This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2015-006536, filed on Jan. 16, 2015, the entire contents of which are incorporated herein by reference.
The present invention relates to a log acquisition management program, a log acquisition management device, and a log acquisition management method.
A provider (also referred to hereinbelow as service provider) providing services to a user, for example, creates a business system for realizing the provision of services. The provider sometimes uses, for example, a PaaS (Platform as a Service) which is provided by a provider (also referred to hereinbelow as cloud provider) providing the cloud computing services.
The PaaS is a service mode which is different from an IaaS (Infrastructure as a Service), which provides hardware resources, such as physical machines (virtual machines), and provides a platform function (platform) such as middleware for operating the software. More specifically, the cloud provider provides an application interface (API) and a DBMS (Database Management System) to a PaaS contractant. The service provider using the PaaS creates a business system by using the platform provided from the cloud provider and provides services to the user.
Further, in the PaaS, each physical machine operating to provide the platform, for example, outputs a log to a predetermined storage unit (also referred to hereinbelow as “data storage”). By accessing the data storage to which the logs have been output, the service provider acquires the logs relating to the physical machine providing the platform. As a result, the service provider can monitor the physical machine providing the platform (see, for example, Patent Documents 1 and 2).
In such a PaaS, the cloud provider sometimes does not provide to the service provider the information relating to the physical machines which operates to provide the platform. In this case, the service provider is not able to determine whether the acquisition of logs can be performed for all of the physical machines for which log acquisition is needed. As a result, the service provider can cause the occurrence of a log acquisition failure.
According to an aspect of the embodiments, a non-transitory computer-readable storage medium storing therein a log acquisition management program for causing a computer to execute a process includes storing, in a first storage, identification information on first information processing device included in a plurality of information processing devices that are used for execution of a single application, in association with information indicating that a log has not been acquired, when executing first log acquisition processing and when the log has not been acquired from the first information processing device, the first log acquisition processing being a processing acquiring logs from the plurality of information processing devices and collecting the acquired logs in a second storage, and when executing second log acquisition processing, which is new log acquisition processing, after the first log acquisition processing has been executed, and when a log has been acquired from the first information processing device, acquiring also a log of a past period preceding a log acquisition target period of the second log acquisition processing from the first information processing device.
The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention.
[Configuration of Information Processing System]
The information processing system 100 depicted in
In the information processing system 100 depicted in
The monitoring device 1 is, for example, a physical machine and acquires logs of the physical machine 11A, etc., output to the storage unit 20. The monitoring device 1 also monitors the physical machine 11A, etc., on the basis of the logs acquired from the storage unit 20.
In the example depicted in
[Acquisition of Logs by Monitoring Device]
The acquisition of logs by the monitoring device 1 will be described hereinbelow.
The items of the logs depicted in
In the physical machines mentioned herein, a processing delay can occur due to the increase in processing load, or the like. In this case, the output of log from each physical machine to the storage unit 20 can be delayed. More specifically, in the example depicted in
Further, when the monitoring device 1 is not able to acquire the information relating to the physical machine 11B (information relating to the operation state of the physical machine 11B), the monitoring device 1 is not able to recognize the processing delay generated in the physical machine 11B. Therefore, even when a log output with a delay to the storage unit 20 is present, the monitoring device 1 does not perform the reacquisition of the log and the log acquisition failure can be occurred.
Further, depending on the contents of the contract between the cloud provider and service provider, in some cases, the monitoring device 1 is not able to delete the log output to the storage unit 20. In such a case, the monitoring device 1 needs to acquire logs from the storage unit 20 under a designated condition, but in order to prevent the same log from being acquired repeatedly, log acquisition in a wide range is not able to be performed. More specifically, for example, the monitoring device 1 is not able to acquire logs under the designated condition of “all of the logs having the TIME STAMP indicating a time preceding a certain time”. Therefore, the monitoring device 1 is not able to prevent a log acquisition failure caused by the spread of conditions when the logs are acquired.
Accordingly, in the present embodiment, when the monitoring device 1 does not acquire logs from the first physical machine (also referred to hereinbelow as “first information processing device”) included in the plurality of physical machines 11, the identification information on the first information processing device and information indicating that a log is not able to be acquired are stored in association with each other. When the monitoring device 1 thereafter acquires the log from the first information processing device, logs of the past periods (also referred to hereinbelow simply as “past logs”) are acquired from the first information processing device. As a result, the monitoring device 1 prevents the acquisition failure of the log to be acquired.
