Patent Application
20060225073
This application relates to and claims priority from Japanese Patent Application No. 2005-108076, filed on Apr. 4, 2005, the entire disclosure of which is incorporated herein by reference.
1. Field of the Invention
The present invention generally relates to a computer system, a log collection method and a computer program product, and in particular to the log collection technology of a computer system in which a plurality of virtual machines operate on a host computer.
2. Description of the Related Art
In recent years, the technique of storage consolidation which consolidates the storages distributed and disposed for each server, and connects such consolidated storages to a server group via a storage dedicated network such as a SAN (Storage Area Network) or the like is becoming widespread. A storage service provider that provides services relating to the configuration, operation and maintenance of storages, for instance, is providing services of leasing a single storage system to a plurality of customers as an operation mode of storage consolidation. Data centers that provide such storage services are seeking to consolidate storage management and reduce management costs by connecting the logical volumes obtained by logically dividing a large-capacity storage system to the servers of respective clients via the SAN or the like. Further, as a result of equipping an NAS (Network Attached Storage) function to the storage system of data centers, a file system for providing a file access service employing a file transfer protocol such as NFS (Network File System) or CIFS (Common Interface File System) to the respective clients can be created.
Japanese Patent Laid-Open Publication No. 2004-227127 discloses technology of virtually dividing the host OS (Operating System) operating on the computer of the data center to provide the storage service to the respective clients so as to operate a plurality of virtual machines on the same hardware resource, and assigning the respective virtual machines to the servers of the respective clients.
The uniform management of hardware is possible by introducing a virtual machine. A virtual machine is capable of the same operations as an ordinary computer. For example, the logs of failures and warnings generated with the virtual machine are stored in the virtual machine. Further, the time of the virtual machine progresses independently from the time of the host computer. Moreover, different networks are respectively used from the perspective of security for the network to be connected to the virtual machine and the network to be connected to the host computer.
In this kind of computer system, it is necessary to collect the logs of the virtual machine for the purpose of auditing whether any manipulation of the computer system or falsification of the data has occurred, or for the purpose of analyzing logs during failures or maintenance. For example, when a network failure occurs due to the network name resolution timeout of the domain name server, since it is not possible to analyze the failure with only logs of the host computer, logs of the virtual machine will become necessary. As a means for collecting logs of the virtual machine, conventionally, a server for collecting logs referred to as a log server was installed on the network, and the time in which the log arrived in the log server was recorded in the log as a time stamp.
Nevertheless, under the network environment where the virtual machine network and the host computer network are different, the virtual machine log and the host computer log cannot be transmitted to the log server via the network. When the two networks are connected, the independence of the network is lost, and security problems will arise.
Further, with a configuration where the logs are stored in the respective virtual machines and the logs of the virtual machines are abstracted from the host computer upon a failure or periodically, since there will be a time subtraction in the time of the host computer and the time of the virtual machines, a time subtraction is contained in the time stamp of the logs abstracted from the virtual machines. When this kind of time subtraction exists in the time stamp of the logs, even if the logs for analyzing failures are collected, such failure analysis will be difficult since the time series of the host computer and the respective virtual machines will not coincide.
In a computer system where a plurality of virtual machines is operating, the uniform management of logs is desired in addition to the uniform management of hardware.
The present invention was devised in view of the foregoing problems, and an object of the present invention is to provide a computer system, a log collection method, and a computer program product capable of abstracting logs in which the time subtraction of the virtual machines and the host computer were corrected.
In order to achieve the foregoing object, the computer system of the present invention is a computer system in which a plurality of virtual machines operate on a host computer; the host computer including: a time subtraction table for storing the time subtraction with the respective virtual machines; and a log collection unit for collecting the log of the respective virtual machines; wherein the log contains a time stanp which shows at least the log output time; and the log collection unit corrects the time stamp of the log collected from the respective virtual machines based on the time subtraction stored in the time subtraction table. According to the foregoing constitution, the logs of virtual machines operating in a time series that is different from the time series of the host computer can be collected upon integrating the time series of the virtual machines and the host computer.
