Abstract:
In a gateway device holding a traffic relay function, the storage cost and the retrieval time for a great amount of access logs are prevented from increasing. The gateway device includes a traffic relay function, a protocol analysis function, a log output function and a log retrieval function. These functions output an access log in compressed or uncompressed form in compliance with a rule for each protocol designated by the manager in accordance with the degree of importance. The retrieval is carried out for the uncompressed file.

Description:
CROSS-REFERENCE TO RELATED PATENT APPLICATIONS 
       [0001]    Japan Priority Application 2009-240983, filed Oct. 20, 2009 including the specification, drawings, claims and abstract, is incorporated herein by reference in its entirety. This application is a Continuation of US Application 12/854,600, filed Aug. 11, 2010, incorporated herein by reference in its entirety. 
       BACKGROUND 
       [0002]    This invention relates to the log management function of a server device such as the WWW (World Wide Web) or a gateway device installed on the communication path between the server device and a terminal in a network system for data communication between the server device and the terminal. 
         [0003]    With the extension of the use of terminals coupled to a wired network or a wireless network, the amount of the data exchanged between the server device such as WWW and client terminals is ever on the increase. Also, the traffic has been increased by the shortening of the data communication time resulting from the increased capacity of the communication band of the wired network or the wireless network. 
         [0004]    The gateway device is often installed in a service provider such as an ISP (internet service provider) or a communication carrier. The increased traffic also increases the amount of data communication through the gateway device. At the same time, the logs handled by the gateway device (access logs) increase, resulting in an increased cost of maintenance and management. 
         [0005]    According to “Information Analysis Time Reduced from Several Days to Several Minutes by Netezza Realizing Immediate, Sophisticated Analysis” [online], Business Communication, 2008, Vol. 45, No. 11, Retrieved Aug. 4, 2009 on Internet &lt;URL: http://www.netezzajp/documents/NTT_docomo_BCM_Nov — 2008_Netezza.pdf&gt;, the data size of the access logs managed by the communication carrier has reached several to several tens of TB. 
         [0006]    The service provider, in order to meet the inquiry from the user (terminal user), is required to hold the access log for a predetermined length of time. Thus, the problem of a high management cost is posed to hold and retrieve the access log. The access log can be analyzed and retrieved at high speed by being stored in a data base. This method, however, requires disk space for index data and harbors the problem of a higher operation cost of the data base management software. 
         [0007]    A technique to solve these problems is disclosed in Japanese Published Patent Application JP-A-2003-76814. 
       SUMMARY 
       [0008]    The technique disclosed in JP-A-2003-76814 is intended to reduce the amount of the logs held in the server device. According to this technique, those logs acquired by the server device which fail to meet a predetermined condition are not output to the data base. In an application of this technique to the gateway device, the fact that all the logs are not held may fail to meet the inquiry from the user. 
         [0009]    In order to solve the problem described above, there is disclosed a system having the traffic relay function, the protocol analysis function, the log output function and the log retrieval function in a server or on a network path between the server and a client. 
         [0010]    The system disclosed herein is characterized by a means for dynamically changing the log acquisition mode, wherein the request from the client or the response from the server output as one access log by the functions described above is acquired in compressed or uncompressed form in accordance with the log acquisition mode designated for each protocol by a manager. 
         [0011]    Also, the system disclosed herein is characterized by a log output means for each log acquisition mode, wherein the functions described each output the access log thereof to a different file. 
         [0012]    According to a more specific aspect, there is provided an access log management method for a gateway device coupled to a client and a server to each other through a network, wherein the request received from the client is transmitted to the server and the response received from the server is transmitted to the client, characterized by comprising the steps of:
       classifying the access logs for each protocol used for access from the client to the server;   compressing the access log of the type designated in advance for compression, and recording the compressed access log in a compressed log file; and   recording the access log of the type designated in advance as uncompressed, in an uncompressed log file in an uncompressed form.       
 
         [0016]    Further, the gateway device is characterized in that the type designated as compressed form and the type designated as uncompressed form are determined in advance in accordance with the protocol and the log acquisition mode designated for the message type of the protocol, and the log acquisition mode is set in accordance with the setting mode for setting the log acquisition mode for each session. 