[Hardware Configuration of Monitoring Device]
The hardware configuration of the monitoring device 1 will be explained hereinbelow.
The storage medium 104 stores a program 110 (also referred to hereinbelow as “log acquisition management program”) for executing the processing (also referred to hereinbelow as “log acquisition management processing”) of managing the log acquisition in a program storage region (not depicted in the figure) in the storage medium 104. The CPU 101 loads the program 110 from the storage medium 104 into the memory 102 when the program 110 is to be executed, and performs the log acquisition management processing in cooperation with the program 110, as depicted in
[Functions of Monitoring Device]
The log acquisition unit 111 executes the log acquisition processing (also referred to hereinbelow as “first log acquisition processing”) of acquiring logs from a plurality of physical machines 11 which are used for executing a single application, and collect the acquired logs 132 in the information storage region 130. More specifically, the log acquisition unit 111 may access the storage unit 20, for example, at a regular timing, such as once each minute, and store the acquired logs 132 in the information storage region 130. A specific example in which the log acquisition unit 111 acquires the logs will be explained hereinbelow.
The log management unit 112 determines whether or not logs have been acquired from all of the physical machines included in the plurality of physical machines 11, for example, when the log acquisition unit 111 executes the first log acquisition processing. Further, for example, when the log has not been acquired from the first physical machine included in the physical machines 11, the log management unit 112 stores the identification information of the first physical machine and the information to the effect that the log has not been acquired in association with each other as part of the management information 131 in the information storage region 130. The log management unit 112 stores the management information 131 in the information storage region (also referred to hereinbelow as “first storage section”) which is included in the information storage region 130. The log management unit 112 may store the management information 131 in the information storage region which is different from the information storage region 130.
Then, the log acquisition unit 111, for example, executes the second log acquisition processing which is new log acquisition processing after the first log acquisition processing. When the log (the past log) is acquired from the first physical machine, from which the log has not been acquired in the first log acquisition processing, when the second log acquisition processing is executed, the past log acquisition unit 113, for example, stores the acquired past logs in the information storage region 130. In this case, the past log acquisition unit 113, for example, acquires logs of a period preceding the log acquisition target period of the second log acquisition processing.
The first embodiment is explained hereinbelow.
As depicted in the flowchart on the left side in
When the log output by the first physical machine included in the plurality of physical machines 11 has not been acquired (YES in S3), the monitoring device 1 stores the identification information of the first physical machine in association with the information to the effect that the log has not been acquired in the first storage section (S4). Meanwhile, where the logs output by all of the physical machines included in the plurality of physical machines 11 have been acquired (NO in S3), the monitoring device 1 does not store information such as identification information.
Thus, in the first log acquisition processing, when the log output from the first physical machine from which the logs have been continuously acquired in the past, was not able to be acquired, the monitoring device 1 determines that a processing delay might occur in the first physical machine. In order to prevent the log acquisition failure, the monitoring device 1 stores information needed for performing the acquisition of the logs of the first physical machine retrospectively, as will be described hereinbelow.
Then, the monitoring device 1 collects the logs acquired in S2 in the information storage region 130 (S5).
Then the monitoring device 1 waits, for example, until the execution timing of the second log acquisition processing according to the flowchart on the right side in
Then, the monitoring device 1 determines whether or not a log has been acquired from the first physical machine from which the log was not able to be acquired in S2 (S13). When the log has been acquired from the first physical machine (YES in S13), the monitoring device 1 acquires the logs of a period preceding the log acquisition target period of the second log acquisition processing from the first physical machine (S14). Meanwhile, when the log has not been acquired from the first physical machine (NO in S13), the monitoring device 1 does not acquire the past logs.
Thus, when the log has been acquired from the first physical machine from which the log was not able to be acquired in S2, the monitoring device 1 determines that a factor (for example, an increase in processing load) delaying the output of logs in the first physical machine has been eliminated. Accordingly, the monitoring device 1 in the present embodiment starts the acquisition with respect to the logs of the past period (a period preceding the period in which the log has not been acquired in S2) in response to the acquisition of the logs from the first physical machine. As a result, the monitoring device 1 can retrospectively acquire the logs that were not able to be acquired in the past and can prevent the occurrence of a log acquisition failure.
