Abstract:
An objective of the present invention is to appropriately extract, or assist in extracting, a normal operation pattern from a normal operation log. A log file including information wherein a plurality of log records is ordered in time series is segmented into a plurality of log groups according to prescribed rules. A plurality of patterns which are configured by a plurality of events which are contiguous in time series is extracted from the plurality of log groups, and the patterns are associated with frequency information which represents how many log records the pattern is extracted from. The pattern to be outputted from the plurality of patterns is selected on the basis of an inclusion relation between the plurality of events which are contiguous in time series and configure a given pattern and the plurality of events which are contiguous in time series and configure other patterns, and on the basis of the frequency information which is associated with the patterns.

Description:
TECHNICAL FIELD 
       [0001]    The present invention relates to a technology of analyzing a log output by an information processing system. 
       BACKGROUND ART 
       [0002]    For management and maintenance of an information processing system, a person who is in charge of the management and maintenance (to be referred to as “administrator” below) needs to identify, when a fault occurs in the information processing system, a cause of the fault. A log output by the information processing system may become an important clue when the administrator identifies the cause of the fault. However, since a log output by the information processing system is huge, it is difficult for the administrator to analyze the entire log in detail. 
         [0003]    For the above reason, to identify the cause of the fault, the administrator needs to identify a message indicating a direct or indirect cause of occurrence of the fault (referred to as “cause message” below) from the huge amount of log output by the information processing system. Then, the administrator analyzes, in detail, the identified cause message and the log around the cause message, and thereby identifies the cause of the fault. 
         [0004]    PTL 1 discloses an example of a technology of detecting, from a log of a huge size output by an information processing system, a pattern of messages appearing at a frequency different from that in normal operation. The technology disclosed in PTL 1 extracts, from a log output by the information processing system in normal operation (referred to as “normal log” below), a typical pattern, such as a frequency at which messages appear in a normal log (referred to as “normal pattern” below). The technology disclosed in PTL 1 compares the normal pattern with a log output by the information processing system as an analysis target (referred to as “analysis-target log” below) and extracts the difference therebetween. As a result, the technology disclosed in PTL 1 is able to detect, from the analysis-target log, a message appearing at a frequency different from that in normal operation. 
       CITATION LIST 
     Patent Literature 
       [0005]    [PTL 1] Japanese Patent No. 4944391 
         [0006]    [PTL 2] Japanese Unexamined Patent Application Publication No. 2012-194604 
         [0007]    [PTL 3] Japanese Unexamined Patent Application Publication No. 2012-168702 
       SUMMARY OF INVENTION 
     Technical Problem 
       [0008]    PTL 1 does not disclose in detail how to extract a normal pattern from a normal log. To appropriately analyze a cause of a fault occurring in an information processing system, it is necessary to appropriately extract a normal pattern from a normal log. 
         [0009]    A description is given of “appropriately extracting a normal pattern from a normal log”. The “appropriately extracting a normal pattern from a normal log” means extracting, on the basis of a normal log, information indicating a process and a frequency at which the process is carried out in an information processing device. 
         [0010]    When a process is carried out in an information processing device, the information processing device outputs a plurality of messages in predetermined time series in response to the process being carried out. In the following description, a plurality of messages output by the information processing device in predetermined time series in response to the information processing device carrying out a particular process are referred to as a “series of messages.” 
         [0011]    A normal log includes an enormous number of messages. To extract information indicating a process and a frequency at which the process has been carried out, on the basis of the normal log, “information for grouping a series of messages in units of process” is necessary. 
         [0012]    PTL 2 and PTL 3 disclose technologies of analyzing a log on the basis of “information for grouping a series of messages in units of process.” 
         [0013]    The technology disclosed in PTL 2 uses a transaction identifier (ID) included in messages, as the “information for grouping a series of messages in units of process.” The technology disclosed in PTL 2 groups, on the basis of a transaction ID included in messages, a plurality of messages including the same transaction ID as a series of messages related to a corresponding transaction. 
