JPH02247745A - Logging processing system - Google Patents

Abstract

PURPOSE:To prevent status information corresponding to an event in a previously determined range from being unrequiredly overlapped and logged in a prescribed period by providing a logging processor with a suppressing object table and an overlap checking table. CONSTITUTION:When a certain even is generated in a communication equipment 1, the logging processor 2 starts processing for logging status information on a corresponding point in the equipment 1. At that time, the processor 2 checks the contents of the suppressing object table 3 and inspects whether the event is specified by a suppressed logsort number or not. When the event is specified, the contents of a recording area 5 between pointers P1 and P2 in the overlap checking table 4 are checked, and when the event is generated within a clear time and corresponds to 'information specifying an object to be logged' in the area 5, the status information corresponding to the objective event is canceled without being logged. When the event belongs to suppressed object information and is not registered in the table 4, the event is registered at that point of time. Consequently, the status information is prevented from being overlapped and logged by an unrequired format.

Description

DETAILED DESCRIPTION OF THE INVENTION [Summary] The present invention relates to a logging processing method for logging status information in a monitored device.

The purpose of this is to prevent state information corresponding to events within a predetermined range from being undesirably duplicated and logged within a predetermined period.

A suppression target table is created in which events within the predetermined range are described.

The configuration includes a duplicate check table in which information specifying at least an event within the predetermined period is registered.

[Industrial application field]

The present invention relates to a logging processing method for logging status information in a monitored device.

In response to the occurrence of an event in a monitored device, status information at that point in time is logged, but there is a limit to the log storage area, and efficient storage is desired.

[Conventional technology]

Conventionally, there is a method of logging status information every time an event occurs in a monitored device.

In this method, because there are things that occur multiple times due to the same cause, or things that occur repeatedly after - times, the log storage area is occupied by the status information, and more important information Log information was sometimes lost.

[Problem to be solved by the invention]

In order to solve this problem, measures such as narrowing down the opportunities for performing the above-mentioned logging have been considered, but these are not sufficient.

In order to solve the above-mentioned problems, the present invention aims to prevent state information corresponding to events within a predetermined range from being undesirably duplicated in logging within a predetermined period.

[Means to solve the problem]

FIG. 1 shows a basic configuration diagram of the present invention. In the figure, reference numeral 1 is a monitoring target device and represents a communication facility, 2 is a logging processing device, 3 is a suppression target table, 4 is a duplication check table, and 5 is a recording area.

The logging processing device 2 logs status information within the communication equipment 1 in response to the occurrence of an event in the communication equipment 1 .

Suppression target table 3 describes "suppression target events" that do not require logging of status information at every point in time when the event occurs, among events that are subject to logging. In the suppression target table 3,
"Suppression target log type number" representing the suppression target event,
A "check target item" that is a target for determining duplication among items belonging to the number is stored in correspondence.

Further, the duplication check table 4 includes a header portion and a recording area 5. The header part contains a check start pointer (PI) J that indicates the check start point in the recording area 5, and a next storage pointer (P2) J that indicates the next storage position when storing the secondary storage. has been done.

In addition, the recording area 5 contains information that specifies the log target (L
OG-A, etc.) and clear time (hh, am, ss shown)
are stored in pairs. The information that specifies the log target may be the logged status information itself, or may be a "log type number" that specifies the logged status information.

However, in the latter case, it is necessary to write "link information" indicating the location where the logged state information is stored together with the "log type number". Further, the above-mentioned clear time is a time obtained by adding a predetermined period (a period for preventing duplicate registration) to the time when logging was performed.

[Effect]

When an event occurs in the communication equipment 1, the logging processing device 2 enters a process of logging the status information of the communication equipment 1 at the relevant time. At this time.

The logging processing device 2 examines the contents of the suppression target table 3 to determine whether the event in question is specified by the suppression target log type number. If the event is not specified by the log type number to be suppressed, the state information corresponding to the event is logged as in the past.

However, if the log is specified by the log type number to be suppressed, the following processing is performed. That is, the content of the recording area 5 between pointer P1 and pointer P2 in the 1-duplication check table 4 is checked, and if the occurrence of the event is within the above-mentioned clearing time and the event is "log target" in the recording area 5. (If the LOG type stone is defeated and the suppression target table 3
(If the contents of the check target items specified in both match), the status information corresponding to the event is discarded without logging. If the event belongs to the suppression target event and has not been registered in the duplication check table 4, it will be registered at that point and the above predetermined period (
Activate a clear timer with a set period (to prevent duplicate registration).

