Abstract:
A non-transitory computer-readable recording medium recoding a log obtaining program that causes a computer to execute processing, the processing includes: obtaining first log data including request source identification information which is used for identifying a request, a response time period related to the request, and a first log record time, from among a plurality of log data included in an access log recorded in a storage; extracting second log data including a second log record time corresponding to a time that is early by the response time period as compared with the first log record time included in the first log data, from among the plurality of log data; and obtaining third log data including the request source identification included in the first log data from among the second log data.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2016-131932, filed on Jul. 1, 2016, the entire contents of which are incorporated herein by reference. 
       FIELD 
       [0002]    The embodiments discussed herein are related to a computer-readable recording medium recoding a log obtaining program, a log obtaining device, and a log obtaining method. 
       BACKGROUND 
       [0003]    A plurality of log data recorded in a transaction log for each tenant is provided on a cloud system. 
         [0004]    As a related art, Japanese National Publication of International Patent Application No. 2014-502767 is discussed. 
       SUMMARY 
       [0005]    According to an aspect of the embodiments, a non-transitory computer-readable recording medium recoding a log obtaining program that causes a computer to execute processing, the processing includes: obtaining first log data including request source identification information which is used for identifying a request, a response time period related to the request, and a first log record time, from among a plurality of log data included in an access log recorded in a storage; extracting second log data including a second log record time corresponding to a time that is early by the response time period as compared with the first log record time included in the first log data, from among the plurality of log data; and obtaining third log data including the request source identification included in the first log data from among the second log data. 
         [0006]    The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. 
         [0007]    It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0008]      FIG. 1  is an example of a block illustrating obtaining processing of an access log; 
           [0009]      FIG. 2  is an example of a block illustrating obtaining processing of an access log; 
           [0010]      FIG. 3  illustrates a configuration of a log obtaining system; 
           [0011]      FIG. 4  is an example of a functional block illustrating a log obtaining device; 
           [0012]      FIG. 5  is an example of a log storage destination table; 
           [0013]      FIG. 6  is an example of an IP address of each device; 
           [0014]      FIG. 7  is an example of a data table; 
           [0015]      FIG. 8  is an example of a flag table; 
           [0016]      FIG. 9  is an example of an access log; 
           [0017]      FIG. 10  is an example of an access log; 
           [0018]      FIG. 11  is an example of transmission log data; 
           [0019]      FIG. 12  is an example of transmission log data; 
           [0020]      FIG. 13  is an example of a configuration illustrating a computer; and 
           [0021]      FIG. 14  is an example of log obtaining processing. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0022]    For example, from among a plurality of log data recorded in a transaction log for each tenant, specific log data is obtained using request identification information by which a request of a transaction ID or the like is identified. The obtained log data is written to a log database for each of the tenants. 
         [0023]    For example, an access log stored in a storage unit of a device in a system is obtained and analyzed. For example, log data included in the access log are analyzed and cyber attack or the like on the system is detected. 
         [0024]    For obtaining processing in which specific log data such as log data including request identification information is obtained from an access log in which a huge amount of log data is recorded, a relatively long time is taken. Due to the time taken for the obtaining processing, real-time performance of log data analysis may be reduced. 
         [0025]      FIGS. 1 and 2  illustrate examples of blocks to explain obtaining processing of an access log. In  FIG. 1 , as an example, an environment is illustrated in which a private environment  10  and a cloud system  12  such as a public cloud are coupled to each other through a network  14  such as the Internet. The private environment may include, for example, environments such as an on-premise and a private cloud. 
         [0026]    As illustrated in  FIG. 1 , in the private environment  10 , an operation system  16 A is built. The operation system  16 A includes a plurality of devices  20 A each of which includes a storage unit that stores an access log  18 A, and a log obtaining device  22 A that obtains the access log  18 A. As the devices  20 A, for example, a load balancer (LB), a firewall (FW), a server computer, a virtual machine, or the like, may be used. In the private environment  10 , a log analysis device  24 A is provided in addition to the operation system  16 A. 