         [0014]    The technology disclosed in PTL 3 uses information in which a series of messages related to a process is defined in advance, as the “information for grouping a series of messages in units of process.” The technology disclosed in PTL 3 groups, on the basis of the information, a plurality of messages as a series of messages related to a specific process. 
         [0015]    However, to appropriately extract a normal pattern from a normal log, the “information for grouping a series of messages in units of process” is not always provided in advance. It is conceivable that, in the technology disclosed in PTL2, a transaction ID may not be assigned to messages. 
         [0016]    One of the aims of the present invention is to appropriately extract or assist in extracting a normal pattern from a normal log without any information being provided in advance for grouping a series of messages in units of process. 
       Solution to Problem 
       [0017]    A first aspect of the present invention is a log analysis system including: division means for dividing a log file including information in which log records are aligned in time series, in accordance with a predetermined rule, into log groups each of which corresponds to a set of log records being contiguous in time series, each of the log records corresponding to information in which an event is associated with a time point of occurrence of the event; extraction means for extracting patterns each of which is formed with events being contiguous in time series, from the log groups, and associating the patterns with frequency information indicating numbers of log records from which the patterns are extracted; and selection means for selecting a pattern to be output, from the patterns, on a basis of an inclusion relationship between events with which a pattern is formed and being contiguous in time series and events with which another pattern is formed and being contiguous in time series, and on a basis of frequency information associated with the patterns. 
         [0018]    A second aspect of the present invention is a log analysis method by a computer including: dividing a log file including information in which log records are aligned in time series, in accordance with a predetermined rule, into a log groups each of which corresponds to a set of log records being contiguous in time series, each of the log records corresponding to information in which an event is associated with a time point of occurrence of the event; extracting patterns each of which is formed with events being contiguous in time series, from the log groups, and associates the patterns with frequency information indicating numbers of log records from which the patterns are extracted; and selects a pattern to be output, from the patterns on a basis of an inclusion relationship between events with which a pattern is formed and being contiguous in time series and events with which another pattern is formed and being contiguous in time series, and on a basis of frequency information associated with the patterns. 
         [0019]    A third aspect of the present invention is a recording medium that stores a program causing a computer to execute: processing of dividing a log file including information in which log records are aligned in time series, in accordance with a predetermined rule, into log groups each of which corresponds to a set of log records being contiguous in time series, each of log records corresponding to information in which an event is associated with a time point of occurrence of the event; processing of extracting patterns each of which is formed with events being contiguous in time series, from the log groups, and associating the patterns with frequency information indicating numbers of log records from which the patterns are extracted; and processing of selecting a pattern to be output, from the patterns on a basis of an inclusion relationship between events with which a pattern is formed and being contiguous in time series and events with which another pattern is formed being contiguous in time series, and on a basis of frequency information associated with the patterns. 
         [0020]    The aim of the present invention is achieved by the above-described computer-readable recording medium in which the program is stored and also by the program stored in the recording medium. 
       Advantageous Effects of Invention 
       [0021]    According to the present invention, it is possible to appropriately extract, or assist in extracting, a normal operation pattern from a normal log without any information being provided in advance for grouping a series of messages in units of process. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0022]      FIG. 1  is a block diagram illustrating a log analysis system  100  according to a first exemplary embodiment of the present invention. 
           [0023]      FIG. 2  is a table presenting an example of a normal log  910  input to the log analysis system  100  according to the first exemplary embodiment of the present invention. 
           [0024]      FIG. 3  is a block diagram illustrating a configuration of the log analysis system  100  according to the first exemplary embodiment of the present invention. 
           [0025]      FIG. 4  is a table presenting an example of a log file divided by a division unit  110  according to the first exemplary embodiment of the present invention. 
           [0026]      FIG. 5  is a table presenting an example of patterns extracted by an extraction unit  120  according to the first exemplary embodiment of the present invention. 
           [0027]      FIG. 6  is a diagram illustrating operation of a selection unit  130  according to the first exemplary embodiment of the present invention. 