〔Example〕

FIG. 2 is a diagram for explaining a processing example in the case of the present invention. Time 0 flows from the top to the bottom of the diagram.

In the figure, rLO belonging to the suppression target event at time ■
Assume that an event for logging G-AJ occurs. In this case, since this is the first logging for rLOG-A, it is registered in the duplication check table 4 (indicated as rfi, J in the figure), and the status information is stored in the log storage area (logging storage area). (shown as "A" in the illustration) is stored. At this time, if the clear timer has not been started, the specified period is set and the clear timer is started.

Next, even if an event of logging rLOc;-AJ occurs at time ■, the contents of the duplication check table 4 are checked and ignored in this case.

Assume that an event for logging rLOG-BJ belonging to a suppression target event occurs at time ■. In this case, it is registered in the 1-duplication check table 4 as shown in FIG. Also, status information is logged.

Even if an event logging rLOG-BJ occurs at time ■, it is ignored in this case.

If the clear timer times out after the above situation occurs, at this point, rLOG-A matches the clear time on the duplication check table 4, and 2 rLOC from the duplication check table 4; -AJ
Delete registration related to. Then, the clear timer is restarted, but if there is a registration for rLOG-B on the double-duplication check table 4 at this point (in this case, it exists), then rLoc-B ”
The clear timer is restarted so that the specified period times out from the time ■ when the related event occurs.

Assuming that an event for logging rLOG-AJ occurs at time (2) below, it will be registered and logged as shown in Figure 9.

Even if an event logging rLOG-BJ occurs at time ■, it is ignored in this case.

If the clear timer times out after the above situation occurs, the registration related to rLOG-B will be deleted, and the clear timer will time out the above specified period from the time when the event related to "rLOG-A" occurred. It will restart like this.

FIG. 3 shows the processing configuration of an embodiment of the present invention. The logging processing device 2 includes a LOG information storage processing mechanism section 11 and a two-duplication table clearing processing mechanism section 12.

In the illustrated LOG information storage processing mechanism section 11.

Processing m in the processing mechanism is shown in the form of a processing flow. Similarly, in the one-duplicate table clearing processing mechanism section 12, processing Lq in the processing mechanism is shown in the form of a processing flow.

The processing in both processing mechanisms corresponds to the case shown in FIG. 2, and will not be repeatedly explained.
In the G information storage processing mechanism unit 11, regarding the 2-illustrated process (2), if it is not the target LOG, that is, if it is not written in the suppression target table 3, it immediately goes to the process (2) and performs logging. ing.

〔Effect of the invention〕

As explained above, according to the present invention, state information is prevented from being logged redundantly in an undesired manner, and suppression target events are previously described on the suppression target table (
(Of course, it may also be rewritable), so flexibility in collecting log information is extremely large.

[Brief explanation of drawings]

FIG. 1 is a diagram showing the principle configuration of the present invention, FIG. 2 is a diagram for explaining a processing example in the case of the present invention, and FIG. 3 is a diagram showing the processing configuration of an embodiment of the present invention. In the figure, 1 is communication equipment (monitored device), 2 is a logging processing device, 3 is a suppression target table, 4 is a duplication check table, 5 is a recording area, 11 is a LOG information storage processing mechanism unit, and 12 is a duplication table・Represents the clear processing mechanism.

Claims (1)

[Scope of Claims] A logging processing device (2) that logs status information in the monitored device (1) is provided, and the logging processing device (2) responds to an event occurring in the monitored device (1). In a logging processing method that logs status information at the relevant point in time, among the events targeted for logging, for suppression target events that do not require logging status information at all points in time, the suppression target log type is specified. Create a suppression target table (3) that holds a number and check target items among those belonging to the number, and also create a check start pointer (
P1), a next storage pointer (P2), and a recording area (5) for recording a clearing time in association with at least information specifying a log target in the range indicated by each of the above pointers. (4), and the logging processing device (2) is connected to the monitoring target device (1).
), the contents of the suppression target table (3) are checked, and if the event is the suppression target event, the contents of the duplication check table (4) are checked, and the corresponding event is checked. The present invention is characterized in that the process of logging status information regarding the event is omitted on the condition that information identifying the log target corresponding to the event exists and the event occurs within the clear time. Logging processing method.