         [0027]    In the cloud system  12 , an operation system  16 B is built. The operation system  16 B includes a plurality of devices  20 B each of which includes a storage unit that stores an access log  18 B, and a log obtaining device  22 B that obtains the access log  18 B, similar to the operation system  16 A of the private environment  10 . In the following description, the alphabets at the ends of the symbols are omitted when elements are collectively referred to without distinction between the operation systems  16 A and  16 B, the access logs  18 A and  18 B, the devices  20 A and  20 B, and the log obtaining devices  22 A and  22 B. 
         [0028]    When an access log  18  is analyzed by the log analysis device  24 A to analyze an access to the operation system  16 , an access log  18 B is obtained from the device  20 B by the log obtaining device  22 B, and transmitted to the log analysis device  24 A through the network  14 . For example, in the network  14  such as the Internet, the transfer speed is slow as compared with an internal network of the private environment  10  such as a local area network (LAN), and a relatively long time is taken for transmission of the access log  18 B. Therefore, the real-time performance of analysis of the access log  18  by the log analysis device  24 A may be reduced. 
         [0029]    For example, there is a case in which pay-per-use in accordance with a transfer amount of data is performed in the cloud system  12  such as a public cloud. In this case, as a transfer amount of data of the access log  18 B transmitted from the cloud system  12  to the private environment  10  through the network  14  becomes larger, the cost becomes higher. 
         [0030]    For example, when the type, the range, and the like, of the access log  18 B that is a collection target are limited, the transfer amount of the access log  18 B from the cloud system  12  to the private environment  10  may be reduced. For example, in such a method, when cyber attack is performed on a device  20 B that is not the collection target of the access log  18 B, the cyber attack may not be detected, and the effect of the cyber attack may not be analyzed. 
         [0031]    For example, as illustrated in  FIG. 2 , when a log analysis device  24 B similar to the log analysis device  24 A is provided in the cloud system  12 , a transfer amount of the access log  18 B from the cloud system  12  to the private environment  10  may be reduced. For example, in such a method, the two log analysis devices  24  are provided and, therefore, the cost may increase. For example, when the log analysis device  24  is a hardware appliance product, or when the performance of a virtual machine usable in the public cloud does not satisfy the performance requirement of the log analysis device  24 , such a method is not applied. 
         [0032]    For example, when the obtaining range of log data is limited from a plurality of log data included in an access log based on response time periods included in the log data, an obtaining time period of the log data may be reduced. 
         [0033]      FIG. 3  illustrates an example of a configuration of a log obtaining system. As illustrated in  FIG. 3 , a log obtaining system  30  includes a client environment  32 , a cloud system  34 , and a private environment  36 . Devices provided in the client environment  32 , the cloud system  34 , and the private environment  36  are coupled to each other and able to communicate with each other through a network  38  such as the Internet. 
         [0034]    In the client environment  32 , a plurality of client terminals  33  (hereinafter simply referred to as “terminals  33 ”) is provided. 
         [0035]    In the cloud system  34 , an operation system  40  is built. The operation system  40  includes an LB  42 , FWs  44 A and  44 B, application (AP) servers  46 A and  46 B, database (DB) servers  48 A and  48 B, and a log obtaining device  50 . In the following description, the alphabets at the ends of the symbols are omitted when elements are collectively referred to without distinction between the FWs  44 A and  44 B, the AP servers  46 A and  46 B, and the DB servers  48 A and  48 B. Between the devices of the LB  42 , the FW  44 , the AP server  46 , the DB server  48 , and the log obtaining device  50 , the times of the devices may be synchronized using a network time protocol (NTP) or the like. 
         [0036]    The LB  42  distributes the load on the FW  44 , the AP server  46 , and the DB server  48  due to an access from the outside of the operation system  40 , such as the terminal  33 . A certain storage area of a storage unit included in the LB  42  stores an access log  52 A in which log data indicating an access to the LB  42  is recorded. 
         [0037]    In accordance with a set rule, through the FW  44 , inbound and outbound communications are caused to pass and are blocked. Certain storage areas of storage units included in the FWs  44 A and  44 B respectively store access logs  52 B and  52 C in which log data indicating accesses to the FWs  44 A and  44 B are recorded. 
