Figure 2 is a flowchart illustrating the operation of the time synchronization unit 22, Figure 3 is a flowchart illustrating the operation of the timestamp assignment unit 23, and Figure 4 is a flowchart illustrating the operation of the event occurrence detection unit 24. Figure 5 is a diagram showing an example of the relationship between the internal time Tinternal, the internal time Toffset at the time of offset acquisition, the offset value ΔT, the elapsed time Ttimer, and the timestamps Treset and Tenent.

[0025] The time synchronization unit 22 increases the advance of the internal time Tinternal so that the offset value ΔT = Tref - Tinternal, which is the difference between the reference time Tref and the internal time Tinternal, becomes 0 if the offset value ΔT is positive, i.e., the internal time Tinternal is behind the reference time Tref (YES in step S100 of Figure 2) (step S101 of Figure 2). Conversely, the time synchronization unit 22 decreases the advance of the internal time Tinternal so that the offset value ΔT becomes 0 if the offset value ΔT is negative, i.e., the internal time Tinternal is ahead of the reference time Tref (YES in step S102 of Figure 2) (step S103 of Figure 2).

[0026] In the example in Figure 5, initially the internal time Tinternal is behind the reference time Tref, and the time synchronization unit 22 increases the progress of the internal time Tinternal. However, midway through, the internal time Tinternal overtakes the reference time Tref, and the time synchronization unit 22 decreases the progress of the internal time Tinternal. Also, in the example in Figure 5, the first and second events occur between the i-th and (i+1)th offset value acquisitions, and the third event occurs after the (i+1)th offset value acquisition.

[0027] When the time synchronization unit 22 receives a command requesting the acquisition of an offset value from the timestamp assignment unit 23 (YES in step S104 in Figure 2), it passes the offset value ΔT to the timestamp assignment unit 23 (step S105 in Figure 2). The time synchronization unit 22 repeatedly performs the processes in steps S100 to S105.

[0028] When the timestamp assignment unit 23 obtains an offset value ΔT from the time synchronization unit 22 (YES in step S200 of Figure 3), it resets the elapsed time Ttimer measured by the timer 21 to 0 (step S201 of Figure 3). The timestamp assignment unit 23 updates the stored reset timestamp Treset with the sum of the obtained offset value ΔT and the internal time Toffset at the time the offset value was obtained as the new reset timestamp Treset (step S202 of Figure 3).

[0029] In the example shown in Figure 5, when the i-th offset value ΔT_i is obtained at time t1, the timestamp assigning unit 23 resets the elapsed time Ttimer to 0 and obtains the internal time Tinternal, setting this value as the internal time Toffset_i at the time the offset value was obtained. The timestamp assigning unit 23 sets Treset_i = Toffset_i + ΔT_i as the new reset timestamp.

[0030] When an event occurs (YES in step S300 of Figure 4), the event detection unit 24 sends an event detection flag VF indicating the occurrence of an event and event information VI to the timestamp assignment unit 23 (step S301 of Figure 4).

[0031] When the timestamp assignment unit 23 learns that an event has occurred based on the event detection flag VF (YES in step S203 of Figure 3), it obtains the elapsed time Ttimer measured by the timer 21 (step S204 of Figure 3). The timestamp assignment unit 23 takes the sum of the reset timestamp Treset stored in its own memory and the obtained elapsed time Ttimer as a new event occurrence timestamp Tevent, and saves this timestamp Tevent together with the event information VI in the storage unit 25 (step S205 of Figure 3). The timestamp assignment unit 23 repeatedly performs the processes in steps S200 to S205.

[0032] In the example shown in Figure 5, when the first event occurs at time t2, the event detection unit 24 sends the event detection flag VF and event information VI_1 to the timestamp assignment unit 23. The timestamp assignment unit 23 obtains the elapsed time Ttimer_1 from the timer 21 and adds Tevent_1 = Treset_i + Ttimer_1 as the timestamp of the first event occurrence, associating it with the event information VI_1, to the storage unit 25.

[0033] Similarly, when the second event occurs at time t3, the event detection unit 24 sends the event detection flag VF and event information VI_2 to the timestamp assignment unit 23. The timestamp assignment unit 23 obtains the elapsed time Ttimer_2 from the timer 21 and adds Tevent_2 = Treset_i + Ttimer_2 as the timestamp for the second event occurrence, associating it with the event information VI_2, to the storage unit 25.