         [0017]    Also, the gateway device is characterized in that the uncompressed log file is retrieved in priority to the compressed log file in response to the retrieval request from the client. 
         [0018]    According to the teaching herein, there can be provided a log management system capable of meeting the inquiry from the user without a high operation cost. 
         [0019]    These and other benefits are described throughout the present specification. A further understanding of the nature and advantages of the invention may be realized by reference to the remaining portions of the specification and the attached drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0020]      FIG. 1  shows an example of the configuration of a computer system. 
           [0021]      FIG. 2  shows an example of a log output mode management table held by the gateway device. 
           [0022]      FIG. 3  shows an example of an identification table held by the gateway device. 
           [0023]      FIG. 4  shows an example of a log output address setting table held by the gateway device. 
           [0024]      FIG. 5  shows an example of a log output management table held by the gateway device. 
           [0025]      FIG. 6  shows an example of an access log file stored in a disk device by the gateway device. 
           [0026]      FIG. 7  shows an example of an access log record stored in a memory by the gateway device. 
           [0027]      FIG. 8  shows an example of the flowchart of the process executed by the gateway device to relay the request from the client to the server. 
           [0028]      FIG. 9  shows an example of the flowchart of the process executed by the gateway device to relay the traffic of the request from the client. 
           [0029]      FIG. 10  shows an example of the flowchart of the process executed by the gateway device to analyze the request received from the client. 
           [0030]      FIG. 11  shows an example of the flowchart of the process executed by the gateway device to relay the response from the server to the client. 
           [0031]      FIG. 12  shows an example of the flowchart of the process executed by the gateway device to receive the response from the server and store the access log in the memory. 
           [0032]      FIG. 13  shows an example of the flowchart of the process executed by the gateway device to output the access log stored in the memory to the disk device. 
           [0033]      FIG. 14  shows an example of the flowchart of the process executed by the gateway device to retrieve the access log stored in the disk device. 
           [0034]      FIG. 15  shows an example of the configuration of the computer system with a conversion table added in the gateway device. 
           [0035]      FIG. 16  shows an example of the conversion table held by the gateway device. 
           [0036]      FIG. 17  shows an example of the flowchart of the process executed by the gateway device to receive the response from the server and dynamically change the mode to store the access log. 
       
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
       [0037]    Examples are explained below with reference to the accompanying drawings. Incidentally, the invention is not limited by these examples. 
         [0038]    The computer system according to this embodiment is configured of a gateway device, a client and a server coupled to each other through a network.  FIG. 1  shows an example of the configuration of the computer system. At least one gateway device  100  includes a traffic relay function  150 , a protocol analysis function  151 , a log output function  152  and a log retrieval function  153 . The gateway device  100  is coupled to at least one client device (hereinafter referred to as a client)  120  and at least one server device (hereinafter referred to as a server)  130  through networks  110 . 
         [0039]    In the description that follows, one gateway device  100 , one client and one server are assumed to be coupled to each other through the networks  110 . 
         [0040]    The traffic relay function  150  relays the request from the client to the server, and records the data of the logs for the process (access logs) in the memory of the gateway device. At the same time, the traffic gateway function  150 , in accordance with the designation by the manager, classifies the access logs into those easy to retrieve later and those difficult to retrieve later. 
         [0041]    Then, the access log highly likely to be retrieved is recorded in uncompressed form in an uncompressed log file  160  of the disk device  104  by the log output function  152 . Also, the access log less likely to be retrieved is compressed and recorded in a compressed log file  161  of the disk device  104  by the log output function  152 . 
         [0042]    In the case where the access log is retrieved based on the request of the user or the manager, the uncompressed log file  160  recorded in the disk device  104  is retrieved in priority by the log retrieval function  153  of the gateway device  100 . In the case where the uncompressed log file  160  contains no object of retrieval, the log retrieval function  153  searches the compressed log file  161 . 
         [0043]    The gateway device  100  is realized on a computer in which a CPU  101 , a memory  103 , at least one network interface (NW I/F)  106 , a disk device  104  for storing the access log file  160  and an input/output unit  102  are coupled to each other through a communication path  105  such as internal bus. The NW I/F  106  is coupled to the client  120  and the server  130  through the network  110 . 
