JP5381059B2 - Device, log recording control method, and program - Google Patents

Description

  The present invention relates to a device, a log recording control method, and a program, and more particularly to a device, log recording control method, and program in which log information is used for analysis of abnormality.

  In order to analyze the cause of a failure that has occurred in a device controlled by a program, it is generally necessary to know the processing sequence of the program at the time of the failure, the value of data used by the program, and the like. If a failure occurs during program development, such information (processing sequence, data values, etc.) is relatively easy to use by using various commercially available tools (defect analysis tools such as debugger tools). Can know.

  However, in the case of a failure (market failure) that has occurred at a customer, it is difficult to use the failure analysis tool in a situation where normal use by a user is performed. Moreover, there are many cases where analysis via a network cannot be performed from the viewpoint of security. Furthermore, in the case of embedded devices such as image forming apparatuses, failure analysis tools are often not provided.

Thus, in embedded devices, failure analysis is performed based on logs output for debugging.
JP 2002-207399 A

  Conventionally, however, it has been difficult to predict the timing of the occurrence of a failure, so that a log for debugging must always be recorded. As a result, in the case of an embedded system that lacks hardware resources such as CPU performance and storage capacity, the hardware resources are consumed for log recording, and processing performance related to normal use may be degraded. There was sex.

  The present invention has been made in view of the above points, and an object of the present invention is to provide an apparatus, a log recording control method, and a program capable of appropriately recording a log for analyzing an abnormality.

  Therefore, in order to solve the above-described problem, the present invention provides an event recording unit that records a history of events that occur in the device in a history management unit, and the occurrence of an abnormality in response to the occurrence of an abnormality in the process according to the event. A comparison unit that starts comparing the history recorded in the history management unit with the history of events that have occurred after the occurrence of the abnormality, and determines whether or not to record log information based on the comparison; and the log by the comparison unit And log recording means for recording log information relating to processing according to the event in the log information management means after it is determined that information recording is necessary.

  Such an apparatus can appropriately record a log for analyzing an abnormality.

  According to the present invention, it is possible to appropriately record a log for analyzing an abnormality.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the present embodiment, a multifunction device is used as an example of a device. FIG. 1 is a diagram illustrating a hardware configuration example of a multifunction machine according to an embodiment of the present invention. In FIG. 1, the multifunction machine 10 includes a controller 201, an operation panel 202, a facsimile control unit (FCU) 203, an imaging unit 204, a printing unit 205, and the like.

  The controller 201 includes a CPU 211, ASIC 212, NB221, SB222, MEM-P231, MEM-C232, HDD (hard disk drive) 233, memory card slot 234, NIC (network interface controller) 241, USB device 242, IEEE 1394 device 243, and Centronics device. 244.

  The CPU 211 is an IC for various information processing. The ASIC 212 is an IC for various image processing. The NB 221 is a north bridge of the controller 201. The SB 222 is a south bridge of the controller 201. The MEM-P 231 is a system memory of the multifunction machine 10. The MEM-C 232 is a local memory of the multifunction machine 10. The HDD 233 is a storage of the multifunction machine 10. The memory card slot 234 is a slot for setting the memory card 235. The NIC 241 is a controller for network communication using a MAC address. The USB device 242 is a device for providing a USB standard connection terminal. The IEEE 1394 device 243 is a device for providing a connection terminal of the IEEE 1394 standard. The Centronics device 244 is a device for providing a Centronics specification connection terminal.

  The operation panel 202 is hardware (operation unit) for an operator to input to the multifunction device 10 and hardware (display unit) for an operator to obtain an output from the multifunction device 10.

  FIG. 2 is a diagram illustrating a software configuration example of the multifunction peripheral according to the embodiment of the present invention. In FIG. 2, the software of the MFP 10 includes a JSDK application 20, a JSDK platform 30, a JNI 40, a native service layer 50, a log recording control unit 60, and the like. Each of these software implements its function by causing the CPU 211 to execute the processing procedure implemented in each software.

  The native service layer 50 is configured by a program using native code. The native service layer 50 provides an interface for using functions based on the hardware and software of the multifunction machine 10 to the upper module, and implements the function in response to the interface call (function use request). To control. For example, the native service layer 50 includes a module that provides an interface related to network communication control, a module that provides an interface related to facsimile control, and control of distribution processing of stored documents (document (image) data stored in the HDD 233). A module for providing an interface for controlling the imaging unit 204 and the printing unit 205, a module for providing an interface for controlling the memory and the HDD 233, a module for providing an interface for controlling the operation panel 202, and an authentication process And a module for providing an interface for controlling the accounting process, a module for providing an interface for managing user information, and the like.