[0034] When the (i+1)th offset value ΔT_(i+1) is obtained at time t4, the timestamp assignment unit 23 resets the elapsed time Ttimer to 0 and obtains the internal time Tinternal, setting this value as the internal time Toffset_(i+1) at the time the offset value was obtained. The timestamp assignment unit 23 sets Treset_(i+1) = Toffset_(i+1) + ΔT_(i+1) as the new reset timestamp.

[0035] When the third event occurs at time t5, the event detection unit 24 sends the event detection flag VF and event information VI_3 to the timestamp assignment unit 23. The timestamp assignment unit 23 obtains the elapsed time Ttimer_3 from the timer 21 and adds Tevent_3 = Treset_(i+1) + Ttimer_3 as the timestamp for the third event, associating it with the event information VI_3, to the storage unit 25.

[0036] As described above, in this embodiment, a correct timestamp can be obtained even if the progress of the internal clock 20 is changed. Therefore, the time interval calculation unit 26 can correctly calculate the difference between two timestamps, i.e., the event occurrence time interval. In addition, in this embodiment, since event information VI is stored together with the timestamp Tevent, the time interval calculation unit 26 can calculate the occurrence time interval of a specific event. For example, if the event is the arrival of an RTP packet of a specific flow, and the event information VI is a sequence number extracted from the header of the RTP packet, the reception interval of consecutive RTP packets with sequence numbers can be calculated to monitor fluctuations and reversals in the order of RTP packets.

[0037] [Second Embodiment] In the first embodiment, ntpd (Network Time Protocol daemon) is used as a method to achieve time synchronization between the time source 1 (NTP server) and the event monitoring device 2 (NTP client) (https: / / docs.ntpsec.org / latest / ntpd.html). By utilizing the ntpq-n command or ntpq-np command provided in ntpd, it is possible to easily obtain the offset value ΔT.

[0038] [Third Embodiment] Another method for achieving time synchronization between the time source 1 (NTP server) and the event monitoring device 2 (NTP client) in the first embodiment is Chrony (https: / / chrony-project.org / documentation.html). By utilizing the sourcestats command provided in Chrony, it is possible to easily obtain the offset value ΔT.

[0039] [Fourth Embodiment] In the first embodiment, if the frequency of events is high, the software cannot keep up with the timestamp assignment process. Therefore, in order to assign timestamps without missing any events even when the frequency of events is high, the event occurrence detection unit 24, timestamp assignment unit 23, timer 21, and storage unit 25 are implemented in hardware. Since time synchronization and offset value acquisition are not performed very frequently, the internal clock 20, time synchronization unit 22, and time interval calculation unit 26 are implemented in software.

[0040] Figure 6 shows the configuration of the event monitoring device 2a when the events subject to timestamping are high-frequency packet arrivals. The packet reception detection unit 24a, which receives packets from network 3, corresponds to the event occurrence detection unit 24 in the first embodiment. In this embodiment, the event detection flag VF corresponds to the packet reception flag. The event information VI corresponds to the packet information. The packet information includes the sequence number and 5-tuple information extracted from the packet header. The event occurrence timestamp Tevent indicates the time when the packet was received.

[0041] In this embodiment, the timestamp assignment unit 23, timer 21, packet reception detection unit 24a, and storage unit 25 are implemented using an FPGA (field-programmable gate array)-NIC (Network Interface Card) 201. The FPGA-NIC 201 is installed in a computer 200 that comprises an internal clock 20, a time synchronization unit 22, and a time interval calculation unit 26.

[0042] As described above, in this embodiment, by realizing the functional unit that transmits and receives information every time an event occurs by hardware, it becomes possible to assign a timestamp without omission even when the frequency of event occurrence is high.

[0043] A configuration example of a computer that realizes the event monitoring devices 2 and 2a described in the first to fourth embodiments is shown in FIG. 7. The computer includes a CPU 300, a storage device 301, and an interface device (I / F) 302. A network 3 or the like is connected to the I / F 302. In such a computer, a program for realizing the event monitoring method of the present invention is stored in the storage device 301. The CPU 300 executes the processes described in the first to fourth embodiments according to the program stored in the storage device 301. As described above, in the case of the first embodiment, the entire event monitoring device 2 is realized by a computer. On the other hand, in the case of the fourth embodiment, among the event monitoring device 2a, the internal clock 20, the time synchronization unit 22, and the time interval calculation unit 26 are realized by a computer.