         [0038]    In the AP servers  46 , web applications that respectively access DBs  54 A and  54 B operate, for example, on a web application server program. Certain storage areas of storage units included in the AP servers  46 A and  46 B respectively store access logs  52 D and  52 E in which log data indicating accesses to the AP servers  46 A and  46 B are recorded. 
         [0039]    Certain storage areas of storage units included in the DB servers  48 A and  48 B respectively store the DBs  54 A and  54 B that store various data including specific data defined in advance as important data (hereinafter referred to as “important data”). The certain storage areas of the storage units respectively store access logs  56 A and  56 B in which log data indicating accesses to the DBs  54 A and  54 B are recorded. 
         [0040]    In the following description, the alphabets at the ends of the symbols are omitted when elements are collectively referred to without distinction between the access logs  52 A,  52 B,  52 C,  52 D, and  52 E, the DBs  54 A and  54 B, and the access logs  56 A and  56 B. 
         [0041]    The LB  42  and each of the FWs  44 A and  44 B are coupled to each other through a network such as a LAN and able to communicate with each other. The FW  44 A and the AP server  46 A are coupled to each other through the network and able to communicate with each other. The FW  44 B and the AP server  46 B are coupled to each other through the network and able to communicate with each other. The AP servers  46 A and  46 B and the DB servers  48 A and  48 B are coupled to each other through the network and able to communicate with each other. 
         [0042]    The log obtaining device  50  is coupled to the network and able to obtain the access log  52  and the access log  56 . The log obtaining device  50  obtains specific log data from the access log  52  and the access log  56  and transmits the obtained log data to a log analysis device  62  through the network  38 . The number of LBs  42 , FWs  44 , AP servers  46 , DB servers  48 , and log obtaining devices  50  and the connection configuration are examples, and are not limited to the example of  FIG. 3 . 
         [0043]    In the private environment  36 , an operation system  60  similar to the operation system  40  of the cloud system  34  is built. In the private environment  36 , the log analysis device  62  is provided that receives the specific log data transmitted from the log obtaining device  50  and analyzes the received log data. 
         [0044]      FIG. 4  illustrates an example of a functional block of the log obtaining device. As illustrated in  FIG. 4 , the log obtaining device  50  includes a detection unit  70 , an extraction unit  72 , an obtaining unit  74 , and a transmission unit  76 . In addition, a certain storage area of the log obtaining device  50  stores a log storage destination table  78 . 
         [0045]      FIG. 5  illustrates an example of the log storage destination table. As illustrated in  FIG. 5 , the log storage destination table  78  stores a “device IP” and a “storage path”. The “device IP” stores an IP address of a device in which the access log  52  or the access log  56  is stored in the operation system  40 . The “storage path” stores a path of a storage destination of the access log.  FIG. 6  illustrates an example of an IP address of each of the devices. As an example, as illustrated in  FIG. 6 , the IP address of the AP server  46 A is “AA:AA:AA:AA”, and the IP address of the AP server  46 B is “BB:BB:BB:BB”. The IP address of the FW  44 A is “CC:CC:CC:CC”, and the IP address of the FW  44 B is “DD:DD:DD:DD”. The IP address of the LB  42  is “EE:EE:EE:EE”. 
         [0046]    For example, in the example of  FIG. 5 , it is indicated that the access log  52 D of the AP server  46 A the IP address of which is “AA:AA:AA:AA” is stored in “/etc/conf/aa.log”. 
         [0047]    The detection unit  70  detects an access to important data stored in the DB  54 , based on the access log  56  and data stored in the DB  54 . Detection processing in which an access to the important data is detected by the detection unit  70  is described with reference to  FIGS. 7 to 9 . 
         [0048]      FIG. 7  illustrates an example of a data table.  FIG. 8  illustrates an example of a flag table. The tables illustrated in  FIGS. 7 and 8  may be stored in the DB  54 . As illustrated in  FIG. 7 , a data table  80  stores a “data number”, a “data content”, and a “department name”. The “data number” stores a number by which each data is uniquely identified. The “data content” stores a content of the data. The “department name” stores the name of a department that handles the content of the data stored in the “data content”. 
