JPH1165895A - Logging file management system and management method - Google Patents

Abstract

(57) [Summary] [Problem] Unnecessary log data accumulated in a logging file cannot be automatically deleted. In addition, it is difficult to determine which log data in the file is log data for processing by which user on which host. SOLUTION: A logging file 100 is composed of a plurality of child files 200, and when all the child files 200 are full of data, the child file 200 storing the oldest log data is discarded and a new one is created. Child file 2
00 is opened and log data is output to the file. It also outputs log data in a formatted form.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system and a method for managing a logging file to which an information processing apparatus outputs log data.

[0002]

2. Description of the Related Art In an information processing system, information at the time of occurrence of a system error or the like, communication record, etc.
Log data, which is a record of processes and operations executed in the system, is created in a specific file (logging file) in an auxiliary storage device such as a magnetic tape or a magnetic disk, and is stored and managed in the file.

In the conventional log data management method using a logging file, for example, in the case of log data for a system error, one logging file for log data for the error is prepared, and when a system error occurs, the log data is stored in the log file. Output to the logging file.

[0004]

Whenever log data is generated and output to a logging file, the log data is accumulated in the logging file over time, and the size of the file is increased. Grows indefinitely. Such an increase in the size of the logging file causes a shortage of system resources and a decrease in access speed to the file.

In general, one logging file is created for each type of log data managed for one information processing system. Therefore, in the case of a multi-user, multi-task system, a plurality of tasks are created. This file will be shared.

For this reason, even if an attempt is made to delete unnecessary log data stored in the logging file, there is a possibility that the logging file may be used by another task. And it is difficult to automate the process. For this reason, the system administrator regularly organizes log data in the logging file and deletes unnecessary log data so that the logging file does not exceed a certain size.

Further, when a logging file is shared by a plurality of tasks, it is difficult to determine which log data in the file is log data for processing by which user on which host.

According to the present invention, the size of the logging file can be automatically adjusted to a certain value or less without manually deleting the log data in the logging file manually. It is an object of the present invention to provide a logging file management device and a management method capable of easily determining which user of a host is log data for a process.

[0009]

SUMMARY OF THE INVENTION The present invention relates to a logging file management system for managing log data generated by an information processing system using a logging file, and includes a log data storage unit, a child file storage instruction unit, and a child file storage instruction unit. A file deletion unit is provided.

[0010] The logging file has one or more child files as constituent elements, and the log data storage means opens a child file, which is a constituent element of the logging file, and stores the log data in the log file.

When the amount of the log data stored in the child file reaches a first value, the child file storage instructing means causes the log data storage means to complete storing the log data in the child file. A child file other than the child file for which the log data has been stored is opened to store the log data.

When the number of child files for which the log data has been stored reaches the second value and the size of the child file for storing the log data has reached the first value, Delete the child file that holds the oldest log data among the above child files.

According to the logging management system of the present invention, the logging file has one or more child files as constituent elements, and the log data stored in the logging file is managed for each child file. In this configuration,
When the size of the logging file reaches the second value,
The child file holding the oldest log data among the child files constituting the logging file is deleted by the child file deleting means, and as a result, the size of the logging file is kept below the second value. .

[0014]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram illustrating a configuration and a management method of a logging file according to the present embodiment.

The logging file 10 in the present embodiment
Numeral 0 is a virtual file generated for each type of log data to be managed. As shown in FIG. 1A, the virtual file is composed of a fixed number (here, n) or less of child files 200. The log data stored in the logging file 100 is managed on a child file 200 basis. This child file 200 is from file 1 to file n
The maximum value to which consecutive file names are assigned is n files of the same size (here, m bytes) which can be handled independently. Of these, in the initial state of the logging file 100, The child file 200 does not actually exist, and the file 1 is output when the first log data is output.
Only are opened and created. Note that child file 20
The file name assigned to 0 is determined based on the logging file 100 to which the file belongs, that is, the type of output log data and the generation time of the output log data. Each child file 200 is managed by this file name. You.

The maximum value of the capacity of the logging file 100 and the maximum number n of the child files 200 are predetermined as predetermined values. Further, according to these values, for example, the maximum capacity of the logging file 100 is 10 Mbytes,
Assuming that the maximum number n of 00 is 10, each child file 200
Is determined to be 1 Mbytes. Note that the maximum capacity of the logging file 100 and the maximum number n of each child file 200 are determined by the resources of the system and the logging file 1.
It is determined as appropriate based on the type of log data output at 00, its size, the amount of data output per unit period, the minimum period in which log data must be stored, and the like.

The log data in this embodiment has a specific format for each type, as described later.
Therefore, the size of one log data is determined by its type. Therefore, as the maximum capacity M of the child file 200, a value having a high storage efficiency with respect to the capacity is selected in consideration of the size of the log data.