           [0028]      FIG. 7  is a table presenting the operation of the selection unit  130  according to the first exemplary embodiment of the present invention. 
           [0029]      FIG. 8  is a flowchart illustrating operation of the log analysis system  100  according to the first exemplary embodiment of the present invention. 
           [0030]      FIG. 9  is a diagram presenting an example of a hardware configuration with which the log analysis system  100  is implemented. 
           [0031]      FIG. 10  is a block diagram illustrating a configuration of a log analysis system  101  according to a second exemplary embodiment of the present invention. 
           [0032]      FIG. 11A  is a first drawing presenting an example of a log file input to a conversion unit  150  according to the second exemplary embodiment of the present invention. 
           [0033]      FIG. 11B  is a second drawing presenting an example of the log file input to the conversion unit  150  according to the second exemplary embodiment of the present invention. 
           [0034]      FIG. 11C  is a third drawing presenting an example of the log file input to the conversion unit  150  according to the second exemplary embodiment of the present invention. 
           [0035]      FIG. 12  is a diagram presenting an example of a format according to the second exemplary embodiment of the present invention. 
           [0036]      FIG. 13  is a diagram presenting an example of the format according to the second exemplary embodiment of the present invention. 
           [0037]      FIG. 14  is a flowchart illustrating operation of the log analysis system  101  according to the second exemplary embodiment of the present invention. 
           [0038]      FIG. 15  is a block diagram illustrating a configuration of a fault cause analysis system  300  according to a third exemplary embodiment of the present invention. 
           [0039]      FIG. 16  is a flowchart illustrating operation of a log analysis system  102  according to a fourth exemplary embodiment of the present invention. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0040]    Exemplary embodiments of the present invention are described below in detail with reference to the drawings. 
       First Exemplary Embodiment 
       [0041]      FIG. 1  is a block diagram illustrating a log analysis system  100  according to a first exemplary embodiment of the present invention. As illustrated in  FIG. 1 , the log analysis system  100  acquires a normal log  910  output by an information processing system  900 . As described above, the normal log  910  is a log output by the information processing system  900  when the information processing system  900  is operating normally. The log analysis system  100  extracts information indicating a process and a frequency at which the process has been carried out in the information processing system  900 , that is, a normal pattern  920 , on the basis of the normal log  910 . As will be described later, it is not necessary that a concrete process is identified on the basis of the normal pattern  920 . The log analysis system  100  outputs the normal pattern  920  to a normal-pattern storage unit  200 . In the following description the “information processing system  900 ” is an information processing device which outputs the normal log  910  acquired by the log analysis system  100  according to the present exemplary embodiment and the log analysis systems according to other exemplary embodiments of the present invention. The “information processing system  900 ” is also an information processing device which outputs an analysis-target log  990  acquired by a fault cause analysis system  300  according to another exemplary embodiment of the present invention. 
         [0042]      FIG. 2  is a table illustrating an example of the normal log  910  output by the information processing system  900 . The normal log  910  is also called a log file. The normal log  910  includes information in which a plurality of log records are aligned in time series. 
         [0043]    A log record is information in which an event occurred in the information processing system  900  is associated with the time point at which the event occurred. A log record is also called a message. A log record is information corresponding to a “row” presented in  FIG. 2 . The log record presented in the first row in  FIG. 2  indicates that an event identified by an event ID (identifier) “A” occurred at the time point 09:04:01 in the information processing system  900 . The log record presented in the second row in  FIG. 2  indicates that an event identified by an event ID (identifier) “B” occurred at the time point 09:04:02 in the information processing system  900 . An event ID is an identifier which identifies an event that occurred in the information processing system  900 . 
         [0044]    In the following description of the exemplary embodiment, an event is identified by use of an event ID when the event needs to be identified. In addition, hereinafter, a “log record indicating that the event A occurred at a certain time point”, for example, may be expressed as a “log record of the event A” in some cases. 