         [0044]    The memory  103  stores therein a program executed by the CPU  101  to realize the traffic relay function  150 , the protocol analysis function  151 , the log output function  152  and the log retrieval function  153  on the one hand and an identification table  154 , a log output mode management table  155 , a log output address setting table  156  and a log output management table  157  on the other hand. 
         [0045]    The traffic relay function  150  relays the request message or the response message between the client  120  and the server  130 . The protocol analysis function  151  analyzes the protocol in the message. According to the log output function  152 , the log (access log) to execute the process of relaying the message recorded by the gateway device  100  in the memory  103  is recorded in the uncompressed log tile  160  or the compressed log file  161  stored in the disk device  104 . According to the log retrieval function  153 , the uncompressed log file  160  or the compressed log file  161  stored in the disk device  104  is retrieved at the request of the client  120  or the manager. 
         [0046]    The identification table  154  holds the log acquisition mode for each protocol. The log output mode management table  155  holds the log output mode for each session. The log output address setting table  156  holds the memory region information for outputting the log to the memory  103 . The log output management table  157  holds the management information for the traffic relay function  150  to output the access log to the memory  103 . 
         [0047]    Each program for realizing the traffic relay function  150 , the protocol analysis function  151 , the log output function  152  and the log retrieval function  153  may be stored in the disk device  104  of the computer or, if required, may be introduced into the disk device  104  from other devices through the input/output unit  102 , the NW I/F  104  and a medium usable by the computer. 
         [0048]    The medium is, for example, a recording medium mountable on and demountable from the input/output unit  102  or the NW  1 /F  104  or a communication medium (i.e. a wired, wireless or optical network  110  or a carrier or a digital signal propagating through the network  110 ). 
         [0049]      FIGS. 2 to 5  show the information contained in the gateway device.  FIGS. 6 and 7  show an example of the configuration of the access log record and the access log file.  FIG. 8  shows an example of the flow of the process executed by the gateway device to relay the request from the client to the server using the SyncML (Synchronization Markup Language) protocol.  FIGS. 9 to 14  show an example of the flow of the relay process, the access log output process and the retrieval process executed by each function of the gateway device. 
         [0050]      FIG. 2  shows an example of the log output mode management table  155  held by the gateway device  100 . A session number column D 11  stores the acceptance number for the gateway device  100  to accept the request from the client  120  to the server  130 . A protocol name column D 12  stores the protocol type of the message. A message type column D 14  stores the message type of the session. A setting mode column D 13  stores the access log acquisition mode designated for the session. 
         [0051]    This embodiment defines three modes including an “all” mode for acquiring all the logs in uncompressed form, a “custom” mode for acquiring a part of the logs in compressed from, and a “minimum” mode for acquiring another part of the logs in compressed form in addition to the logs acquired in custom mode. 
         [0052]    In “all” mode, all the logs are acquired in uncompressed form. Although the data size of the log is increased, the overhead for retrieving the logs held is decreased. 
         [0053]    In “minimum” mode, the log is acquired by compressing many data. Although the log data size is small, the overhead for retrieving the log held is high. 
         [0054]    In “custom” mode, the log data size is smaller than in “all” mode and larger than in “minimum” mode. Also, the overhead for retrieving the log held is larger than in “all” mode and smaller than in “minimum” mode. 
         [0055]    In “minimum” mode, the log to be retrieved is acquired in uncompressed form and the log not to be retrieved is compressed. In retrieving the log held, for example, the policy is adopted to add the busy message and not to retrieve the log of the initialization message (analysis not required), and the traffic relay function  150  acquires the logs other than these two messages in uncompressed form. 
         [0056]    Similarly, in “custom” mode, the log to be retrieved is acquired in uncompressed form and the log not to be retrieved is compressed. However, there are more types of logs (acquired in uncompressed form) to be retrieved than those designated in “minimum” mode. The policy is adopted, for example, not to retrieve the logs of the busy message (analysis not required), and the logs other than the busy message are acquired in uncompressed form by the traffic relay function  150 . 
         [0057]    The manager designates the log acquisition method of each mode as the log acquisition mode D 23  shown in  FIG. 3  (identification table) in units of protocol or message. 