In the method of managing log data in the logging file 100 according to the present embodiment, the generated log data is accumulated in the file 1 in the child files 200 constituting the logging file 100. The log data is accumulated, and the size of the file 1 is determined by the maximum capacity of the logging file 100 and the maximum number n of the child files 200 described above.
When the maximum capacity m is reached, the file name of file 1 is changed to file 2. Then, a new file 1 is opened, and subsequent log data is output to the newly opened file 1.

Next, the size of file 1 is
When the maximum capacity m becomes 0, the file name of file 2 is changed to file 3 and the file name of file 1 is changed to file 2. Then, a new file 1 is opened, and the subsequent log data is output to this file 1. File 1 until the number of child files 200 becomes n
The same process is performed each time the size of the file reaches the maximum capacity m of the child file 200.

When the number of child files 200 becomes n and the size of file 1 reaches the maximum capacity m of the child file 200, the file n is deleted first, and then the file n-
The file name of the child file 200 is changed in order from the file name of No. 1 to the file n and the file name of the file n-2 to the file n-1. After the file name of the file 1 is changed to the file 2, the file 1 is newly opened, and the subsequent log data is stored therein. By repeating this process, the oldest log data is discarded in the logging file 100, and its size is kept below the maximum value (m × n) defined as the initial value.

FIGS. 1B to 1L show the above processing. Note that the hatched lines in the figure indicate that log data is accumulated in the file. FIG. 1B shows an initial state of the logging file, in which only the file 1 exists, and the file 1 is opened and the log data is stored. When the log data is accumulated and the size of the file 1 reaches the maximum capacity m of the child file 200, the file 1 is closed as being full, and the output of the log data to this file is no longer performed. Stop (Fig. 1
(C)). Then, the data in the file 1 is copied to the file 2 and the file 1 is deleted (FIG. 1).
(D)). Then, the file 1 is newly opened, and the subsequent log data is output to this (FIG. 1 (e)).
By this processing, the old file 1 is renamed to file 2
Will be changed to In general, in an information processing system, it is the OS of the system that directly manages a file. According to the type of the OS, the file name is not changed by copying and deleting the file as described above. It is also possible to change the file name directly.

The log data is output to the new file 1 opened in FIG. 1E, and when the size of the file reaches the maximum capacity m of the child file 200, the file 1 is closed and the log data is deleted. The output is stopped (FIG. 1 (f)). Then, the data in file 2 is copied to file 3 and file 2 is deleted, and then the data in file 1 is copied to file 2 and file 1 is deleted (FIG. 1 (g)). As a result of this processing, the old files 1 and 2 have been renamed to the files 2 and 3. Then, a new file 1 is opened, and the subsequent log data is output to it (FIG. 1 (h)).

Thereafter, the size of file 1 is changed to child file 20.
Every time the capacity becomes greater than or equal to the maximum capacity of 0, the file name of the child file 200 is shifted and changed one by one, then a new file 1 is opened, and log data is output to it.

By repeating this process, the child file 20
The number of zeros gradually increases, and eventually the number of child files becomes the number n defined as a specified value (FIG. 1 (i)).
In this state, the log data is stored in the logging file 100 in the order of output, such as file 1, file 2, file 3,..., File n and the latest log data to the file 1, and the oldest log data to the file n. They are stored in chronological order.

When the child file 200 is full from file 1 to file n, the oldest file n of the log data stored in the logging file 100 is deleted and discarded (FIG. 1). (J)).
Then, the file names are shifted in the order of file n-1 to file n and file n-2 to file n-1 (FIG. 1).
(K)) Finally, a new file 1 is opened. Then, the subsequent log data is output to the new file 1 (FIG. 1 (l)).

Thereafter, by repeating the processing of FIGS. 1 (i) to 1 (l), the size of the logging file 100 is kept below the specified value (m × n). With the above processing, when the size of the logging file 100 reaches the maximum value, the oldest log data in the logging file 100 whose value as information is reduced is deleted in units of the child files 200 holding it. By doing so, the size of the logging file 100 can be kept below a certain value.

In this embodiment, the logging file 1
00, the child file 200 does not actually exist and the child file 200 is created together with the output of the log data.
It is also possible to have a configuration that already has n files in the initial state of 0. In this case, a child file 200 having a size of 0 is created as the initial state child file and log data is sequentially output, and a child file 200 having a size of m is created in advance to secure the necessary capacity. Configuration.

In the present embodiment, input / output of log data is performed for each child file 200 constituting the logging file 100. Therefore logging file 100
While data input / output processing is performed for the entire file, access to the child file 200 whose capacity is as small as 1 / n reduces access time.

In this embodiment, the logging file 1
The log data output to 00 has a prescribed format according to the type of the data, is standardized, and is output to a logging file.