Then, the monitoring device 1 collects the logs acquired in S12 and the logs acquired in S14 in the information storage region 130 (S15).
Thus, according to the first embodiment, where a log has not been acquired from the first physical machine when the first log acquisition processing was executed, the first monitoring device 1 stores the identification information on the first physical machine in association with the information to the effect that the log has not been acquired. Where the log has been acquired from the first physical machine when the second log acquisition processing, which was new log acquisition processing, was executed, the monitoring device 1 acquires also the logs of the period preceding the log acquisition target period of the second log acquisition processing from the first physical machine. As a result, the monitoring device 1 can prevent the occurrence of a log acquisition failure with respect to the logs that have been output by the plurality of physical machines 11.
The first embodiment will be described hereinbelow in greater detail.
Initially, the log acquisition unit 111 of the monitoring device 1 waits until the execution timing of log acquisition processing (NO in S21). When the execution timing of the log acquisition processing is thereafter reached (YES in S21), the log acquisition unit 111 refers to the acquired logs 132 stored in the information storage region 130 (S22).
Then, the log acquisition unit 111 specifies the most recent TIME STAMP among the TIME STAMPS of the acquired logs 132 for each physical machine 11 for which the NON-ACQUISITION FLAG included in the management information 131 is “0” (S22). A specific example of the logs and management information 131 is explained hereinbelow.
In order to manage the logs acquired from the storage unit 20, the monitoring device 1 needs to identify each log. Therefore, for example, the LOG CONTENTS depicted in
More specifically, when the contents of the logs output by the physical machines 11 are themselves unique, the LOG CONTENTS of each log may set the contents of the log itself. Meanwhile, when the contents of the logs output by the physical machines 11 are themselves not unique, the LOG CONTENTS of each log may be set a contents including the contents of the log itself, the machine ID of the physical machine 11 that has output the log, and time (time stamp) at which the log has been output from the physical machine 11.
The management information 131 depicted in
More specifically, among the logs depicted in
Further, among the logs depicted in
Further, among the logs depicted in
Thus, the management information 131 depicted in
Returning to
More specifically, in the example of the management information 131 depicted in
When the log acquired from the storage unit 20 by the log acquisition processing is the log which has already been acquired (the log that has been stored as the acquired log 132 in the information storage region 130), the log acquisition unit 111 determines that this log is a duplicate log and destroys this log, without storing the log in the information storage region 130.
Further,
Returning to
More specifically, the logs depicted in
Then, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines whether or not a physical machine for which a log was not able to be acquired is present among the physical machines for which the NON-ACQUISITION FLAG in the management information 131 is “0” (S27).
More specifically, in the management information 131 depicted in
Then, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines, as depicted in
More specifically, in the management information 131 depicted in
Then, the log management unit 112 sets the TIME STAMP indicating the most recent time, among the times indicated by the TIME STAMPS of the logs acquired in S23, in the ACQUISITION END TIME for each physical machine (S35).
More specifically, there are two TIME STAMPS of the logs for which the MACHINE ID is “11A”, among the logs depicted in
Then, the log management unit 112 determines, as depicted in
More specifically, the RE-ACQUISITION EXECUTION TIME corresponding to all of the MACHINE IDs in the management information 131 depicted in
The log acquisition unit 111 then waits again until the log acquisition timing (S21).
Thus, when the logs were able to be acquired from all of the physical machines for which the logs have been continuously acquired, the log management unit 112 performs only the update of information set in the ACQUISITION END TIME and LOG CONTENTS without updating the information set in the NON-ACQUISITION FLAG, RE-ACQUISITION EXECUTION TIME, and RE-ACQUISITION START TIME.
[Specific Example of the Case in which Physical Machine for which Log was not Able to be Acquired is Present]
A specific example of the case in which a physical machine for which the log was not able to be acquired is present among the physical machines for which the NON-ACQUISITION FLAG in the management information 131 is “0” will be described hereinbelow.