         [0049]    As illustrated in  FIG. 8 , a flag table  82  stores a “department name” and an “importance degree flag”. The “department name” of the flag table  82  stores information similar to the “department name” of the data table  80 . The “importance degree flag” stores information indicating whether the content of data handled by the department stored in the “department name” is important. For example, data handled by a department in the “department name” in which the “importance degree flag” indicates “True” may be important data, and data handled by a department in the “department name” in which the “importance degree flag” indicates “False” may be unimportant data. For example, in  FIGS. 7 and 8 , data the data number of which is “000002” may be important data. 
         [0050]    For example, the important data includes data set by the user as data that is an analysis target of an access log. Determination of whether the data is important data based on a department name is an example, and the embodiment is not limited to such an example. 
         [0051]      FIG. 9  illustrates an example of an access log.  FIG. 9  illustrates an example of an access log  56  in a format in which information used for the above-described detection processing is normalized in order to avoid complication. As illustrated in  FIG. 9 , the access log  56  records a “communication ID”, a “communication type”, a “log record time”, a “request source IP”, and a “target data number”. 
         [0052]    The “communication ID” stores request identification information by which a request from the outside of the operation system  40  such as the terminal  33  is uniquely identified. The same “communication ID” is stored in the access log  52  and the access log  56  for a series of communications from a request to a response to the terminal  33 , for example, when the request from the terminal  33  to the operation system  40  is issued. 
         [0053]    For example, the “communication type” stores whether the communication type is “Request” or “Response”. The “log record time” stores a date and time at which log data corresponding to “request” or “response” is recorded in the access log  56  after the occurrence of the “request” or “response”. For example, in the “log record time”, merely a time may be stored. 
         [0054]    The “request source IP” stores an IP address of a device that is a request source when the communication type is “Request”. The “target data number” stores a data number of accessed data of the data table  80 . 
         [0055]    The detection unit  70  periodically refers to the access log  56 , and obtains a target data number of log data the communication type of which is “Request” when the log data is recorded in the access log  56 . The detection unit  70  refers to the data table  80 , and obtains a department name having a data number corresponding to the obtained target data number. The detection unit  70  refers to the flag table  82 , and detects whether access to important data has been made depending on whether the importance degree flag having a department name corresponding to the obtained department name is “True”. 
         [0056]    When the detection unit  70  detects that access to important data has been made, the detection unit  70  outputs log data corresponding to the access recorded in the access log  56  to the extraction unit  72  and the obtaining unit  74 . For example, in  FIG. 9 , the detection unit  70  outputs log data the communication ID of which is “AAAA”, to the extraction unit  72  and the obtaining unit  74 . 
         [0057]    When the log data is input to the extraction unit  72  from the detection unit  70 , the extraction unit  72  refers to the log storage destination table  78 , and obtains an access log  52  stored in a storage path corresponding to a request source IP of the log data from a device indicated by the request source IP. The extraction unit  72  extracts log data from the obtained access log  52 , based on a log record time of the log data input from the detection unit  70 . Extraction processing of log data by the extraction unit  72  is described below with reference to  FIG. 10 . 
         [0058]      FIG. 10  illustrates an example of an access log.  FIG. 10  illustrates an example of an access log  52 D in a format in which information used for the above-described extraction processing is normalized, in order to avoid complication. As illustrated in  FIG. 10 , the access log  52 D stores a “communication ID”, a “communication type”, a “log record time”, a “request source IP”, and a “response time period”. In  FIG. 10 , an example of the access log  52 D is illustrated, but log data similar to the access log  52 D may also be stored in the access logs  52 A to  52 C, and  52 E. 
         [0059]    The “communication ID”, the “communication type”, the “log record time”, and the “request source IP” respectively store information similar to the “communication ID”, the “communication type”, the “log record time”, and the “request source IP” of the access log  56 . The “response time period” stores a time taken from the request to the response. 
         [0060]    The extraction unit  72  identifies log data  86  including the same communication ID as the communication ID of the log data input from the detection unit  70 , from among log data  84  recorded in the access log  52 D on and after the log record time of the input log data. In order to identify a log of a response from the DB server  48 , which has been recorded in the access log  52 D, as described above, a range in which the log data  86  is identified is limited to the time after the above-described log record time. 