FIG. 2 is a diagram showing an example of an output format when the log data is log data for a system error in the present embodiment. In the logging file management system according to the present embodiment, when a system error occurs, the error information is standardized by adding a date, a host name, a user name, and an error level, and output as log data to a logging file.

In FIG. 2, date information indicating the date and time when the error occurred, a host name indicating the host where the error occurred,
The information includes a user name indicating the name of the user who was performing the process in which the error occurred, an error level indicating the type of the error, and error information that is detailed information on the error that occurred. One log data has a fixed size,
Each of the information is given a prescribed number of bits, and is stored at a prescribed position in the log data.

As an example of the log data of the error information,
For example, “1997-04-01 08: 8: 30: 00: 00 AM on April 1, 1997, which is the date and time when the error occurred.
30:00 ”, an identifier“ s5ws1 ”indicating the host name in which the error occurred, a user name“ hanako ”indicating the user who performed the processing in which the error occurred, and an error level indicating the content of the error occurred. "ALERT" indicating that the error is a bug, and error information corresponding to the error, such as an address indicating an error occurrence position and register information at the time of error occurrence, are output to the logging file as log data in the format of FIG. .

FIG. 3 is a diagram showing types of error levels, which is one of the data stored in the log data of the system error shown in FIG. The types of system errors according to the present embodiment include a shutdown represented by “EMERG”, a bug represented by “ALERT”,
There are system errors such as an internal failure represented by "CRIT", insufficient memory represented by "ERR", and insufficient disk capacity. By adding this error level, when the log data is used later, necessary information can be easily searched and referenced according to the error level.

FIG. 4 is a flowchart showing the processing operation of the logging file management system in this embodiment. FIG. 4 shows a processing operation when a logging file having a maximum capacity of 10 Mbytes for storing log data of a system error is constituted by ten 1 Mbyte child files from file 1 to file 10. ing.

In FIG. 4, when a system error occurs and processing is started, first, in step S101, the file name of a logging file that stores log data generated for the system error is obtained. Then, as a step S102, the file 1 of the child file constituting the logging file is opened.

In step S103, it is determined whether the size of the file 1 exceeds 1 Mbyte. If not exceeded (step S103, NO), the process proceeds to step S113, where the log data of the error information is standardized and written to the file 1.

If it is determined in step S103 that the size of file 1 exceeds 1 Mbyte (step S10
3, YES), since new log data cannot be stored in this file, file 1 is closed in step S104.

After the processing in step S104, it is next determined in step S105 whether or not the file 10 has already been created in the logging file, that is, whether or not the size of the logging file has already reached its maximum capacity of 10 Mbytes. Is done. If the file 10 exists (step S105, YES), step S106
And delete the file 10 in which the oldest log data is stored in this logging file, and execute step S10
Move to the process of 7. If the file 10 does not exist (Step S105, NO), Step S10
Move to the process of 7.

In step S107, a value obtained by subtracting 1 from 10 which is the maximum number of child files is set to 9 as an initial value in a file counter used for file processing. Next, using this file counter, the file name of each child file is changed by the processing from steps S108 to S111.

In step S108, first, it is checked whether a file corresponding to the file counter, for example, a child file having a file name of file 9 if the file counter is 9, exists in the child files constituting the logging file. If it does not exist (step S108, N
O), the process of changing the file name is skipped, the process proceeds to step S110, and the file counter is decremented. If a file corresponding to the file counter exists in the determination in step S108, the file corresponding to the file obtained by adding 1 to the value of the file counter, for example, the file counter becomes 9 in step S109.
If so, the file is copied to the file 10 and then the file corresponding to the file counter is deleted. This step S10
By the process of No. 9, the file name of the file corresponding to the file counter has been changed to the file name corresponding to the value of the file counter + 1. Note that this file name change processing may be changed to a flow of directly changing the file name depending on the type of OS, other than the method of copying and deleting a file as in step S109.

After the file name change processing in step S109 is completed, the value of the file counter is decremented by 1 in step S110, and if the file counter is not 0 (step S111, NO), a logging file is still formed. Since the file names of all child files have not been changed, the process returns to step S108,
The processes of steps S108 to S111 are repeated until the file names of all files have been changed. By repeating this, the file names of the child files are shifted one by one from file 9 to file 10, file 8 to file 9,..., File 1 to file 2.

If it is determined in step S111 that the value of the file counter is 0 (step S11, YES), the file names of all the child files constituting the logging file have been changed, and the file 1 has been deleted. At step S112, file 1 is opened and file 1 is newly created.

Then, in step S113, information on the system error is formatted into log data as shown in FIG. 2 in the file 1, output to the file 1, written and saved, and after the writing is completed, the file 1 is closed. (Step S114) The processing of this logging file ends. Steps S104 to S11
Since the log file cannot be output to the logging file 100 between the two, the output of the log data during this period is waited for to be output to the logging file 100 by the exclusive control mechanism of the system.