  The JNI 40 is a so-called JNI (Java (registered trademark) Native Interface) provided with an API (Application Program Interface) that enables the use of the function provided by the native service layer 50 from a program written in Java (registered trademark). is there.

  The JSDK platform 30 is a software platform that provides an execution environment for the JSDK application 20. The JSDK platform 30 includes a Java (registered trademark) standard class, a class library related to a class extended for the multi-function peripheral 10, a Java (registered trademark) virtual machine, and the like.

  The JSDK application 20 is an application (hereinafter, referred to as “SDK application”) created using a dedicated SDK (software development kit) published on the JSDK platform 30. Among SDK applications, an application developed using the Java (registered trademark) language is called a JSDK application. In the figure, as the JSDK application 20, an application A, an application B, an application C, and the like are illustrated.

  The log recording control unit 60 records log information (particularly, debug log information) regarding the operation of the multifunction machine 10 at an appropriate timing. The log recording control unit 60 includes an event acquisition unit 61, an error detection unit 62, an event comparison unit 63, a log output unit 64, an occurrence event storage unit 65, a comparison event storage unit 66, a log storage unit 67, and the like.

  The event acquisition unit 61 receives data indicating an event that occurs in the device 10 (hereinafter, “event data”) from the JNI 40, and accumulates the event data in the occurrence event storage unit 65. The occurrence event storage unit 65 includes event data. This is a storage area (for example, a file) for accumulating (managing) the history of, and is formed, for example, in the HDD 233. In the present embodiment, the occurrence event storage unit 65 accumulates the history by the structure of the ring buffer. Therefore, event data from a recent (latest) event up to a predetermined number of events back by a predetermined number of events is accumulated in the generated event storage unit 65. Note that an event is an input made via the operation panel 202 or a composite Various events or events that occur according to the hardware or software operation of the machine 10 It refers to the notification of the event.

  The error detection unit 62 detects an error (abnormality) generated based on a failure or a malfunction in the process executed by the JSDK platform 30 according to an event. The error detection unit 62 transcribes (copies) the history of event data accumulated in the generated event storage unit 65 to the comparison event storage unit 66 in response to detection of an error. The comparison event storage unit 66 is a recording area (for example, a file) for holding the contents of the generated event storage unit 65 when an error occurs (that is, a history of past events when an error occurs). , Formed in the HDD 233. The event data transcribed in the comparison event storage unit 66 is hereinafter referred to as “comparison event data”.

  The event comparison unit 63 compares the history of comparison event data stored in the comparison event storage unit 66 with the event data history of events that have occurred after the occurrence of an error. The event comparison unit 63 determines the necessity of recording log information based on the comparison. More specifically, if a continuous part in the history of comparison event data matches a continuous part in the event data history of an event that has occurred after the occurrence of an error, it is determined that log information needs to be recorded.

  The log output unit 34 outputs (records) log information of processing by the JSDK application 20 or the JSDK platform 30 to the log storage unit 67. The log storage unit 67 is a recording area (for example, a file) for storing log information, and is formed in the HDD 233, for example. However, the log information may be recorded in a computer (storage device) connected via a network. In the present embodiment, log information by the JSDK application 20 and the JSDK platform 30 is not normally recorded. Recording of log information is started after the event comparing unit 63 determines that recording of log information is necessary.

  Hereinafter, a processing procedure of the multifunction machine 10 will be described. FIG. 3 is a flowchart for explaining a processing procedure of log recording processing by the multifunction peripheral. This figure shows the processing procedure executed in response to the occurrence of one event. Therefore, every time an event occurs, the processing procedure of FIG.

  When occurrence of any event such as an input to the operation panel 202 by the user is detected, the multi-function device 10 executes processing (for example, screen transition, job execution, etc.) according to the event (S101). Subsequently, based on the event data of the event that has occurred, the multi-function device 10 determines whether or not the event is an event specified in the filter information (S102).

  FIG. 4 is a diagram illustrating a configuration example of event data. In the figure, the event data has items (or attributes) such as an event code and a type. The event code is identification information (number or symbol, etc.) for identifying the contents of the event. For example, event data corresponding to the same key input to the operation panel 602 has the same event code. The type is information indicating to which class the event belongs when the event is classified according to the generation factor or the occurrence location. For example, the events are classified into types such as an event corresponding to an input on the operation panel 602, an event related to a scan function, an event related to a printing function, an event related to a power supply, and the like. The event code may include a symbol indicating the type of event.