Initially, the log acquisition unit 111, for example, waits until the execution timing of the log acquisition processing in the same manner as described hereinabove (NO in S21). Then, when the execution timing of the log acquisition processing is reached (YES in S21), the log acquisition unit 111, for example, refers to the management information 131 in the same manner as described hereinabove. Explained hereinbelow is the case in which the log acquisition unit 111 refers to the management information 131 depicted in
The log acquisition unit 111, for example, specifies the most recent TIME STAMP among the TIME STAMPS of the logs, which have been output in the past by the physical machines 11, for each physical machine 11 for which the NON-ACQUISITION FLAG included in the management information 131 is “0” (S22). More specifically, in the management information 131 depicted in
Then, the log acquisition unit 111 acquires, for example, the logs having the TIME STAMP corresponding to the time after the oldest time, among the times indicated by the most recent TIME STAMP specified in S22 (S23). Thus, in the management information 131 depicted in
As a result, the log acquisition unit 111 acquires, for example, the log for which the MACHINE ID is “11C”, the TIME STAMP is “2014/07/12 00:01:46”, and the LOG CONTENTS are “Message 3-1”, as depicted in
Then, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines that a log output from the physical machine 11 for which information is not present in the management information 131 is not present (NO in S24).
Then, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines whether or not a physical machine for which a log was able to be acquired is present among the physical machines for which the non-acquisition flag of the management information 131 is “0” (S27). In this case, in the logs depicted in
For example, the log management unit 112 then updates to “1” the non-acquisition flag corresponding to the physical machine for which the log was not able to be acquired (S28). More specifically, the log management unit 112 updates the NON-ACQUISITION FLAG for which the MACHINE ID is “11B” to “1”, as depicted in
Then, for example, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines that the log of the physical machine for which the non-acquisition flag of the management information 131 is “1” has not been acquired (NO in S31).
Then, the log management unit 112 sets the TIME STAMP indicating the most recent time, among the times indicated by the TIME STAMPS of the logs acquired in S23, in the ACQUISITION END TIME for each physical machine (S35).
More specifically, by referring to the logs depicted in
In this case, since the logs depicted in
Then, the log management unit 112, for example, refers to the management information 131 depicted in
[Specific Example of the Case in which Log is not Able to be Acquired from Physical Machine for which Non-Acquisition Flag is “1”]
A specific example of the case in which a physical machine for which a log was not able to be acquired is present among the physical machines for which the NON-ACQUISITION FLAG in the management information 131 is “1” will be described hereinbelow.
Initially, the log acquisition unit 111, for example, waits until the execution timing of log acquisition processing in the same manner as described hereinabove (NO in S21). Then, after the execution timing of the first log acquisition processing has been reached (YES in S21), the log acquisition unit 111, for example, refers to the management information 131 in the same manner as described hereinabove. In the case explained herein, the log acquisition unit 111 refers to the management information 131 depicted in
Then, the log acquisition unit 111 specifies, for example, the most recent TIME STAMP, among the TIME STAMPS of the logs output by each physical machine 11 in the past, for each physical machine 11 for which the non-acquisition flag included in the management information 131 is “0” (S22). More specifically, in the management information 131 depicted in
Then, the log acquisition unit 111, for example, acquires a log having the TIME STAMP corresponding to a time after the oldest time, among the times indicated by the most recent TIME STAMPS specified in S22 (S23). More specifically, in the management information 131 depicted in
Thus, where a physical machine with the NON-ACQUISITION FLAG of “1” is present, the time difference between the time specified in the ACQUISITION END INFORMATION corresponding to the information in which the NON-ACQUISITION FLAG is “1” and the time specified in the ACQUISITION END INFORMATION corresponding to the information in which the NON-ACQUISITION FLAG is “0” increases. More specifically, in the example indicating the management information in
Accordingly in S22 the log acquisition unit 111 specifies the TIME STAMPS without considering the ACQUISITION END INFORMATION corresponding to the information in which the non-acquisition flag is “1”. Further, in S23, the log acquisition unit 111 performs log acquisition on the basis of the specified TIME STAMPS, without considering the ACQUISITION END INFORMATION corresponding to the information in which the non-acquisition flag is “1”. As a result, the log acquisition unit 111 can reduce the number of duplicate logs that will be acquired and can prevent the increase in the processing load of the monitoring device 1.
More specifically, the log acquisition unit 111, for example, acquires a log with the MACHINE ID of “11C”, the TIME STAMP of “2014/07/12 00:02:59”, and the LOG CONTENTS of “Message 4-1”, as depicted in
Then, for example, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines that a log output from the physical machines 11 for which information is not present in the management information 131 is not present (NO in S24).