         [0061]    The extraction unit  72  extracts log data  88  including a log record time corresponding to a time that is earlier by a response time period included in the identified log data  86  as compared with the log record time included in the log data  86 , from among the log data included in the access log  52 D. 
         [0062]    In  FIG. 10 , the extraction unit  72  extracts log data  88  recorded at “11:59:59” obtained by subtracting “3000 ms” (=3 seconds) that is the response time period included in the log data  86  from “12:00:02” that is the log record time included in the log data  86 . 
         [0063]    The obtaining unit  74  obtain log data  90  including the same communication ID as the communication ID included in the log data  86 , from among the log data  88  extracted by the extraction unit  72 . 
         [0064]    The extraction unit  72  obtains an access log  52  stored in a storage path corresponding to a request source IP included in the log data  90  obtained by the obtaining unit  74 , from a device of the request source IP to execute the above-described extraction processing. The extraction unit  72  repeats the above-described extraction processing until the access log  52  that is an extraction target becomes the access log  52 A of the most upstream device of the communication path, for example, the access log  52 A of the LB  42 . 
         [0065]    Similarly, the obtaining unit  74  repeatedly executing the above-described obtaining processing of the log data  90  for log data  88  repeatedly extracted by the extraction unit  72 . 
         [0066]    The transmission unit  76  generates transmission log data  92  in which the log data input from the detection unit  70 , the log data  86 , and the log data  90  are arranged in chronological order, and to which information indicating a device that is an output source of each of the log data has been assigned. The transmission unit  76  transmits the generated transmission log data  92  to the log analysis device  62  through the network  38 . 
         [0067]      FIG. 11  illustrates an example of the transmission log data. As illustrated in  FIG. 11 , the transmission log data  92  stores a “communication ID”, a “communication type”, a “log record time”, a “request source IP”, a “target data number”, a “response time period”, and an “output source device”. Each of the “communication ID”, the “communication type”, the “log record time”, the “request source IP”, the “target data number”, and the “response time period” stores information similar to the corresponding information stored in at least one of the access log  52  and the access log  56 . The “output source device” stores an IP address of a device that is an output source of each of the log data as information indicating the device that is the output source. 
         [0068]    In the example of  FIG. 11 , the transmission log data  92  stores log data of the request and the response related to a series of the communications of the LB  42 , the FW  44 A, the AP server  46 A, and the DB server  48 B provided in the communication path, as illustrated in the example of  FIG. 12 . 
         [0069]      FIG. 13  illustrates an example of a configuration of a computer. The log obtaining device  50  may be obtained, for example, by a computer  100  illustrated in  FIG. 13 . The computer  100  also includes a central processing unit (CPU)  101 , a memory  102  as a temporary storage area, and a nonvolatile storage unit  103 . The computer  100  includes an input/output device  104  including a display device and an input device. The computer  100  also includes a read/write (R/W) unit  105  that controls reading and writing of data for a recording medium  108 , and a network interface (I/F)  106  coupled to a network. The CPU  101 , the memory  102 , the storage unit  103 , the input/output device  104 , the R/W unit  105 , and the network I/F  106  are coupled to each other through a bus  107 . 
         [0070]    The storage unit  103  may be a hard disk drive (HDD), a solid state drive (SSD), a flash memory, or the like. The storage unit  103  as a recording medium stores a log obtaining program  110  that causes the computer  100  to function as the log obtaining device  50 . The log obtaining program  110  includes a detection process  111 , an extraction process  112 , an obtaining process  113 , and a transmission process  114 . The storage unit  103  includes an information storage area  115  that stores the log storage destination table  78 . 
         [0071]    The CPU  101  reads the log obtaining program  110  from the storage unit  103 , deploys the log obtaining program  110  to the memory  102 , and executes the processes included in the log obtaining program  110 . When the CPU  101  executes the detection process  111 , the CPU  101  operates as the detection unit  70  illustrated in  FIG. 4 . When the CPU  101  executes the extraction process  112 , the CPU  101  operates as the extraction unit  72  illustrated in  FIG. 4 . When the CPU  101  executes the obtaining process  113 , the CPU  101  operates as the obtaining unit  74  illustrated in  FIG. 4 . When the CPU  101  executes the transmission process  114 , the CPU  101  operates as the transmission unit  76  illustrated in  FIG. 4 . As described above, the computer  100  that has executed the log obtaining program  110  functions as the log obtaining device  50 . 