The time subtraction table further stores the subtraction acquisition time showing the time when the time subtraction with the virtual machines was acquired; and the log collection unit may correct the time stamp based on the time subtraction in the subtraction acquisition time that is newer than the time of the time stamp among the subtraction acquisition times stored in the time subtraction table, yet which is the closest to the time of the time stamp. The time subtraction of the host computer and virtual machines is not necessarily fixed, and, for instance, this may fluctuate when the host computer and virtual machines respectively acquire the time information from the NTP server and synchronize the time, or when the time of the virtual machines is falsified by manipulation. As a result of correcting the time stamp based on the time subtraction in the subtraction acquisition time that is newer than the time of the time stamp among the subtraction acquisition times stored in the time subtraction table, yet which is the closest to the time of the time stamp, time stamp correction can be conducted with even higher precision.
The log collection unit may collectively output the logs of the corrected time stamps of the plurality of virtual machines. Thereby, since the logs of the respective virtual machines can be rearranged on the same time axis for analysis, this is preferable for analyzing system failures.
In addition to the time stamp, the log further contains a log message; and the log collection unit may contain a log of the pre-corrected time stamp output time in the log message.
The log collection unit may collect the log from the virtual machines by transmitting a log collection order to the virtual machines. As a result of the host computer abstracting the log via the virtual machines instead of directly abstracting the log from the virtual machines, the security function of the virtual machines can be improved.
The virtual machines may send a time change notification to the host computer each time the time of the virtual machine is changed. Further, the log collection unit may collect the time subtraction with the virtual machines upon receiving the time change notification. As a result, the host computer is able to retain the latest time subtraction with the virtual machines, and time stamp correction can be conducted with even higher precision.
The plurality of virtual machines and the host computer may be respectively connected to different networks. In comparison to the conventional method of collecting logs from a virtual machine via a network using a log server, the present invention is superior in security since there is no need to connect the networks of the virtual machines.
The log collection method of the present invention is a method of collecting logs of a computer system in which a plurality of virtual machines operate on a host computer, including the steps of the host computer acquiring the time subtraction with the virtual machines; the host computer collecting the logs of the virtual machines; and the host computer correcting the time stamp of the logs collected from the virtual machines based on the time subtraction.
The computer program product of the present invention is a product wherein a computer program for making a computer system, in which a plurality of virtual machines operate on a host computer, execute the log collection method is recorded on a recording medium. As the recording medium, for example, preferably employed are optical recording mediums (a recording medium capable of optically reading data such as a CD-RAM, CD-ROM, DVD-RAM, DVD-ROM, DVD-R, PD, MD, MO or the like), magnetic recording mediums (a recording medium capable of magnetically reading data such as a flexible disk, magnetic card, magnetic tape or the like), or a memory element (a semiconductor memory element such as a DRAM, a ferroelectric memory element such as an FRAM, or the like).
According to the present invention, the logs of the virtual machines operating in a time series that is different from the time series of the host computer can be collected upon integrating the time series of the virtual machines and the host computer. Further, even if the time of the virtual machines is wrongfully falsified, the logs of the virtual machines can be collected at a proper time on the host computer. Thereby, the uniform management of virtual machine logs is enabled.
Embodiments of the present invention are now explained with reference to the attached drawings.
The host computer 40 (1) acquires in advance the time subtraction of the respective virtual machines 50, 60 and the host computer 40, (2) and, upon collecting the logs from the respective virtual machines 50, 60, (3) corrects the log output time (time stamp) of the respective virtual machines 50, 60 by matching (rearranging on the same time axis) the log output time (time stamp) to the time series of the host computer 40 upon giving consideration to the time subtraction, (4) and collectively outputs the logs of the corrected time subtraction to the management computer (not shown) on the management network 21. According to the log collection system, since the time stamp of the respective virtual machines 50, 60 can be matched to the time series of the host computer 40, the log of the corrected time subtraction can be abstracted. Thus, this is preferable for the audit, failure analysis, maintenance and so on of the computer system 10.
Incidentally, there is no particular limitation to the usage of the computer system 10, and this may be used in general computer systems including an operational environment of a plurality of virtual machines 50, 60. For instance, this may be employed in various computer systems such as workstations, mainframe computers, network servers and personal computers.