Further, for example, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines whether or not a physical machine for which the log was not able to be acquired is present among the physical machines for which the non-acquisition flag in the management information 131 is “0” (S27). More specifically, in the management information 131 depicted in
Further, for example, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines that the log of the physical machine for which the non-acquisition flag in the management information 131 is “1” has not been acquired (NO in S31).
Further, the log management unit 112 sets the time stamp indicating the most recent time, among the times indicated by the time stamps of the logs acquired in S23, to the acquisition end time for each physical machine (S35).
More specifically, the log management unit 112 refers to the logs depicted in
In this case, since the logs depicted in
Then, the log management unit 112, for example, refers to the management information 131 depicted in
[Specific Example of the Case in which Log was Able to be Acquired from Physical Machine for which Non-Acquisition Flag is “1”]
A specific example of the case in which a physical machine for which a log was able to be acquired is present among the physical machines for which the non-acquisition flag of the management information 131 is “1” will be described hereinbelow.
Initially, the log acquisition unit 111, for example, waits until the execution timing of log acquisition processing in the same manner as described hereinabove (NO in S21). Then, after the execution timing of the first log acquisition processing has been reached (YES in S21), the log acquisition unit 111, for example, refers to the management information 131 in the same manner as described hereinabove. In the case explained herein, the log acquisition unit 111 refers to the management information 131 depicted in
Then, the log acquisition unit 111 specifies, for example, the most recent TIME STAMP, among the TIME STAMPS of the logs output by each physical machine 11 in the past, for each physical machine 11 for which the non-acquisition flag included in the management information 131 is “0” (S22). More specifically, in the management information 131 depicted in
Then, the log acquisition unit 111, for example, acquires a log having the TIME STAMP corresponding to a time after the oldest time, among the times indicated by the most recent TIME STAMPS specified in S22 (S23). More specifically, in the management information 131 depicted in
More specifically, the log acquisition unit 111, for example, acquires a log with the MACHINE ID of “11C”, the TIME STAMP of “2014/07/12 00:03:31”, and the LOG CONTENTS of “Message 5-1”, as depicted in
Then, for example, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines that a log output from the physical machines 11 for which information is not present in the management information 131 is not present (NO in S24).
Further, for example, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines whether or not a physical machine for which the log was not able to be acquired is present among the physical machines for which the non-acquisition flag in the management information 131 is “0” (S27). More specifically, in the management information 131 depicted in
Further, for example, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines whether or not the log of a physical machine for which the NON-ACQUISITION FLAG in the management information 131 is “1” has been acquired (S31). More specifically, in the management information 131 depicted in
Then, the log management unit 112 sets the information, which has been set in the ACQUISITION END TIME in the management information 131, to RE-ACQUISITION START TIME (S32). More specifically, the log management unit 112, for example, sets “2014/07/12 00:01:10”, which is the information which has been set in the ACQUISITION END TIME, as the RE-ACQUISITION START TIME corresponding to the information in which the NON-ACQUISITION FLAG is “1”, as depicted in
Thus, the information which has been set in the ACQUISITION END TIME corresponding to the information in which the NON-ACQUISITION FLAG is “1” is needed for specifying the logs which have already been acquired by the log acquisition unit 111 when the past log acquisition unit 113 acquires the past logs, as will be described hereinbelow. However, since the log output by the physical machine for which the NON-ACQUISITION FLAG is “1” has been acquired in S23, the log management unit 112 needs to set the TIME STAMP of the acquired log as the ACQUISITION END TIME corresponding to the information in which the NON-ACQUISITION FLAG is “1”. Accordingly, the log management unit 112 sets the time stamp, which has been set in the ACQUISITION END TIME, as the RE-ACQUISITION START TIME before the information which has been set in the ACQUISITION END TIME corresponding to the information in which the NON-ACQUISITION FLAG is “1” is updated. As a result, the log management unit 112 can maintain the information which has been set as the ACQUISITION END TIME corresponding to the information in which the NON-ACQUISITION FLAG is “1”.