  The filter information is information (information for filtering an event to be monitored) indicating which type of event is to be monitored. The filter information is set in advance by an administrator or the like and recorded in the HDD 233 or the like. Therefore, in step S102, the type of event that has occurred is compared with the type of event set as filter information. A plurality of types may be set in the filter information. The filter information may be managed in a format that can be distributed via a recording medium or a network, such as a file. By doing so, filter information can be easily applied to a customer.

  When the type of the event that has occurred is included in the type set in the filter information (Yes in S102), the multifunction machine 10 records the event data in the occurrence event storage unit 65 (S103).

  FIG. 5 is a diagram illustrating a configuration example of the generated event storage unit. In the figure, the occurrence event storage unit 65 has a configuration capable of accumulating event data in the order of occurrence (that is, the event data history can be recorded). In the present embodiment, the generated event storage unit 65 is used as a ring buffer. That is, after event data is recorded in the last entry (last line), event data is recorded in the first entry. Therefore, event data is accumulated retroactively a predetermined number of times from the present time. The reason for using the generated event storage unit 65 as a ring buffer is to prevent an increase in the consumption of the storage area of the multifunction machine 10. However, the ring buffer is not necessarily required. For example, the occurrence event storage unit 65 may be configured by a list structure.

  Subsequently, the multifunction machine 10 determines whether or not the comparison event data is registered in the comparison event storage unit 66 (S104). When the comparison event data is not registered in the comparison event storage unit 66 (No in S104), the multi function device 10 determines whether an error (including an exception) has occurred in the process corresponding to the current event. Determination is made (S105). When an error occurs (Yes in S105), the event data recorded in the occurrence event storage unit 65 is copied to the comparison event storage unit 66 in the order of occurrence, and the pointer of the comparison event storage unit 66 (hereinafter, referred to as “event event storage unit 66”). "Comparison pointer") is set at the head (S106). Further, the multifunction machine 10 initializes the number of comparisons by the event comparison unit 63 to zero. If no error has occurred (No in S105), copying is not performed.

  On the other hand, when event data is registered in the comparison event storage unit 66 (that is, when an error has occurred at least once) (Yes in S104), the multifunction machine 10 has the comparison pointer in the comparison event storage unit 66. It is determined whether or not the end (after the last entry) is pointed (S111). If the comparison pointer is not the end (No in S111), the multifunction machine 10 compares the event code of the current event with the event code of the comparison event data pointed to by the comparison pointer in the comparison event storage unit 66 (S112). ). If the two match (Yes in S113), the multifunction machine 10 increments the comparison pointer and the number of comparisons (S114). Subsequently, the multifunction device 10 determines whether or not the number of comparisons is equal to or greater than a preset threshold (that is, whether or not a match equal to or greater than the threshold has occurred) (S115). That is, it is determined whether or not the same sequence as the head portion of the sequence of events in which errors have occurred in the past has been reproduced.

  For example, when the event codes of continuous comparison event data are a, b, c, a, d, and e (here, for convenience, the event code is expressed by a single letter), When the threshold is “3”, if the match of the leading a and b is already confirmed and the event code of the current event is “c”, it is determined that a match equal to or greater than the threshold has occurred.

  If the number of comparisons is equal to or greater than the threshold (Yes in S115), the multi-function device 10 validates the output of log information by the JSDK application 20 and the JSDK platform 30 (S116). When the log information output is validated, the log output command embedded in the source code of the JSDK application 20 and the JSDK platform 30 is validated. As a result, log information related to the process executed in step S101 is recorded in the log storage unit 67 in accordance with an event that occurs next time.

  That is, before step S116 is executed, the output of log information by the JSDK application 20 and the JSDK platform 30 is invalidated. Therefore, the log information is not output. Switching between enabling and disabling the output of log information may be performed using a flag variable or the like.

  If the number of comparisons is less than the threshold (No in S115), the multifunction machine 10 does not validate the output of log information.

  On the other hand, in step S111, if the comparison pointer points to the end of the comparison event storage unit 66 (after the last entry) (Yes in S111), the multifunction machine 10 generates an error in the process corresponding to the current event. It is determined whether or not (S121). When an error occurs (Yes in S121), the log information recorded in the log storage unit 67 is stored without being deleted (S122). When no error has occurred (No in S121), the multifunction machine 10 deletes the log information recorded in the log storage unit 67 (S123).