         [0045]    When the information processing system  900  carries out a process, the information processing system  900  generates a plurality of events in predetermined time series in response to the process being carried out. In the following description, a plurality of events generated by the information processing system  900  in predetermined time series in response to the information processing system  900  carrying out a specific process are referred to as a “series of events”. 
         [0046]    For easy understanding, the present exemplary embodiment is described with the following concrete assumptions. It is assumed that, when the information processing system  900  carries out (Process 1), the information processing system  900  generates Event A, Event B, and Event C in this order. It is assumed that, when the information processing system  900  carries out (Process 2), the information processing system  900  generates Event X and Event Y in this order. 
         [0047]    Under the above assumptions, when the information processing system  900  carries out (Process 1), the information processing system  900  outputs the log record of Event A, the log record of Event B, and the log record of Event C in this order. When the information processing system  900  carries out (Process 2), the information processing system  900  outputs the log record of Event X and the log record of Event Y in this order. 
         [0048]    The normal log  910  includes an enormous number of log records. The log analysis system  100  extracts information indicating a process and a frequency at which the process has been carried out, on the basis of the normal log  910 . For example, the log analysis system  100  extracts, as the normal pattern  920 , information indicating “Process 1 has been carried out 10 times, and Process 2 has been carried out 18 times, in a predetermined time period”. It is not necessary that a concrete process is identified on the basis of the normal pattern  920 . For example, the normal pattern  920  may be information indicating that “the pattern of Events A-&gt;B-&gt;C has occurred 10 times, and the pattern of Events X-&gt;Y has occurred 18 times, in the predetermined time period”. The normal pattern  920  providing such information can sufficiently play a role as a comparison target to be used for analyzing the cause of a fault which occurred in the information processing system  900 . 
         [0049]    The symbol “-&gt;” denotes that the events described before and after the symbol are contiguous in time series in the normal log  910 . Specifically, “A-&gt;B-&gt;C-&gt;” means that the log record of Event A, the log record of Event B, and the log record of Event C are contiguous in this order in the normal log  910 . In some parts of the following description, “A-&gt;B-&gt;C”, for example, is denoted as “ABC” by omitting the symbol “-&gt;”, to express a plurality of events being contiguously occurred. 
         [0050]    In order for the log analysis system  100  to extract such information on the basis of the normal log  910 , “information for grouping a series of log records in units of process” is needed. 
         [0051]    Here, the “information for grouping a series of log records in units of process” is, for example, information indicating “the log record of Event A, the log record of Event B, and the log record of Event C are associated with a certain process” or “the log record of Event X and the log record of Event Y are associated with a certain process”. 
         [0052]    The log analysis system  100  according to the present exemplary embodiment is capable of appropriately extracting the normal pattern  920  on the basis of the normal log  910  without any “information for grouping a series of log records in units of process” being explicitly provided in advance. This is because the log analysis system  100  according to the present exemplary embodiment itself can extract “information for grouping a series of log records in units of process” on the basis of the normal log  910 . 
         [0053]    In other words, even when the log analysis system  100  is not provided in advance with information indicating “the log record of Event A, the log record of Event B, and the log record of Event C are associated with a certain process” or “the log record of Event X and the log record of Event Y are associated with a certain process”, the log analysis system  100  itself can extract such information on the basis of the normal log  910 . 
         [0054]    It is assumed that the information processing system  900  according to the present exemplary embodiment has the following attributes as assumptions. 
         [0055]    (Assumption 1) The information processing system  900  carries out a plurality of processes in parallel. 
         [0056]    (Assumption 2) For example, when the information processing system  900  carries out Process 1 and Process 2 in parallel, the information processing system  900  may output a log file in which the log records of the events associated with Process 1 and the log records associated with Process 2 are mixed in time series, in some cases. For example, the log records output in the time period from 09:04:12 to 09:04:16 in  FIG. 2  include the log records of the events associated with Process 1 and the log records of the events associated with Process 2 being mixed in time series. In the example illustrated in  FIG. 2 , Events A-&gt;B-&gt;C are associated with Process 1. Similarly, Events X-&gt;Y are associated with Process 2. 