         [0058]      FIG. 3  shows an example of the identification table  154  held by the gateway device  100 . The protocol name column D 21  stores the name of the protocol used between the client  120  and the server  130 . The message type column D 22  stores the message type for the particular protocol. The log acquisition mode column D 23  is configured of an “all” column D 231 , a “custom” column D 232  and a “minimum” column D 233 . The “all” column D 231  stores therein the log acquisition method for compressed or uncompressed form while the log acquisition mode is the “all” mode. The “custom” column D 232  stores therein the log acquisition method for the compressed or uncompressed form while the log acquisition mode is the “custom” mode. The “minimum” column D 233  stores therein the log acquisition method for compressed or uncompressed form while the log acquisition mode is the “minimum” mode. 
         [0059]      FIG. 4  shows an example of the log output address setting table  156  held by the gateway device  100 . A compression head address column D 41  stores therein the candidates of the head address used in the case where the access log to be output in compressed form is stored in the memory  103  of the gateway device  100 . A compression memory size column D 42  stores therein the memory size to be output in compressed form. An uncompressed head address column D 43  stores therein the candidates of the head address in the case where the access log to be output in uncompressed from is stored in the memory  103  of the gateway device  100 . An uncompressed memory size column D 44  stores therein the memory size to be output in uncompressed form. 
         [0060]    Each value in the identification table  154  and the log output address setting table  156  is initialized at the time of activating the traffic relay function  150 . 
         [0061]      FIG. 5  shows an example of the log output management table  157  held by the gateway device  100 . A compression offset address column D 51  stores therein the offset address used in the case where the access log to be output in compressed form is stored in the memory  103  of the gateway device  100 . An uncompressed offset address column D 52  stores therein the offset address used in the case where the access log to be output in uncompressed form is stored in the memory  103  of the gateway device  100 . A compressed head address column D 53  stores therein the head address used in the case where the access log to be output in compressed form is stored in the memory  103  of the gateway device  100 . An uncompressed head address column D 54  stores therein the head address used in the case where the access log to be output in uncompressed form is stored in the memory  103  of the gateway device  100 . 
         [0062]      FIG. 6  shows an example of the data format employed in the case where the access log recorded in the memory  103  is output by the log output function  152  to the disk device  104  as an uncompressed log file  160  or a compressed log file  161 . 
         [0063]    The uncompressed log file  160  or the compressed log file  161  is configured of an access log file name D 701 , an access log output time D 702 , an access log record number D 703  and at least one access log record D 704 - n.    
         [0064]      FIG. 7  shows an example of the data format of the access log record D 704 - n  output to the memory  103  by the traffic relay function  150 . The access log record D 704 - n  is configured of a traffic relay server number D 601  indicating a process identifier for identifying the program to operate the traffic relay function  150  that has output the record, a session number D 602  indicating the acceptance number of the request from the client  120  to the server  130 , a HTTP response code D 603  indicating an error state added to the response message from the server  130 , an error number D 604  indicating an error code given as a response to the client by the traffic relay function  150 , a client terminal address D 605  for specifying the transmitter of the request received, a request transfer destination address D 606  for specifying the request transfer destination, a request URL D 607  indicating the acquirer of the content of the request, a request receiving time D 608  indicating the time when the request is received from the client  120 , a response receiving time D 609  indicating the time when the response message is received from the server  130 , a request header size D 610  indicating the header size of the request received from the client  120 , a request data size D 611  indicating the data size of the request received from the client  120 , a response header size D 612  indicating the size of the header of the response message received from the server  130 , and a response data size D 613  indicating the size of the response message received from the server  130 . 
         [0065]      FIG. 8  shows an example of the flow of the process executed by the gateway device  100  to relay the request from the client  120  to the server  130 . An explanation is given here about a case using the SyncML protocol. 
         [0066]    According to the SyncML protocol, the messages including the initialization request M 200  and the synchronization request M 204  are transmitted and received in that order to synchronize the data in the communication between the client  120  and the server  130 . 
         [0067]    The traffic relay function  150  of the gateway device  100 , using the information designated in the session number column D 11 , the protocol name column D 12 , the message type column  14  and the setting mode column D 13  of the log output mode management table  155 , accesses the record having the same protocol name column D 21  and the same message type column D 22  of the identification table  154 , and determines the log acquisition method in the log acquisition mode designated in the setting mode column D 13  of the log output mode management table  155 . 