In the present embodiment, an NAS file server for providing a file service via a network is exemplified taking the computer system 10 having an operational environment of operating a plurality of virtual machines on a host computer as the specific example.
Operating on the computer system 10 are a virtual machine 50 for providing a file service for Company A and a virtual machine 60 for providing a file service for Company B (c.f.,
The system administrator is able to access the computer system 10 by making input operations to the management computer 22 so as to conduct the audit, failure management, maintenance management and so on of the computer system 10. Clients of Company A may request data I/O (file access) by designating the file name from the client device 25 to the virtual machine 50 via the operation network 24. Similarly, clients of Company B can request a file access from the client device 28 to the virtual machine 60 via the operation network 27. When the operation networks 24, 27 are, for example, a LAN (Local Area Network), the communication protocol of TCP/IP (Transmission Control Protocol/Internet Protocol) is used for the file access request from the client devices 25, 28 to the virtual machines 50, 60.
Incidentally, as the disk drives 31, 32, 33, a stand-alone hard disk may be used, or a disk array device formed from a plurality of hard disks constituted in a RAID (Redundant Array of Independent Inexpensive Disks) may be employed. Further, a plurality of logical volumes may be formed in the disk drives 32, 33, and data for providing file services to Company A and Company B may be stored in these logical volumes. As the hard disk, for example, a fiber channel disk drive, ATA (Advanced Technology Attachment) disk drive, SCSI (Small Computer System Interface) disk drive and the like may be used.
The virtual machine storage unit 51 is located on the memory 12 assigned to the virtual machine 50. The time setting unit 52 acquires time information from the operation NTP server 26 and sets the time of the virtual machine 50. The time change of the virtual machine 50 is notified to the host computer 40 via the virtual adapter 56. The log output unit 53 creates a log upon receiving the log output order and log contents from the time setting unit 52 or other components, and outputs the log to the external storage unit 54. As the logs to be created by the log output unit 53, for instance, there are various logs such as a log showing that the time of the virtual machine 50 has been changed, a log showing that an application has been installed, a log showing that the password has been changed, a log showing that there is a system failure due to manipulation, a log showing that the system has been shut down due to network failure or other system failures, and so on.
The external storage unit 54 is a storage area functioning as the external storage unit of the virtual machine 50, and the disk drive 32 corresponds thereto in the present embodiment. The virtual CPU 55 is a virtual CPU assigned to the process of the virtual machine 50 based on the time division operation of the CPU 11. The virtual adapter 56 is a virtual adapter that connects the communication between the virtual machine 50 and host computer 40. When the virtual adapter 56 receives the log collection order from the host computer 40, it transmits the log abstracted from the external storage unit 54 to the host computer 40. In the foregoing explanation, the time setting unit 52, log output unit 53 and virtual adapter 56 show the functions to be realized by the virtual CPU 55 executing the processes.
Incidentally, for the sake of convenience of explanation, although only the virtual adapter 66 is shown as the functional configuration of the virtual machine 60, the functional configuration of the virtual machine 60 is the same as the functional configuration of the virtual machine 50.
The host computer 40 includes a network interface 13, a host computer storage unit 41, a time setting unit 42, a log output unit 43, a virtual machine log collection unit 44, an external storage unit 45, a virtual CPU 46 and a virtual adapter 47.
The host computer storage unit 41 is the storage area on the memory 12 assigned to the host computer 40. The time setting unit 42 acquires time information from the management NTP server 23, and sets the time of the host computer 40. The log output unit 43 creates a log upon receiving the log output order and log contents from the time setting unit 42 or other components, and outputs the log to the external storage unit 45. Further, the log output unit 43 is also able to transmit logs of the host computer 40 to the management computer 22 via the management network 21.
The virtual machine log collection unit 44 basically performs the following four processing steps:
The external storage unit 45 is the storage area that functions as the external storage device of the host computer 40, and the disk drive 31 corresponds thereto in the present example. The virtual CPU 46 is a virtual CPU assigned to the processes of the host computer 40 based on the time subtraction operation of the CPU 11. The virtual adapter 47 is a virtual adapter for connecting the communication between the host computer 40 and the virtual machines 50, 60. In the foregoing explanation, the time setting unit 42, log output unit 43, virtual machine log collection unit 44 and virtual adapter 47 show the functions realized by the virtual CPU 46 executing the processes.