  In the case of No in step S122, S123, or step S113 (when the event code of the current event does not match the event code of the comparison event data pointed to by the comparison pointer in the comparison event storage unit 66), The multi-function device 10 initializes the comparison pointer and the number of comparisons (that is, sets the pointer destination to the head position of the comparison event storage unit 66 and sets the comparison number to 0) (S124). Subsequently, the multifunction machine 10 invalidates the output of log information by the JSDK application 20 and the JSDK platform 30 (S125).

  Next, how the components shown in FIG. 2 cooperate to realize the processing procedure of FIG. 3 will be described. FIG. 6 is a diagram for explaining cooperation between components in the log recording process.

  An event occurring in the multifunction machine 10 is notified to the JNI 40 from an OS (Operating System) shown in the figure (S201). The JNI 40 transmits event data of the notified event to the JSDK platform 30 (S202). The JSDK platform 30 that has received the event data executes processing corresponding to the event. In addition, the JSDK platform 30 notifies the event data to the JSDK application 20 that is the operation target as necessary (S203). The JSDK application 20 notified of the event data executes processing corresponding to the event.

  The JNI 40 also transmits event data to the event acquisition unit 61 and the event comparison unit 63 (S204, S205). The event acquisition unit 61 records the received event data in the occurrence event storage unit 65 (S206). The event comparison unit 63 ignores the received event data.

  During normal operation, the above process is repeated. As a result, the occurrence event storage unit 65 stores a predetermined number of recent event data.

  In the processing of the JSDK application 20 or the JSDK platform 30 executed in response to an event, a bug due to a program bug or a failure of the multifunction machine 10 (notification of an error from the native service layer 50 or in the JSDK application 20 or the JSDK platform 30) When the occurrence of an exception) is detected, the JSDK platform 30 notifies the error detection unit 62 of the occurrence of the error (S211). In response to the error occurrence notification, the error detection unit 62 copies the event data group accumulated in the occurrence event storage unit 65 to the comparison event storage unit 66 (S212). Further, the error detection unit 62 notifies the event comparison unit 63 that the comparison event data has been registered in the comparison event storage unit 66 (S213).

  In response to the notification from the error detection unit 62, the event comparison unit 63 starts comparing the event data repeatedly received at the timing of step S205 with the comparison event storage unit 66 (S214). Comparison event data to be compared is identified by a comparison pointer. The comparison pointer is set to the first entry of the comparison event storage unit 66 by the event comparison unit 63 in response to the notification from the error detection unit 62. Thereafter, it is incremented every time the comparison is completed. The event comparison unit 63 increments the number of comparisons when the comparison target matches continuously. When the number of comparisons is equal to or greater than the threshold (that is, when the comparison targets are continuously equal to or greater than the threshold number), the event comparison unit 63 makes a log information output start request to the JSDK platform 30 (S221). .

  For example, when the threshold value is 3 and the event codes of continuous comparison event data are a, b, c, a, d, and e, the event comparison unit 63 indicates that the received event (S205) is When it is confirmed that a, b, and c are continued, a log information output start request is made. The log information output start request is also notified to the JSDK application 20 by the JSDK platform 30 (S222).

  In response to the log information output start request, the JSDK platform 30 and the JSDK application 20 validate the log information output (log output command). Therefore, regarding the process executed in response to the event (S202, S203) notified thereafter, the JSDK platform 30 or the JSDK application 20 notifies the log output unit 64 of log information based on the log output command ( S231, S232). The log output unit 64 records the notified log information in the log storage unit 67 based on a predetermined format.

  As a result, log information from the JSDK application 20 or the JSDK platform 30 is accumulated in the log storage unit 67 each time processing is executed in response to the occurrence of an event. Further, the comparison of event data by the event comparison unit 63 is continued.

  Thereafter, when the last entry (the last comparison event data) in the comparison event storage unit 66 is a comparison target, and the comparison is performed using the last comparison event data, the event comparison unit 63 issues a log information output stop request. The JSDK platform 30 is notified (S241). The JSDK platform 30 notifies the JSDK application 20 of a log information output stop request (S242).

  In response to the log information output stop request, the JSDK platform 30 and the JSDK application 20 invalidate the output of log information. Therefore, log information is not output for processing executed in response to an event (S202, S203) notified thereafter.