[0044] Some or all of the above embodiments can also be described as follows in the appended claims, but are not limited thereto.

[0045] (Note 1) The event monitoring device of the present invention comprises an internal clock configured to measure time, a time synchronization unit configured to synchronize the internal time indicated by the internal clock with a reference time distributed from an external time source, a timer configured to measure elapsed time at the same rate as the reference time, an event occurrence detection unit configured to detect the occurrence of an event, a timestamp assignment unit configured to obtain two timestamps: a first timestamp to correct the discrepancy in the event occurrence time due to the internal time, and a second timestamp indicating the event occurrence time, and a storage unit configured to store the second timestamp. The timestamp assignment unit resets the elapsed time to 0 when it obtains an offset value indicating the discrepancy of the internal time with respect to the reference time, updates the sum of the offset value and the internal time at the time the offset value was obtained as a new value for the first timestamp, and when the event occurs, adds the sum of the first timestamp and the elapsed time to the storage unit as a new value for the second timestamp.

[0046] (Note 2) In the event monitoring device described in Note 1, the timestamp assigning unit adds and saves the second timestamp and event information in association with each other in the storage unit when the event occurs.

[0047] (Note 3) In the event monitoring device described in Note 1, the time synchronization unit performs time synchronization by raising or lowering the progress of the internal time to gradually bring it closer to the reference time.

[0048] (Supplementary Note 4) The event monitoring method of the present invention includes a first step of synchronizing the internal time indicated by an internal clock with a reference time distributed from an external time source, and when an offset value indicating the deviation of the internal time from the reference time is obtained, resetting a timer that measures an elapsed time at the same progress as the reference time, and updating the sum of the offset value and the internal time at the time of obtaining the offset value as a new value of a first timestamp; a third step of detecting the occurrence of an event; and a fourth step of additionally saving, when the event occurs, the sum of the first timestamp and the elapsed time as a new value of a second timestamp indicating the occurrence time of the event.

[0049] 1... Time source, 2, 2a... Event monitoring device, 3... Network, 20... Internal clock, 21... Timer, 22... Time synchronization unit, 23... Timestamp adding unit, 24... Event occurrence detection unit, 24a... Packet reception detection unit, 25... Storage unit, 26... Time interval calculation unit, 200... Computer, 201... FPGA-NIC.

Claims

1. An event monitoring device comprising: an internal clock configured to measure time; a time synchronization unit configured to synchronize the internal time indicated by the internal clock with a reference time distributed from an external time source; a timer configured to measure elapsed time at the same rate as the reference time; an event occurrence detection unit configured to detect the occurrence of an event; a timestamp assignment unit configured to obtain two timestamps: a first timestamp to correct the discrepancy in the event occurrence time due to the internal time, and a second timestamp indicating the event occurrence time; and a storage unit configured to store the second timestamp, wherein the timestamp assignment unit, upon obtaining an offset value indicating the discrepancy of the internal time with respect to the reference time, resets the elapsed time to 0, updates the sum of the offset value and the internal time at the time the offset value was obtained as a new value for the first timestamp, and, upon the occurrence of the event, adds the sum of the first timestamp and the elapsed time to the storage unit as a new value for the second timestamp.

2. An event monitoring device according to claim 1, wherein the timestamp assigning unit adds and stores the second timestamp and event information in association with each other in the storage unit when the event occurs.

3. An event monitoring device according to claim 1, characterized in that the time synchronization unit performs time synchronization by raising or lowering the progress of the internal time to gradually bring it closer to the reference time.

4. An event monitoring method characterized by comprising: a first step of synchronizing the internal time indicated by an internal clock with a reference time distributed from an external time source; a second step of resetting a timer that measures elapsed time at the same rate as the reference time when an offset value indicating the difference between the internal time and the reference time is obtained, and updating the sum of the offset value and the internal time at the time the offset value was obtained as a new value for the first timestamp; a third step of detecting the occurrence of an event; and a fourth step of adding and saving the sum of the first timestamp and the elapsed time as a new value for the second timestamp indicating the time the event occurred when the event occurs.

Images