         [0072]    A function achieved by the log obtaining program  110  may be executed, for example, by a semiconductor integrated circuit, an application specific integrated circuit (ASIC), or the like. 
         [0073]      FIG. 14  illustrates an example of log obtaining processing. For example, when the log obtaining device  50  executes the log obtaining program  110 , the log obtaining processing illustrated in  FIG. 14  is executed. The log obtaining processing illustrated in  FIG. 14  is executed by the CPU  101 , for example, in a case or the like in which the power source of the log obtaining device  50  is turned on. 
         [0074]    In Operation S 10  of the log obtaining processing illustrated in  FIG. 14 , the detection unit  70  obtains an access log  56  from the DB server  48 . For example, the detection unit  70  obtains log data that are not obtained since the previous execution of the processing of Operation S 10 , from among log data recorded in the access log  56 . 
         [0075]    In Operation S 12 , the detection unit  70  obtains log data each communication type of which is “Request”, from among the log data obtained in Operation S 10 . The detection unit  70  determines whether access to important data has been performed, based on the obtained log data, with reference to the data table  80  and the flag table  82 . When “NO” is determined in Operation S 12 , the processing returns to Operation S 10 , and when “YES” is determined in Operation S 12 , the processing proceeds to Operation S 14 . 
         [0076]    In Operation S 14 , the detection unit  70  extracts log data corresponding to the access to the important data, which has been detected in Operation S 12 , from the log data obtained in Operation S 10 . In Operation S 16 , the extraction unit  72  obtains an access log  52  stored in a storage path corresponding to a request source IP included in the log data extracted in Operation S 14 , from a device indicated by the request source IP, with reference to the log storage destination table  78 . 
         [0077]    When “NO” is determined in Operation S 24 , and the second or subsequent Operation S 14  is executed, the extraction unit  72  obtains an access log  52  by the following processing. For example, in this case, the extraction unit  72  obtains an access log  52  stored in a storage path corresponding to a request source IP included in log data  90  obtained in Operation S 22 , from a device indicated by the request source IP, with reference to the log storage destination table  78 . 
         [0078]    In Operation S 18 , the extraction unit  72  identifies log data  86 , from among log data  84  recorded after the log record time included in the log data extracted in Operation S 14 , in the access log  52  obtained in Operation S 16 . When the second or subsequent Operation S 18  is executed, log data  86  is identified by the following processing. For example, in this case, the extraction unit  72  identifies log data  86  from among the log data  84  recorded after the log record time included in the log data  86  that had been identified in Operation S 18 , in the access log  52  obtained in the previous Operation S 16 . 
         [0079]    In Operation S 20 , the extraction unit  72  extracts log data  88  by the following processing, from among the log data included in the access log  52  obtained in Operation S 16 . For example, the extraction unit  72  extracts log data  88  including a log record time corresponding to a time that is earlier by a response time period included in the log data  86  identified in Operation S 18  as compared with the log record time included in the log data  86 , from among the log data included in the access log  52 . 
         [0080]    In Operation S 22 , the obtaining unit  74  obtains log data  90  including the same communication ID as the communication ID included in the log data  86  identified in Operation S 18 , from among the log data  88  executed in Operation S 20 . 
         [0081]    In Operation S 24 , the obtaining unit  74  determines whether the access log  52  that is a processing target of Operations S 16  to S 22  is an access log  52  of the LB  42 . When “NO” is determined in Operation S 24 , the processing returns to Operation S 16 , when “YES” is determined in Operation S 24 , the processing proceeds to Operation S 26 . 
         [0082]    In Operation S 26 , the transmission unit  76  generates transmission log data  92  using the log data extracted in Operation S 14 , the log data  86  identified in Operation S 18 , and the log data  90  obtained in Operation S 22 . In Operation S 28 , the transmission unit  76  transmits the transmission log data  92  generated in Operation S 26  to the log analysis device  62  through the network  38 . When the processing of Operation S 28  ends, the processing returns to Operation S 10 . 