Then, the log management unit 112 sets the time indicated by the most recent TIME STAMP, among the TIME STAMPS of the logs output by the physical machines for which the NON-ACQUISITION FLAG is “1”, those logs being acquired by the log acquisition unit 111 in S23, as the RE-ACQUISITION EXECUTION TIME in the management information 131 (S33). Thus, the log management unit 112 sets the TIME STAMP of the log which serves as a reference for past log acquisition when the past log acquisition unit 113 acquires the past logs, as will be described hereinbelow, as the RE-ACQUISITION EXECUTION TIME. As a result, the log management unit 112 can manage the interval of time from the time which has been set in the RE-ACQUISITION START TIME to the time which has been set in the RE-ACQUISITION EXECUTION TIME as the time in which the acquisition of past logs needs to be performed.
More specifically, as depicted in
The log management unit 112 then updates to “0” the NON-ACQUISITION FLAG of the physical machine for which the log has been acquired, among the physical machines for which the non-acquisition flag is “1” (S34). More specifically, as depicted in
Then, the log management unit 112 sets the time indicated by the most recent TIME STAMP, among the times indicated by the TIME STAMPS of the logs acquired in S23, as the ACQUISITION END TIME for each physical machine (S35).
More specifically, by referring to the logs depicted in
Then, the log management unit 112, refers to the management information 131 depicted in
More specifically, in the management information 131 depicted in
Then, the past log acquisition unit 113, for example, acquires logs in a period up to a unit time before the time which has been set in the RE-ACQUISITION EXECUTION TIME, for each physical machine for which the RE-ACQUISITION EXECUTION TIME is not blank (S42). The unit time may be, for example, the time (for example, 1 min) equal to the time interval in which the log acquisition unit 111 executes the log acquisition processing. Thus, the past log acquisition unit 113, acquires in a stepwise manner the logs within a period going back by a unit time, for example, each time the log acquisition unit 111 performs the acquisition of logs from the storage unit 20. As a result, when a large number of the past logs which are to be acquired are present, the past log acquisition unit 113 can prevent the occurrence of a processing delay which accompanies the increase in the processing load in the monitoring device 1. In the explanation hereinbelow, the unit time is 1 min.
More specifically, the past log acquisition unit 113 calculates a time of 0 h, 3 min, 5 sec on Jul. 12, 2014, which is 1 min before the time which has been set in the RE-ACQUISITION EXECUTION TIME in the management information 131 depicted in
When the time which is 1 min before the time which has been set in the RE-ACQUISITION EXECUTION TIME is before the time (0 h, 1 min, 10 sec on Jul. 12, 2014 in the example depicted in
Then, the past log acquisition unit 113, for example, determines whether or not a physical machine for which log acquisition has been performed going back until the RE-ACQUISITION START TIME in the management information 131 is present (S43). More specifically, in the example of the management information 131 depicted in
Then, the past log acquisition unit 113, for example, determines whether or not a physical machine for which past logs were not able to be acquired is present among the physical machines for which the RE-ACQUISITION START TIME in the management information 131 is blank (S45). More specifically, in the example for the management information 131 depicted in
Then, the log management unit 112 resets, as the RE-ACQUISITION EXECUTION TIME, the time which is by a unit time before the time which has been set in the RE-ACQUISITION EXECUTION TIME, with respect to the physical machines for which information has been set in the RE-ACQUISITION EXECUTION TIME of the management information 131 (S48). More specifically, the log management unit 112 resets “2014/07/12 00:03:05”, which is 1 min before the time which has been set in the RE-ACQUISITION EXECUTION TIME, as the RE-ACQUISITION EXECUTION TIME, as depicted in
Then, the log acquisition unit 111 waits again until the log acquisition timing (S21).