         [0068]    Now, an explanation is given about an example of the process executed by the traffic relay function  150  of the gateway device  100  to relay the initialization request M 204  or the synchronization request M 204  of the SyncML protocol from the client to the server. 
         [0069]    The initialization request M 200  for data synchronization is transmitted by the client  120  and received by the gateway device  100  (S 101 ). The traffic relay function  150  of the gateway device  100  transmits the received request M 201  to the server  130  (S 102 ). 
         [0070]    The server  130 , after receiving the initialization request M 201  for data synchronization, transmits the initialization response M 202  for data synchronization containing the result (status code) of processing the request, and the gateway device  100  received the initialization response M 202  (S 103 ). 
         [0071]    The traffic relay function  150  of the gateway device  100  transmits the response M 203  corresponding to the received response M 202  to the client  120  (S 104 ). 
         [0072]    The client  120 , after receiving the initialization response M 203  for data synchronization, transmits the request M 204  including the data to he synchronized and the synchronization request, which request M 204  is received by the gateway device  100  (S 105 ). 
         [0073]    The traffic relay function  150  of the gateway device  100  transmits the request M 205  corresponding to the received M 204  to the server  130  (S 106 ). 
         [0074]    The server  130 , after receiving the request M 205  including the data to be synchronized and the synchronization request, transmits the response M 206  including the synchronization result (status code), which request M 205  is received by the gateway device  100  (S 107 ). In this case, the server is in busy state, and therefore, the status code of the response M 206  is  101  indicating the busy state. 
         [0075]    The traffic relay function  150  of the gateway device  100  transmits the response M 207  corresponding to the received response M 206  to the client (S 108 ). 
         [0076]    The client  120 , after receiving the response M 207  having the status of  101  indicating the busy state, transmits the request M 208  including the data to be synchronized and the synchronization request again, which request M 208  is received by the gateway device  100  (S 109 ). 
         [0077]    The traffic relay function  150  of the gateway device  100  transmits the request M 209  corresponding to the received request M 208  to the server  130  ( 5110 ). 
         [0078]    The server  130 , after receiving the request M 209  including the data to be synchronized and the synchronization request, transmits the response M 210  including the synchronization result (status code), which response M 210  is received by the gateway device  100  (S 111 ). 
         [0079]    The traffic relay function  150  of the gateway device  100  transmits the response M 211  corresponding to the received response M 210  to the client  120  (S 112 ). 
         [0080]      FIG. 9  is a flowchart showing the processing steps of the traffic relay process executed by the traffic relay function  150  of the gateway device  100 . 
         [0081]    The traffic relay function  150  of the gateway device  100  receives the request from the client  120  (F 101 ). In the process, the traffic relay function  150  allocates the session number as a request acceptance number. In the case where the session for the previous access to the same server is held, however, a new session number is not allocated. Next, the protocol analysis function  151  of the gateway device  100  analyzes the received request (F 102 ). Then, the traffic relay function  150  transmits the request to the server  130  (F 103 ). 
         [0082]      FIG. 10  is a flowchart showing the detailed step (F 102  in  FIG. 9 ) for analyzing the request received from the client  120  by the protocol analysis function  151 . 
         [0083]    The protocol analysis function  151  of the gateway device  100  sets different information in the log output mode management table  155  according to whether the previous session is held or not (including a new session) at the time of receiving the request from the client  120 . The flowchart of  FIG. 10  shows these steps. 
         [0084]    First, the protocol analysis function  151  searches the session number column D 11  of the log output mode management table  155  for the session number for the request which may have been received from the client (F 201 ). 
         [0085]    In the case where such a session number is found to exist in step F 201 , the protocol name and the message type obtained by analyzing the received request and the initial setting mode designated by the manager are registered in the record of the log output mode management table  155  by the protocol analysis function  151  (F 202 ). 
         [0086]    In the case where such a session number is not found to exist in step F 201 , on the other hand, the session number, the protocol name and the message type obtained by analyzing the received request and the initial setting mode designated by the manager are registered in the new record of the log output mode management table  155  by the protocol analysis function  151  (F 203 ). 
         [0087]      FIG. 11  is a flowchart showing the steps of the traffic relay process in which the traffic relay function  150  of the gateway device  100  receives the response from the server  130  and transmits it to the client  120 . 