         [0083]    A reduction effect of a transfer amount of log data by the above-described log obtaining processing is calculated. For example, as an example, a case is estimated in which the number of devices in each of which an access log is stored is 100, and the number of requests is 10000 requests/second. For example, as an example, a case is estimated in which the number of devices related to a single request is 10 that corresponds to 10% of the whole number of devices, and the data capacity of one row of log data recorded in the access log is 0.5 Kbit. For example, as an example, a case is estimated in which the number of request for important data is 1 request/second. 
         [0084]    The number of rows of log data recorded in the access log within one second is calculated by the following formula (1). 
         [0000]      The number of rows of log data=the number of requests/second×the number of servers related to a single request×2(round-trip communication portion)  (1)
 
         [0085]    For example, in the above-described example, the number of rows of the log data is calculated as 200000 rows/second in accordance with the following formula (2). 
         [0000]      10000×10×2=200000  (2)
 
         [0086]    In the above-described example, a transfer amount of log data per second is calculated as 100 Mbit in accordance with the following formula (3). 
         [0000]      200000×0.5=100000 (Kbit)=100 (Mbit)  (3)
 
         [0087]    For example, the number of rows of the log data per second, which is obtained in the above-described obtaining processing, is calculated by the following formula (4). 
         [0000]      The number of rows of the log data=the number of requests/second for important data×the number of device through which the communication has passed×2(round-trip communication portion)  (4)
 
         [0088]    For example, in the above-described example, the number of rows of the log data is calculated as 20 rows/second, in accordance with the following formula (5). 
         [0000]      1×10×2=20  (5)
 
         [0089]    For example, in the above-described example, a transfer amount of the log data per second is calculated as 10 Kbit/second in accordance with the following formula (6). 
         [0000]      20×0.5=10  (6)
 
         [0090]    As described above, in the system having the scale illustrated in the above-described example, when the above-described method is applied, the transfer amount of the log data may be reduced to 1/1000000, as compared with a case in which transfer of all log data recorded in the access log is performed. 
         [0091]    For example, when log data including a communication ID, a response time period, and a log record time is recorded in the access log  52 , the following processing may be executed. log data including a log record time corresponding to a time that is earlier by the response time period as compared with the log record time included in the recorded log data are extracted. From among the extracted log data, log data including the communication ID included in the recorded log data is obtained. As described above, the extracted log data is limited to the log data including the log record time corresponding to the time that is earlier by the response time period as compared with the log record time included in the recorded log data, so that a time taken to obtain specific log data from the access log may be reduced. A transfer amount of the log data through the network  14  may be reduced. 
         [0092]    When access to important data has been performed, log data including a log record time corresponding to a time that is earlier by a response time period is extracted from among a plurality of log data included in an access log  52  that is a request source for the important data. Therefore, the log data related to communication through which the access to the important data has been performed is obtained. 
         [0093]    Log data described below is extracted from among a plurality of log data included in an access log  52  of a device indicated by a request source IP included in the obtained log data. For example, log data including a log record time corresponding to a time that is earlier by a response time period as compared with a log record time of log data that includes a communication ID included in the obtained log data, the response time period, and the log record time are further extracted. From among the extracted log data, log data including the communication ID is obtained. Therefore, the log data related to a series of communications is obtained from the access log  52 . 
         [0094]    For example, the embodiment is not limited to a case in which the log data  88  are extracted when access to the above-described important data has been performed. For example, when the access log  52  is periodically referred to, and log data including a communication ID, a response time period, and a log record time has been recorded in the access log  52 , log data  88  may be extracted. 
         [0095]    For example, the embodiment is not limited to the above-described case in which the log obtaining program  110  is stored (installed) in the storage unit  103  in advance. The log obtaining program  110  may be provided in the form of being recorded in a recording medium such as a compact disc-read-only memory (CD-ROM), a digital versatile disc (DVD)-ROM, a universal serial bus (USB) memory, or a memory card. 
         [0096]    All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.