[Specific Example of Case in which Acquisition of Past Logs is Performed]
A specific example of the case in which the acquisition of past logs is performed will be explained hereinbelow with respect to the example of the management information 131 depicted in
When the log acquisition unit 111 performs the next log acquisition processing in the example illustrated by the management information 131 depicted in
More specifically, in the example depicted in
Then, the past log acquisition unit 113 performs the acquisition of past logs on the basis of the information which has been set in the RE-ACQUISITION EXECUTION TIME in the management information 131 (S42). More specifically, the past log acquisition unit 113 calculates 0 h, 2 min, 5 sec on Jul. 12, 2014, which is 1 min before “2014/07/12 00:03:05” which is the information that has been set in the RE-ACQUISITION EXECUTION TIME in
Then, when the log acquisition unit 111 executes the next log acquisition processing in the example represented by the management information 131 depicted in
More specifically, in the example depicted in
Then, the past log acquisition unit 113 performs the acquisition of past logs on the basis of information which has been set in the RE-ACQUISITION EXECUTION TIME in the management information 131 (S42). More specifically, the past log acquisition unit 113 calculates 0 h, 1 min, 5 sec on Jul. 12, 2014, which is the time 1 min before the time of “2014/07/12 00:02:05” which has been set in the RE-ACQUISITION EXECUTION TIME in the management information 131 depicted in
The time of 0 h, 1 min, 5 sec on Jul. 12, 2014, which is the time calculated by the past log acquisition unit 113, is before the time of 0 h, 1 min, 10 sec on Jul. 12, 2014, which has been set in the RE-ACQUISITION START TIME in the management information 131 depicted in
Then, the past log acquisition unit 113, for example, determines whether or not a physical machine for which log acquisition has been performed by going back to the RE-ACQUISITION START TIME in the management information 131 is present (S43). More specifically, in the example depicted in
Then, the past log acquisition unit 113 deletes the information which has been set in the RE-ACQUISITION EXECUTION TIME and RE-ACQUISITION START TIME corresponding to the physical machine for which the acquisition of past logs has been performed until the RE-ACQUISITION START TIME in the management information 131 (S44). More specifically, as depicted in
[Specific Example of Case in which Logs have been Acquired from Physical Machine for which Information is not Present in Management Information]
A specific example of the case in which logs have been acquired from a physical machine for which information is not present in the management information 131 will be explained hereinbelow.
Initially, the log acquisition unit 111 waits, for example, until the execution timing of log acquisition processing in the same manner as described hereinbelow (NO in S21). When the execution timing of the log acquisition processing is thereafter reached (YES in S21), the log acquisition unit 111, for example, refers to the management information 131 in the same manner as described hereinbelow. In the case explained herein, the log acquisition unit 111 refers to the management information 131 depicted in
Then, the log acquisition unit 111 specifies the most recent TIME STAMP from among the TIME STAMPS of the logs that have been output in the past by the physical machines 11, for each physical machine 11 for which the non-acquisition flag included in the management information 131 is “0” (S22). More specifically, in the management information 131 depicted in
Then, the log acquisition unit 111, for example, acquires the log having the TIME STAMP corresponding to the time after the oldest time, among the times indicated by the most recent TIME STAMPS specified in S22 (S23). More specifically, in the management information 131 depicted in
More specifically, for example, as depicted in
Then, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines whether or not the log output from the physical machine 11 for which information is not present in the management information 131 is present (S24). More specifically, the logs depicted in
In this case, the log management unit 112, for example, adds information on the new physical machine to the management information 131 (S25). More specifically, as depicted in
Then, the log management unit 112, for example, sets the most recent TIME STAMP, among the TIME STAMPS of the logs output by the new physical machine, as the RE-ACQUISITION EXECUTION TIME in the management information 131 (S26). More specifically, the TIME STAMPS of the logs with the MACHINE ID of “11D”, which relates to the new physical machine, among the logs depicted in
Then, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines whether or not a physical machine for which a log was not able to be acquired is present among the physical machines for which the non-acquisition flag in the management information 131 is “0” (S27). More specifically, in the management information 131 depicted in
Then, for example, by using the results of log acquisition from the storage unit 20 in S23, the log management unit 112 determines that the log of a physical machine for which the non-acquisition flag in the management information 131 is “1” has not been acquired (NO in S31).
Then, the log management unit 112 sets the time stamp indicating the most recent time, among the times indicated by the time stamps of the logs acquired in S23, to the acquisition end time for each physical machine (S35).
More specifically, the log management unit 112 refers to the logs depicted in
Then, the log management unit 112, for example, refers to the management information 131 depicted in
More specifically, in the management information 131 depicted in
Then, the past log acquisition unit 113, for example, acquires logs in a period up to a unit time (for example, 1 min) before the time which has been set in the RE-ACQUISITION EXECUTION TIME, for each physical machine for which the RE-ACQUISITION EXECUTION TIME is not blank, in the same manner as described hereinabove (S42). Thus, when a log output by the new physical machine has been acquired in S23, the past log acquisition unit 113 acquires the past logs output by the new physical machine.