         [0057]    (Assumption 3) It is not often that the log records of events associated with a certain process are output in such a manner as to be mixed in time series with the log records of events associated with a different process as described above. In most cases, the log records of events associated with a particular process is contiguous in time series in a log file. 
         [0058]    Detailed description is given below of how the log analysis system  100  appropriately extracts the normal pattern  920  from the normal log  910 , on the basis of the above assumptions. 
         [0059]      FIG. 3  is a block diagram illustrating the log analysis system  100  illustrated in  FIG. 1 . As illustrated in  FIG. 3 , the log analysis system  100  includes a division unit  110 , an extraction unit  120 , a selection unit  130 , and a normal-pattern extraction unit  140 . 
         [0060]    The division unit  110  acquires the normal log  910  and divides the acquired normal log  910  into a plurality of log groups. Each log group is a set of a plurality of log records which are contiguous in time series (to be described later in detail). 
         [0061]    The extraction unit  120  extracts, from a plurality of log groups, a plurality of “patterns” each of which is formed with a plurality of events which are contiguous in time series. The extraction unit  120  associates a pattern in the patterns with frequency information which indicates the number of log records from which the pattern is extracted (to be described later in detail). 
         [0062]    The selection unit  130  selects a pattern to be output from the plurality of patterns, on the basis of an inclusion relationship between a plurality of events which are contiguous in time series and with which a certain pattern is formed and a plurality of events which are contiguous in time series and with which a different pattern is formed. In addition, the selection unit  130  selects a pattern to be output from the plurality of patterns, on the basis of the frequency information associated with the patterns (to be described later in detail). 
         [0063]    The normal-pattern extraction unit  140  extracts the normal pattern  920  from the normal log  910  on the basis of the pattern output by the selection unit  130 . 
         [0064]    The division unit  110  is described in detail.  FIG. 4  is a table illustrating a state in which the normal log  910  presented in  FIG. 2  is divided into a plurality of log groups by the division unit  110 . The log groups presented in  FIG. 4  are obtained in a case where the division unit  110  divides the normal log  910  into log groups at five-second intervals. 
         [0065]    The division unit  110  divides the normal log  910  at predetermined time intervals specified in advance. Preferably, the division unit  110  divides the normal log  910  at time intervals with which log records of a series of events, which are output in response to a process carried out by the information processing system  900 , are expected to be included in a single log group. The time period required for the information processing system  900  to carry out a particular process varies every time depending such as on the load state of the information processing system  900 . Accordingly, it is preferable that the division unit  110 , for example, calculates a value such as the average processing time and determines the time intervals for division on the basis of such a value. 
         [0066]    For the determination of the time interval for the division, values of Poisson distribution or the like of execution time of the process or transaction may be taken into account. 
         [0067]    The extraction unit  120  is described in detail.  FIG. 5  is a table presenting an example of the “pattern” extracted from a plurality of log groups by the extraction unit  120  and the “frequency” of the pattern that is extracted. The “pattern” is the combination of a plurality of events being contiguous in time series, which are found in the log groups. The “frequency” is information indicating the number of log records from which the concerned pattern is extracted. 
         [0068]    Description is given with concrete examples. For example, assume a case where the extraction unit  120  extracts a pattern from Log group 1 illustrated in  FIG. 4 . The plurality of log records which are contiguous in time series and with which Log Group 1 is formed are “ABCXY”. In this case, possible patterns which the extraction unit  120  extracts from Log Group 1 are as follows: “ABCXY”, “ABCX”, “BCXY”, “ABC”, “BCX”, “CXY”, “AB”, “BC”, “CX”, “XY”, “A”, “B”, “C”, “X”, and “Y.” 
         [0069]    The extraction unit  120  extracts the “pattern” from a plurality of log groups. The extraction unit  120  associates the pattern with frequency information indicating the number of log records from which the pattern is extracted. For example, in  FIG. 5 , the frequency of the pattern “ABC” is 43. This means that the pattern “ABC” is extracted from 43 log groups. 