         [0088]    The traffic relay function  150  of the gateway device  100  receives the response from the server  130  (F 301 ). 
         [0089]    Next, the traffic relay function  150  outputs to the memory  103  the request received from the client  120  and the access log for the response received from the server  130  (F 302 ). 
         [0090]    Then, the traffic relay function  150  transmits the response received from the server  130  to the client  120  (F 303 ). 
         [0091]      FIG. 12  is a flowchart showing the detailed step (F 302  in  FIG. 11 ) for outputting the access log to the memory  103  at the time when the traffic relay function  150  receives the response from the server  130 . 
         [0092]    The traffic relay function  150  retrieves the record in which the value recorded in the session number column of the log output mode management table  155  coincides with the present session number (F 401 ). 
         [0093]    In the case where the retrieval in step F 401  is successful, the traffic relay function  150  acquires the setting mode designated in the setting mode column D 13  and the protocol name designated in the protocol name column D 12  of the same record of the log output mode management table  155  (F 403 ). 
         [0094]    Then, the traffic relay function  150 , by accessing the identification table  154 , obtains the log acquisition mode using the setting mode, the protocol name and the message type (F 404 ). 
         [0095]    The traffic relay function  150  acquires the offset address designated in the log output management table  157  and the memory size designated in the log output address setting table  156 , calculates the total value of the output access log record size and the offset address, and thus determines whether the total value is less than the memory size or not (F 405 ). 
         [0096]    In the case where the total value of the output access log record size and the offset address is less than the memory size, the traffic relay function  150  records the access log in the address value of the memory  103  obtained from the total of the offset address and the head address of the log output management table  157  (F 406 ). 
         [0097]    In the case where the record cannot he retrieved in step F 401 , the traffic relay function  150  designates the log output setting mode as uncompressed and proceeds to step F 405  (F 407 ). 
         [0098]    In the case where the total value of the access log record size and the offset address is not less than the memory size in step F 405 , on the other hand, the traffic relay function  150  updates the offset address of the log output management table  157  to  0  and the head address to the other head address designated in the log output address setting table  156 . 
         [0099]    Then, the traffic relay function  150  notifies the log output function  152  that the log recording memory is filled up (F 408 ). Specifically, the offset address and the head address with the access log recorded therein are notified. 
         [0100]      FIG. 13  is a flowchart showing the steps of the process executed by the log output function  152  of the gateway device  100  to output the access log in the log recording region on the memory  103  to the uncompressed log file  160  or the compressed log file  161  of the disk device  104 . 
         [0101]    The log output function  152  of the gateway device  100  receives the notification from the traffic relay function  150  that the log recording memory is filled up (F 501 ). 
         [0102]    Next, the log output function  152 , based on the head address and the offset address received, outputs to the disk device  104  the access log recorded in the particular address region (F 502 ). In the case of the log for compression, the log output function  152  outputs the log in compressed form. 
         [0103]    According to this embodiment, the log is compressed collectively at the time of outputting to the disk device  104 . Nevertheless, the access log may alternatively be compressed at the time of being recorded temporarily in the memory  103  by the traffic relay function  150 . 
         [0104]      FIG. 14  is a flowchart showing the steps of the process in which the log retrieval function  153  of the gateway device  100  retrieves the uncompressed log file  160  or the compressed log file  161  recorded in the disk device  104 . 
         [0105]    The log retrieval function  153  reads the uncompressed log file  160  recorded in the disk device  104  (F 601 ). 
         [0106]    Next, the log retrieval function  153  retrieves the access log file  160  with the character string designated by the client  120  or the manager as a search key (F 602 ). 
         [0107]    As the result of retrieval by the log retrieval function  153  in step F 602 , it is determined whether the log to be retrieved is found or not in the uncompressed log file  160  (F 603 ). 
         [0108]    In the case where the log to be retrieved is so found, the log retrieval function  153  displays the retrieval result on the input/output unit  102  of the gateway device  100  (F 605 ). 
         [0109]    In the case where the log to be retrieved is found, on the other hand, the log retrieval function  153  searches the compressed log file  161  (F 604 ). 