More specifically, the past log acquisition unit 113 calculates 0 h, 6 min, 8 sec on Jul. 12, 2014, which is 1 min before “2014/07/12 00:07:08” which has been set in the RE-ACQUISITION EXECUTION TIME in the management information 131 depicted in
In this case, when the RE-ACQUISITION START TIME is blank, the past log acquisition unit 113 is not able to determine a range in which the past logs need to be acquired, by contrast with the case (the case described with reference to
Then, the past log acquisition unit 113, for example, determines whether or not a physical machine is present for which log acquisition has been performed by going back to the RE-ACQUISITION START TIME in the management information 131 (S43). More specifically, in the management information 131 depicted in
Then, the past log acquisition unit 113, for example, determines whether or not a physical machine for which past logs were not able to be acquired is present among the physical machines for which the RE-ACQUISITION START TIME in the management information 131 is blank (S45). More specifically, in the management information 131 depicted in
Then, the log management unit 112 sets, as the RE-ACQUISITION EXECUTION TIME, the time which is by a unit time before the time which has been set in the RE-ACQUISITION EXECUTION TIME, with respect to the physical machines for which information has been set in the RE-ACQUISITION EXECUTION TIME of the management information 131 (S48). More specifically, as depicted in
[Specific Example of Case in which Acquisition of Past Logs is Performed]
A specific example of the case in which the acquisition of past logs is performed will be explained hereinbelow with respect to the example of the management information 131 depicted in
When the log acquisition unit 111 performs the next log acquisition processing in the example illustrated by the management information 131 depicted in
More specifically, in the example depicted in
Then, the past log acquisition unit 113 performs the acquisition of past logs on the basis of the information which has been set in the RE-ACQUISITION EXECUTION TIME in the management information 131 (S42). More specifically, the past log acquisition unit 113 calculates 0 h, 5 min, 8 sec on Jul. 12, 2014, which is 1 min before “2014/07/12 00:06:08” which has been set in the RE-ACQUISITION EXECUTION TIME in
Then, the past log acquisition unit 113, for example, determines whether or not a physical machine for which past logs were not able to be acquired is present among the physical machines for which the RE-ACQUISITION START TIME in the management information 131 is blank (S45). More specifically, in the example depicted in
In this case, the past log acquisition unit 113, for example, acquires all of the logs having the TIME STAMP indicating a time before the time which has been set in the RE-ACQUISITION EXECUTION TIME in the management information 131, among the logs output by the physical machine for which the RE-ACQUISITION START TIME in the management information 131 is blank (S46). More specifically, in the example depicted in
Thus, when past logs were not able to be acquired in S42, it can be predicted that the number of past logs having the TIME STAMP indicating a time before the time at which the acquisition of past logs has been performed in S42 is small. Therefore, in this case, the past log acquisition unit 113 acquires, at a time, the past logs preceding the time of acquisition in S42.
Then, the past log acquisition unit 113 deletes the information which has been set in the RE-ACQUISITION EXECUTION TIME and RE-ACQUISITION START TIME corresponding to the physical machine for which the acquisition of past logs has been performed until the RE-ACQUISITION START TIME in the management information 131 (S47). More specifically, the log management unit 112 deletes the information which has been set in the RE-ACQUISITION EXECUTION TIME and RE-ACQUISITION START TIME corresponding to the information in which the MACHINE ID, for which the past log acquisition unit 113 has performed the acquisition of past logs, is “11D”, as depicted in
Thus, according to the first embodiment, when a log has not been acquired from the first physical machine during the execution of the first log acquisition processing, the monitoring device 1 stores the identification information on the first physical machine and the information to the effect that the log has not been acquired in association with each other in the first storage section. When a log is acquired from the first physical machine during the execution of the second log acquisition processing, which is new log acquisition processing, the monitoring device 1 also acquires a log of a period preceding the log acquisition target period of the second log acquisition processing from the first machine. As a result, the monitoring device 1 can prevent the occurrence of a log acquisition failure with respect to logs output from a plurality of physical machines.
All examples and conditional language provided herein are intended for the pedagogical purposes of aiding the reader in understanding the invention and the concepts contributed by the inventor to further the art, and are not to be construed as limitations to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although one or more embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.
Number | Date | Country | Kind |
---|---|---|---|
2015-006536 | Jan 2015 | JP | national |