         [0070]    Various algorithms can be used as a concrete method of extracting patterns. The extraction unit  120  extracts patterns by use of, for example, one of apriori, prefixspan, Linear time Closed itemset Miner (LCM), Bi-Directional Execution (BIDE), and Frequent Pattern (FP)-growth, or an application of one of those algorithms. 
         [0071]    In the following description, a pattern which is associated with a specific process carried out by the information processing system  900  is referred to as a “meaningful pattern”. For example, the pattern “ABC” is associated with Process 1 and is hence a meaningful pattern. For example, the pattern “XY” is associated with Process 2 and is hence a meaningful pattern. 
         [0072]    In the following description, a pattern which is not associated with any specific process carried out by the information processing system  900  is referred to as a “meaningless pattern”. A type of a meaningless pattern is, for example, a pattern which is merely a subset of a meaningful pattern. For example, a pattern such as “AB” or “BC” itself is not associated with any process independently and is hence a meaningless pattern. Another type of a meaningless pattern is, for example, a pattern made by adding an event to a meaningful pattern. For example, a pattern such as “ABCX” or “XYA” itself is not associated with any process independently and is hence a meaningless pattern. Still another type of a meaningless pattern is, for example, a pattern in which a pattern associated with a process is mixed with a pattern associated with another process are mixed in time series. For example, a pattern such as “ABXCY” or “XAYBC” itself is not associated with any process independently and is hence a meaningless pattern. 
         [0073]    The selection unit  130  is described in detail. The selection unit  130  selects a “meaningful pattern” from the plurality of patterns extracted by the extraction unit  120  and outputs the selected pattern as “information for grouping a series of messages in units of process”. 
         [0074]    In view of the above-described (Assumption 3), it is not so often to find a pattern in which a pattern associated with a process and a pattern associated with another process are mixed in time series. For this reason, the selection unit  130  can remove such a pattern as noise by avoiding selecting any pattern whose frequency is lower than a predetermined threshold value. 
         [0075]    Similarly, in view of the above-described (Assumption 3), it is conceivable that the frequency of the pattern “ABC” or “XY”, which is associated with a specific process carried out by the information processing system  900 , is higher than the frequencies of other patterns. However, when the frequency of, for example, the pattern “ABC” is high, naturally, the frequencies of the patterns “AB” and “BC”, which are subsets of the pattern “ABC”, are also high. And, it is possible that the frequency of a pattern such as “ABCX” or “YABC”, which is made by adding an event to the pattern “ABC”, is also high to some extent. Therefore, the selection unit  130  does not select “meaningful patterns” only by simply selecting patterns with high frequencies. 
         [0076]    This is because, when the selection unit  130  simply extracts patterns with high frequencies, a “meaningful pattern”, a “pattern of a subset of a meaningful pattern”, and a “pattern made by adding an event to a meaningful pattern” are extracted without any distinction. It is not possible for the selection unit  130  to distinctively select a “meaningful pattern” from the above patterns. 
         [0077]    The selection unit  130  selects a “meaningful pattern” from the plurality of patterns through the following operation. The operation of the selection unit  130  is described below specifically. 
         [0078]    The selection unit  130  selects a pattern to output, from the plurality of patterns, on the basis of inclusion relationship between the plurality of events which are contiguous in time series and with which a pattern is formed and the plurality of events which are contiguous in time series and with which another pattern is formed. The selection unit  130  selects a pattern to output, from the plurality of patterns, further on the basis of frequency information associated with the patterns. 
         [0079]    For easy understanding, terms “parent pattern” and “child pattern” are defined below. When a plurality of events which are contiguous in time series and with which one pattern is formed corresponds to a subset of a plurality of events which are contiguous in time series and with which another pattern is formed, the another pattern is defined as a parent pattern of the one pattern. The one pattern is defined as a child pattern of the another pattern. For example, the pattern “ABCD” is a parent pattern of the pattern “ABC”. For example, the pattern “AB” is a child pattern of the pattern “ABC”. A term such as “grandchild pattern” can be defined similarly. 