By the above processing, the log data for the system error is stored in a formatted form in the order of generation time and from file 1 in order. When the total amount of the log data reaches 10 Mbytes, the file 10 storing the oldest and low-value log data is discarded, and the size of the entire logging file is always kept at 10 Mbytes or less. It is.

When the data is stored in the logging file, the data is processed in a predetermined format, standardized, and then written as the log data into the logging file. Since information such as which system and which user performed the process and the time when the process was generated are added to the log data, it is easy to determine the log data.

FIG. 5 is a diagram showing an environment of an information processing system in which the logging file management system according to the present embodiment is used. This information processing system includes a CPU 11, a main storage device 12, a hard disk device 1 as shown in FIG.
3. Input / output devices (I /
O) 14, a network connection device 15 such as a modem, and a medium reading device 16 for reading stored contents from a portable storage medium such as a disk or a magnetic tape.
Are provided.

In the information processing system shown in FIG. 5, a magnetic tape, a floppy disk, a CD
Reading out a program and data stored in a storage medium 18 such as a ROM and an MO, and downloading them to the main storage device 12 or the hard disk 13; The processing according to the present embodiment can also be implemented in software by the CPU 11 executing this program or data.

In this information processing system, application software may be exchanged using a storage medium 18 such as a floppy disk. Therefore, the present invention is not limited to the logging file management device and the management method,
When used by a computer, it may be configured as a computer-readable storage medium 18 for causing the computer to perform the functions of the above-described embodiments of the present invention.

In this case, the “storage medium” includes, for example, FIG.
As shown in FIG. 2, a portable storage medium 26 such as a CD-ROM disk, a floppy disk (or an MO, a DVD, or a removable hard disk) or an external device (a server or the like) transmitted via the network line 23. ), A memory (RAM or hard disk, etc.) 25 in the main body 24 of the information processing apparatus 21, and the like. Portable storage medium 26
The program stored in the storage means (database or the like) 22 is loaded into a memory (RAM or hard disk or the like) 25 in the main body 24 and executed.

[0050]

As described above, according to the logging file management system of the present invention, the size of the logging file can be limited within a specified value. Therefore, it is possible to prevent a system resource shortage and a decrease in access speed to the file from being caused by the enlargement of the logging file.

In addition, the unnecessary log data in the logging file can be automatically deleted, and the system administrator periodically and manually organizes the log data so that the log data does not exceed a certain size. There is no need to delete unnecessary log data.

Further, since the input / output of the log data is performed for a child file smaller than the entire logging file, the access speed is increased. Further, according to the present invention, the log data is standardized when stored in the logging file, so that the data can be easily determined, and necessary information can be searched and referenced.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a configuration and a management method of a logging file.

FIG. 2 is a diagram illustrating an example of a format of log data of information for a system error.

FIG. 3 is a diagram showing types of error levels.

FIG. 4 is a flowchart showing a processing operation of the logging file management system.

FIG. 5 is an environment diagram of an information processing system in which the present system is used.

FIG. 6 is a diagram illustrating an example of a storage medium.

[Explanation of symbols]

 11 CPU 12 Main storage device 13 Hard disk 14 Input / output device 15 Network connection device 16 Medium reading device 21 Information processing device 22 Storage means 23 Network line 24 Information processing device main body 25 Memory 26 Portable storage medium 100 Logging file 200 Child file

Claims (6)

[Claims] 1. A logging file management system for managing log data generated by an information processing system using a logging file, wherein a child file which is a component of the logging file is opened, and the log data is stored in the child file. Log data storage means for storing, and the amount of the log data stored in the child file is a first
When the log data storage unit completes the storage of the log data in the child file, opens a child file different from the child file in which the log data has been stored, and stores the log data. File storage instructing means, and the number of child files for which the log data has been stored is second
And when the size of the child file for storing the log data reaches the first value, the child file deletion means for deleting the child file holding the oldest log data among the child files. A logging file management system comprising: 2. A logging file management method for managing log data generated by an information processing system using a logging file, wherein the logging file includes one or more child files as constituent elements, A logging file management method characterized in that it is performed for each child file. 3. The log data is stored in the logging file in time series, and when the amount of log data stored in the logging file reaches a specified value, a plurality of child files constituting the logging file are included. 3. The method according to claim 2, wherein a child file storing the oldest log data is deleted. 4. The logging file management method according to claim 3, wherein said child file is managed by a file name of said child file. 5. The logging file management method according to claim 2, wherein the log data output to the logging file is standardized. 6. A storage medium storing a program for causing an information processing system to manage log data by using a logging file, wherein the logging file has one or more child files as constituent elements. A storage medium storing a program to be executed for each child file.