Patent ID: 7809681
Filing Date: 2010-10-05
Classification: H04L

Abstract:
1. A log analysis method for receiving, by a log analyze unit executed by a processor, logs including time stamps from a plurality of computers, and correcting the time stamps by the processor for executing the log analyze unit to analyze the logs, comprising the steps of: generating, by the plurality of computers, a first log including time correction amount and a time stamp at a time of correcting time; generating, by the plurality of computers, a second log including a time stamp in a log regarding a process or an operation; transmitting, by the plurality of computers, the first log and the second log; receiving, by the log analyze unit, the first log and the second log; storing, by the log analyze unit, the first log in a time correction history storage; calculating, by the log analyze unit, first time correction amount based on the first log; correcting, by the log analyze unit, the time stamp of the second log based on the first time correction amount and second time correction amount; determining, by the log analyze unit, whether, for a plurality of second logs whose time stamps have been corrected, a time-sequential order relation among the plurality of second logs satisfies a preset consistency rule; obtaining, when the time-sequential order relation among the plurality of second logs does not satisfy the preset consistency rule, by the log analyze unit, the second time correction amount from a difference among time stamps of the plurality of second logs; correcting the time stamps of second logs which do not satisfy the preset consistency rule again based on the first time correction amount and the second time correction amount; determining whether the second logs whose time stamps have been corrected again satisfy the preset consistency rule again; storing second logs which satisfy the preset consistency rule; and analyzing the stored second logs.