         [0080]    The selection unit  130  analyzes the parent-child relationship for each of the patterns extracted by the extraction unit  120 .  FIG. 6  is a diagram presenting a state in which the selection unit  130  analyzes the parent-child relationship for the pattern “ABCD”. As illustrated in  FIG. 6 , the selection unit  130  puts the patterns including events in common order together in the same category set. Then, the selection unit  130  analyzes the parent-child relationship of the patterns on the basis of the numbers of events (the numbers of elements) included in the patterns. 
         [0081]    Concrete Example 1 to Concrete Example 4 are described below as examples of the operation of the selection unit  130 . The selection unit  130  extracts a “meaningful pattern” by, for example, a combination of the following concrete examples. 
       Concrete Example 1 
       [0082]    The selection unit  130  analyzes the parent-child relationship for each of the plurality of patterns. As a result of the analysis by the selection unit  130 , the parent-child relationship indicating that the parent pattern is “ABCX”, the child pattern is “ABC”, and the grandchild pattern is “AB”, or the like is obtained for the pattern “ABCX”, for example. 
         [0083]    The selection unit  130  calculates the ratio of a frequency of a child pattern to a frequency of a parent pattern. In the example presented in  FIG. 5 , the frequency of the parent pattern “ABCX” is 17, and the frequency of the child pattern “ABC” is 43; accordingly, the ratio between the frequencies is 43/17=2.5. Here “/” is a symbol representing division. When the ratio is a relatively large value (e.g., a case where the value is 2 or larger), there is a high possibility that the parent pattern is a “meaningless pattern”. This is because it is considered that such a parent pattern is a pattern of the child pattern to which an event is simply added. 
         [0084]    Similarly, the selection unit  130  calculates the ratio of a frequency of a child pattern to a frequency of a parent pattern. In the example presented in  FIG. 5 , the frequency of the parent pattern “ABC” is 43, and the frequency of the child pattern “AB” is 46. Accordingly, the ratio between the frequencies is 46/43=1.07. When the ratio is a value close to one (e.g., a case where the value is 1.1 or smaller), there is a high possibility that the child pattern is a “meaningless pattern”. This is because such a child pattern is merely extracted as a subset of a parent pattern in most cases and it is difficult to consider that such a child pattern is associated with a certain process independently. A conceivable example of a case where such a child pattern is extracted as a pattern other than a subset of the parent pattern is a case where the division unit  110  accidentally divides the normal log  910  at the middle of a “meaningful pattern”, such as, at the division between Log Group 2 and Log Group 3 presented in  FIG. 4 . 
       Concrete Example 2 
       [0085]    The selection unit  130  analyzes the parent-child relationship for each of the plurality of patterns. The selection unit  130  may preferentially select, as a “meaningful pattern”, a pattern which is formed with a large number of elements (events) and the frequency of which is high. For example, the pattern “ABC” may be preferentially selected as a “meaningful pattern” since the pattern “ABC” is formed with three elements (A, B, and C) and has a high frequency of 43. The criterion for determining whether the number of elements with which a pattern is formed is large or small and the criterion for determining whether a frequency is high or low may be set in advance, for example. 
       Concrete Example 3 
       [0086]    The selection unit  130  analyzes the parent-child relationship for each of the plurality of patterns.  FIG. 7  is a table obtained by analyzing, for each pattern, the number of parent patterns of a pattern. The selection unit  130  may preferentially select a child pattern having more parent patterns as a “meaningful pattern”. 
       Concrete Example 4 
       [0087]    The selection unit  130  analyzes the parent-child relationship for each of the plurality of patterns. The selection unit  130  may select a “meaningful pattern” on the basis of, for example, a support degree of pattern, a reliability degree of a parent pattern with respect to a child pattern, the ratio of the reliability degree to the support degree (a lift value), or the like. The support degree, the reliability degree, and the lift value may be defined by an operator in advance, for example. 
