CROSS-REFERENCE TO PRIOR APPLICATION

This application relates to and claims the benefit of priority from Japanese Patent Application No. 2019-10359 filed on Jan. 24, 2019, the entire disclosure of which is incorporated herein by reference.

BACKGROUND

The present invention relates to a technique for analyzing labels indicating contents of events in log stream data composed of log data output consecutively.

DESCRIPTION OF THE RELATED ART

In recent years, there has been an increasing interest in improving the reliability, availability, and security of IT systems in the automatization of IT operation management. Main tasks in the IT operation management include monitoring and maintaining the health of IT systems, and tasks are currently conducted by human operators (monitoring operators).

The monitoring operators are obliged to monitor and interpret a log stream output generated by IT systems for indicating the current soundness status of the IT systems or events of operations, for example, a change of system configuration during maintenance. When the soundness of the IT systems is endangered, the monitoring operators need to take measures.

In recent years, the number of IT systems has been steadily increasing in an organization, and, for example, use of large entities of the IT systems such as data centers has been gradually becoming common. This leads to a large amount of log stream output which is generated by a large number of IT systems and all of which the monitoring operators need to analyze. To interpret all the log data generated by the IT systems requires a huge amount of labor and expense.

Most of the log stream output results from activities that are performed to improve (maintain) the system health and that do not require strict observation by the monitoring operators because further measures are not taken.

Although strict observation is not required, it remains important to notify a root cause of a log event of the observing monitoring operators in an accurate and timely manner.

Therefore, an automatic log labeling apparatus will provide relief to work resources necessary to interpret a log stream output in known maintenance log events.

For example, U.S. Pat. No. 9,779,005 proposes an unsupervised method for analyzing similarity of log stream data by identifying similarity of log data including a specific term. Here, a log record is log stream data partitioned into a log group according to a certain freely definable constraint. Similarity is determined between log records including the same definition term and stored in a data structure for definition words.

Furthermore, U.S. Patent application No. 2017/0132104 proposes an unsupervised log analysis method for a distributed control system that identifies a set of low-level log operations with one operation intention from an operation history by a system operator. The set of low-level log operations is organized by more abstract high-level operations and the same high-level operation is clustered in order to obtain a low-level operation ordering rule probability in each high-level operation.

SUMMARY

For IT systems, their health status is the most important and affects many users, therefore it is subject to continuous monitoring by monitoring operators. Here, the monitoring operators must accurately identify the type and cause of log stream output in order to ensure that the health of IT systems is not endangered.

Although most of the log stream output is generated by log events that do not endanger the health of the IT systems, for example, by maintenance operation, the IT systems may often output a log stream that does not endanger the health of the IT systems but looks like an error. Even at such times, it is necessary to accurately identify in order to confirm that no fatal error has occurred.

Many log events include a plurality of operation steps that all generate a log stream output, and the time frame of one log event may span a longer period with a break inserted in between. While the log output is being streamed continuously during an actual event being in progress, the monitoring operators have to identify a log event.

Therefore, it is not feasible to wait for an end of the log event in order to identify a right log event label by the log analysis method.

In order to support the monitoring operators and guarantee the health of the IT systems, it is necessary to identify a log event from the log stream output in an accurate and timely manner.

When the same definition term is included, similarity information is obtained for different records of the log stream output. However, it is impossible to handle groups of log records for all event labels. Furthermore, regardless of whether to include defined terms, a cumulative approach cannot gradually calculate similarity between log records.

The technique disclosed in U.S. Patent Application No. 2017/0132104 handles order information on a set of low-level operations by clustering with the same operation intention. This is performed in an offline approach only, so it cannot be applied to the log stream output. Furthermore, the technique of U.S. Patent Application No. 2017/0132104 does not calculate similarity between an extracted high-level operation and a newly observed log output either cumulatively or by the offline approach.

The present invention has been made in view of the above circumstances, and its object is to provide a technique capable of appropriately recognizing labels indicating contents of log events included in a log stream output.

In order to achieve the above object, a log analysis apparatus according to one aspect is a log analysis apparatus for recognizing a label indicating a log event included in log stream data which is a plurality of pieces of log data output consecutively, comprising: a storage unit configured to store importance information indicating importance of a plurality of action sets each including one or more actions included in log data for a plurality of labels, and action set information identifying a first action set used for calculating a long-term similarity which is similarity in a long-term perspective with each label of a first log unit including one or more pieces of log data at a first time point; a similarity calculation unit configured to calculate the long-term similarity with each of the labels of the first log unit based on the importance information, an action set included in the first log unit at the first time point, and the action set identified by the action set information; a label detection processing unit configured to detect label candidates corresponding to the first log unit based on the long-term similarity; and an accumulation determination unit configured to determine a second action set which is an action set used for calculating a long-term similarity with each label of a second log unit at a time point next to the predetermined time point based on the long-term similarity and to store action set information identifying the second action set in the storage unit.

According to the present invention, it is possible to appropriately recognize labels indicating contents of log events included in a log stream output.