  Subsequently, the JSDK platform 30 notifies the log output unit 64 of the output stop of the log information (S243). If the last log information indicates an error, the log output unit 64 saves (saves) the log information recorded in the log storage unit 67 in a predetermined storage area.

  Thereafter, the cause of the failure (failure) is analyzed based on the saved log information.

  As described above, the MFP 10 according to the present embodiment detects the occurrence of an event sequence that matches a continuous part of the event history (event sequence) when a failure has occurred in the past (that is, the past). Recording of log information is started when there is a high possibility that the event sequence at the time of failure will be reproduced).

  In general, in an embedded system device such as the multifunction machine 10, event-driven control is performed. Event-driven control is to perform some processing triggered by an event coming from a device and return to the event standby state when the processing is completed. Therefore, when some kind of failure occurs, there is a high possibility that there is a relationship between the previous event sequence and the failure. In other words, an event sequence generated by a key operation represents a series of key operation procedures, and a defect that occurs in a specific key operation can be said to be related to the event sequence.

  Therefore, according to the MFP 10, it is possible to start recording log information before a failure occurs and when it is predicted that the possibility of the failure is relatively high. . Therefore, the storage capacity for recording the log information can be significantly reduced as compared with the case where the log information is always recorded, and the log information useful for the failure analysis work can be recorded.

  The comparison event storage unit 66 may be generated every time a failure occurs. In this case, a plurality of comparison event storage units 66 may exist at the same time. When there are a plurality of comparison event storage units 66, the event comparison unit 63 performs a comparison with the plurality of comparison event storage units 66 each time an event occurs. As a result, when a match with a part of the event sequence (a part for the threshold) in at least one comparison event storage unit 66 is confirmed, output of log information is started.

  Also, when a plurality of types (event types) are set in the filter information (when there are substantially a plurality of filters), an occurrence event storage unit 65 and a comparison event storage unit 66 are prepared for each type. However, the event sequences may be compared independently for each type.

  Further, the JSDK application 20, the JSDK platform 30, or the log output unit 64 may dynamically determine a range in which log information output is valid, an output level of log information, and the like based on filter information. For example, it is assumed that an event related to a scan function and an event related to a print function are monitored, and each type is set as filter information. If a problem occurs due to an event related to the scan function in this state, only the output of log information related to the scan function is enabled.

  Similarly, a range (for example, a class or the like) for outputting log information may be dynamically determined according to the content of the defect (for example, the content of an error).

  Further, when the same defect (for example, the same error code or exception code) occurs a plurality of times, the comparison event data is registered in the plurality of independent comparison event storage units 66, and the comparison event is stored. It is also possible to extract comparison event data that overlaps between the units 66 and automatically update the filter information based on the type of the extracted comparison event data.

  Furthermore, in the present embodiment, an example is shown in which there is one comparison pointer and the initial position is the first entry (comparison event data) of the comparison event storage unit 66, but one comparison event storage is shown. A plurality of comparison pointers may be set for the unit 66. For example, the event sequence of comparison event data (hereinafter referred to as “comparison event sequence”) is a, b, c, a, d, e (one letter of the alphabet indicates an event code), and is newly added. When the event code of the generated event is “a”, a comparison pointer is set for each of the first “a” and the fourth “a” in the comparison event sequence. Thereafter, while comparing each comparison pointer by one, the event code of the comparison event data pointed to by each comparison pointer is compared with the event code of the newly generated event. When a match equal to or greater than the threshold is detected for any of the log information, the output of log information is started.

  By doing so, for example, in the event sequence for comparison described above, even if a, d, and e are event sequences that cause a failure, even if an operation corresponding to the event of a and d is performed. (The threshold value in this case is “2”), and output of log information can be started.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

FIG. 2 is a diagram illustrating an example of a hardware configuration of a multifunction machine according to an embodiment of the present invention. FIG. 3 is a diagram illustrating a software configuration example of a multifunction machine according to an embodiment of the present invention. 10 is a flowchart for explaining a processing procedure of log recording processing by the multifunction peripheral. It is a figure which shows the structural example of event data. It is a figure which shows the structural example of an occurrence event storage part. It is a figure for demonstrating the cooperation between the components in a log recording process.