         [0110]    After that, the retrieval result is displayed on the input/output unit  102  of the gateway device  100  (F 605 ). 
         [0111]    In the method according to this embodiment, the log acquisition mode corresponding to the protocol or the message can be designated, and the gateway device  100  can acquire the log to be retrieved in uncompressed form. Therefore, the log retrieval time can be shortened. Also, since the data amount of the data to be retrieved is decreased, the log data size can be decreased. 
         [0112]    Also, the access log less liable to be retrieved may be recorded in compressed form to reduce the access log amount. 
         [0113]    According to this embodiment, the system is so configured that the disk device  104  is included in the gateway device  100 . As an alternative, the system may be so configured that the disk device  104  is coupled to the gateway device  100  as a storage device. 
         [0114]    Further, according to this embodiment, the log retrieval function  153  is operated by the gateway device  100 . As long as the system is so configured that the uncompressed log file  160  and the compressed log file  161  are accessible from the log retrieval function  153 , however, the log retrieval function  153  may alternatively be implemented by a device other than the gateway device  100 . 
         [0115]    The second embodiment represents a technique to change the log acquisition mode dynamically by confirming the content of the response to the request from the client in addition to the method of recording the access log in accordance with the designation of the log acquisition mode by the manager as described in the first embodiment. The explanation that follows is concentrated mainly on the difference from the first embodiment. 
         [0116]      FIG. 15  shows an example of the system configuration having a conversion table  158  in addition to the example of the system configuration shown in  FIG. 1 . The conversion table  158  is stored in the memory  103  of the gateway device  100 . 
         [0117]      FIG. 16  shows an example of the conversion table  158  held by the gateway device  100 . The protocol name column D 31  stores therein the name of the protocol of the message transmitted/received between the client  120  and the server  130 . The response code column D 32  stores therein the response code of the particular protocol. The change mode column D 33  stores therein the mode name after change of the log acquisition mode for the response code of the protocol. 
         [0118]      FIG. 17  is a flowchart showing the detailed step (F 302  in  FIG. 11 ) for outputting the access log when the traffic relay function  150  receives the response from the server  130 . 
         [0119]    The difference of the flowchart shown in  FIG. 17  from the flowchart shown in  FIG. 12  is explained below. 
         [0120]    In the case where the retrieval in step F 401  is successful, the traffic relay function  150  acquires the response code in the response message (F 402 ). 
         [0121]    In the case where the response code is obtained in step F 402 , the traffic relay function  150  acquires the setting mode designated in the setting mode column D 13  and the protocol name designated in the protocol name column D 12  of the record of the log output mode management table  155  (F 403 - 1 ). 
         [0122]    Next, the traffic relay function  150  acquires the contents of the protocol name column D 31  and the response code column D 32  of the conversion table  158  on the one hand and the mode of the change mode column D 33  in which the particular protocol name and the response code are described in the same record. This mode is compared with the mode designated in the setting mode column D 13  of the session record of the log output mode management table  155  (F 409 ). 
         [0123]    In the case where the modes compared with each other in step F 409  are different from each other, the traffic relay function  150  writes the contents of the setting mode column D 13  of the session record of the log output mode management table  155  over the mode of the change mode column D 33  of the same record of the conversion table  158 . Then, the traffic relay function  150  proceeds to step F 404  (F 410 ). 
         [0124]    In the case where the comparison shows that the modes are the same in step F 409 , on the other hand, the traffic relay function  150  proceeds to step F 404 . 
         [0125]    Also, in the case where the record fails to be retrieved in step F 401  or the response code fails to be acquired in step F 402 , the traffic relay function  150  designates the setting mode of the log output as uncompressed, and proceeds to step F 405  (F 407 ). 
         [0126]    The subsequent process is identical with the process shown in  FIG. 12 . 
         [0127]    According to this embodiment, the content of the response from the server  130  is confirmed, and in accordance with the content of the response, the access log acquisition mode is dynamically changed. As a result, the access log liable to be retrieved can be recorded in uncompressed form. 
         [0128]    According to this embodiment, the access log can be retrieved without accessing the compressed access log file, and therefore, the retrieval time can be shortened. 
         [0129]    The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. It will, however, be evident that various modifications and changes may he made thereto without departing from the spirit and scope of the invention as set forth in the claims.