The management computer 22 includes a management screen display unit 71 and a log collection processing unit 72. The management screen display unit 71 is used for providing a user interface between the management computer 22 and system administrator, and, for example, displays a screen for guiding the instructions of the log collection processing to the system administrator, or displaying the logs collected from the computer system 10. The log collection processing unit 72 transmits an order for collecting the logs of the virtual machines 50, 60 to the host computer 40 in response to the instructions of the system administrator.
Incidentally, for security reasons, although it is desirable for the host computer 40 to collect the logs via the virtual machines 50, 60 as described above as the means for collecting the logs of the virtual machines 50, 60, the host computer 40 may also be constituted to directly abstract the logs of the virtual machines 50, 60 since it is aware of the storage location of the logs of the virtual machines 50, 60 as a result of retaining the log table (
When the host computer 40 receives the log collection order from the management computer 22 (S22), it refers to the log table and determines which logs should be collected from the virtual machines 50, 60 (S23). Then, the host computer 40 requests the virtual machines 50, 60 to collect the logs. The virtual machines 50, 60 transmit the logs abstracted from the disk drives 32, 33 to the host computer 40. As a result of taking the foregoing procedures, the host computer 40 is able to collect the logs of the virtual machines 50, 60 (S24).
Next, the host computer 40 uses the time subtraction stored in the time subtraction table and corrects the time stamp of the virtual machines 50, 60 (S25), and stores the log of the corrected time stamp in the host computer 40 (S26). When the host computer 40 has not finished collecting the logs of the virtual machines 50, 60 (S27: NO), it repeats the steps of S23 to S26 once again. Meanwhile, when is has finished collecting the logs of the virtual machines 50, 60 (S27: YES), the host computer 40 transmits the logs collected from the virtual machines 50, 60 to the management computer 22 (S28). The logs collected from the plurality of virtual machines 50, 60, for example, may be rearranged in the time series on the host computer 40 and these logs may be summarized into a single log, and collectively transmitted to the management computer 22.
Incidentally, the time subtraction employed for the correction of the log output time does not necessarily have to be the time subtraction in the latest subtraction acquisition time. It is preferable to correct the log output time based on the time subtraction in the subtraction acquisition time that is newer than the log output time, yet closest to the log output time. Further, the log of the pre-corrected time stamp output time may be included in the log message.
Next, advantages of matching the log output time of the virtual machines 50, 60 to the time series of the host computer 40 are explained.
According to the present embodiment, logs of the virtual machines 50, 60 operating in a time series that is different from the time series of the host computer 40 can be integrated to the time series of the host computer 40 and then collectively collected. Further, even if the time of the virtual machines 50, 60 is wrongfully falsified, logs of the virtual machines 50, 60 can be collected at the correct time on the host computer 40. As a result, the uniform management of logs of the virtual machines 50, 60 is enabled. Further, in comparison to the conventional method of collecting logs from a virtual machine via a network using a log server, the present invention is superior in security since there is no need to network-connect the virtual machines. Further, the audit, failure analysis, maintenance and the like of the respective virtual machines 50, 60 on the host computer 40 can be conducted without having to depend on the time subtraction between the host computer 40 and the virtual machines 50, 60. This will also contribute to the reduction of management costs.
Incidentally, in the foregoing explanation, although an example was described where the host computer 40 and the virtual machines 50, 60 operate on the same hardware resource, the present invention may also be employed in cases where the respective hardware operates in a different time series in a system formed by consolidating different hardware, such as in a storage system formed from a disk array device and the maintenance terminal thereof. In the foregoing example, the maintenance terminal does not have to depend on the time series of the disk array device, and the log of the disk array device may be collected upon matching the time series of the maintenance terminals.
The present invention is not limited to the foregoing embodiments. Those skilled in the art may make various additions or modification within the scope of the present invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2005-108076 | Apr 2005 | JP | national |