Explanation of symbols

10 MFP 20 JSDK application 30 JSDK platform 40 JNI
50 Native Service Layer 60 Log Recording Control Unit 61 Event Acquisition Unit 62 Error Detection Unit 63 Event Comparison Unit 64 Log Output Unit 65 Occurrence Event Storage Unit 66 Comparison Event Storage Unit 67 Log Storage Unit 201 Controller 202 Operation Panel 203 Facsimile Control Unit 204 Imaging unit 205 Printing unit 211 CPU
212 ASIC
221 NB
222 SB
231 MEM-P
232 MEM-C
233 HDD
234 Memory card slot 235 Memory card 241 NIC
242 USB device 243 IEEE 1394 device 244 Centronics device

Claims (12)

Event recording means for recording the history of events occurring in the device in the history management means;
Comparing means for starting the comparison of the response to the occurrence of an abnormality in the processing corresponding to the event, event history that occurred after the occurrence of the recorded history the abnormality in the history management means by the abnormality occurrence,
In the comparison, when a continuous part of the history recorded in the history management means before the occurrence of the abnormality matches a continuous part of the history of events that have occurred after the occurrence of the abnormality , a response is made according to the event. And log recording means for recording log information related to the processing in the log information management means. The log recording means includes, in the comparison, a continuous part from the beginning or a part from the middle of the history recorded in the history management means until the occurrence of the abnormality, and an event that has occurred after the occurrence of the abnormality. 2. The device according to claim 1, wherein log information relating to processing according to the event is recorded in a log information management means when a continuous part of the history matches. In accordance with the occurrence of an abnormality in the process according to the event, it has comparison data generation means for generating comparison data indicating a history recorded in the history management means until the occurrence of the abnormality,
It said comparing means according to claim 1 or 2 apparatus according compares the history of the events that occur after the occurrence of abnormality and history of the data for comparison are shown.   The device according to any one of claims 1 to 3, wherein the event recording unit records a history of the latest predetermined number of events in the history management unit. A log recording control method executed by a device,
An event recording procedure for recording a history of events occurring in the device in the history management means;
A comparison procedure for starting the comparison of the response to the occurrence of an abnormality in the processing corresponding to the event, event history that occurred after the occurrence of the recorded history the abnormality in the history management means by the abnormality occurrence,
In the comparison, when a continuous part of the history recorded in the history management means before the occurrence of the abnormality matches a continuous part of the history of events that have occurred after the occurrence of the abnormality , a response is made according to the event. Log recording control method comprising: a log recording procedure for recording log information relating to the processed processing in log information management means. In the comparison, the log recording procedure includes a continuous part from the beginning of the history recorded in the history management means until the occurrence of the abnormality or a part from the middle of the history, and an event that has occurred after the occurrence of the abnormality. 6. The log recording control method according to claim 5, wherein log information relating to processing according to the event is recorded in the log information management means when a continuous part of the history matches. In accordance with the occurrence of an abnormality in the process according to the event, a comparison data generation procedure for generating comparison data indicating a history recorded in the history management means until the occurrence of the abnormality,
The comparison procedure, the log record control method according to claim 5 or 6, wherein comparing the history of events that occur after the occurrence of abnormality and history the comparative data indicates.   The log recording control method according to claim 5, wherein the event recording procedure records the history of the latest predetermined number of events in the history management unit. On the equipment,
An event recording procedure for recording a history of events occurring in the device in the history management means;
A comparison procedure for starting the comparison of the response to the occurrence of an abnormality in the processing corresponding to the event, event history that occurred after the occurrence of the recorded history the abnormality in the history management means by the abnormality occurrence,
In the comparison, when a continuous part of the history recorded in the history management means before the occurrence of the abnormality matches a continuous part of the history of events that have occurred after the occurrence of the abnormality , a response is made according to the event. For executing a log recording procedure for recording log information relating to the processing to the log information management means. In the comparison, the log recording procedure includes a continuous part from the beginning of the history recorded in the history management means until the occurrence of the abnormality or a part from the middle of the history, and an event that has occurred after the occurrence of the abnormality. The program according to claim 9, wherein log information relating to processing according to the event is recorded in the log information management means when a continuous part of the history matches. In accordance with the occurrence of an abnormality in the process according to the event, a comparison data generation procedure for generating comparison data indicating a history recorded in the history management means until the occurrence of the abnormality,
The comparison procedure, claim 9 or 10, wherein the program compares a history of events that occur after the occurrence of abnormality and history of the data for comparison are shown.   12. The program according to claim 9, wherein the event recording procedure records the history of the latest predetermined number of events in the history management unit.

Images