       Concrete Example 5 
       [0088]    The selection unit  130  may preferentially select a child pattern which is consistent with the concerned pattern, when, for example, the pattern “XYABC” is extracted. For example, in the above-described example, the child patterns “ABC” and “XY” is consistent with the parent pattern “ABCXY” and are hence preferentially selected. For example, in the above-described example, child patterns “XAB” and “XBC” are not consistent with the parent pattern “ABCXY” (e.g., YC is too much in a case of XAB) and is hence excluded from candidates. 
         [0089]    (Concrete Example 1), (Concrete Example 2), (Concrete Example 3), (Concrete Example 4), and (Concrete Example 5) are described above as examples of the operation of the selection unit  130 . The selection unit  130  selects the patterns “ABC” and “XY” as “meaningful patterns” from among the patterns extracted by the extraction unit  120 , through the operation provided as the above-described concrete examples. The selection unit  130  outputs the selected patterns to the normal-pattern extraction unit  140 . 
         [0090]    The normal-pattern extraction unit  140  receives an input of a “meaningful pattern” from the selection unit  130 . The normal-pattern extraction unit  140  extracts the normal pattern  920  from the normal log  910  on the basis of the received pattern. 
         [0091]    Next, operation of the log analysis system  100  is described.  FIG. 8  is a flowchart presenting the operation of the log analysis system  100  according to the first exemplary embodiment. 
         [0092]    The division unit  110  divides the normal log  910  (log file) into a plurality of log groups (Step S 101 ). The extraction unit  120  extracts patterns from the plurality of log groups (Step S 102 ). The selection unit  130  selects a “meaningful pattern” from the patterns extracted by the extraction unit  120  and outputs the selected “meaningful pattern”. (Step S 103 ). The normal-pattern extraction unit  140  extracts the normal pattern  920  from the normal log  910  on the basis of the pattern selected by the selection unit  130  (Step S 104 ). 
         [0093]    Next, an example of a hardware configuration with which the log analysis system  100  can be implemented is described.  FIG. 9  is a diagram illustrating an example of the hardware configuration with which the log analysis system  100  can be implemented. 
         [0094]    The log analysis system  100  of the present exemplary embodiment and the log analysis systems according to the other exemplary embodiments can be implemented by a computer having the hardware configuration presented in  FIG. 9 . The computer includes a CPU (central processing unit)  1 , a memory  2 , a storage device  3 , and a communication interface (I/F)  4 . The log analysis system may include an input device  5  or an output device  6 . Functions of the log analysis system are implemented by, for example, the CPU  1  executing a computer program (a software program, which is referred to simply as a “program” below) loaded into the memory  2 . At the time of execution, the CPU  1  appropriately controls the communication interface  4 , the input device  5 , and the output device  6 . 
         [0095]    Note that the present invention described by taking, as examples, the present exemplary embodiment and the exemplary embodiments to be described later may be implemented by a nonvolatile storage medium  8 , such as a compact disc, in which a concerned program are stored. The program stored in the storage medium  8  is read out by, for example, the drive  7 . 
         [0096]    Communication performed by the log analysis system is achieved by an application program controlling the communication interface  4  by use of a function provided by, for example, an OS (operating system), for example. The input device  5  is, for example, a keyboard, a mouse, or a touch panel. The output device  6  is, for example, a display. The log analysis system may be implemented with two or more physically separated devices being communicably connected by wire or wirelessly. The hardware configuration of the log analysis system and the functional blocks of the log analysis system are not limited to the above-described configuration. The above-described hardware configuration is also applicable to the log analysis system and the fault cause analysis system according to the other exemplary embodiments to be described later. 
         [0097]    The effects of the log analysis system  100  according to the first exemplary embodiment are described. The log analysis system  100  is capable of appropriately extracting, or assisting in extracting, the normal pattern  920  from the normal log  910  without “information for grouping a series of messages in units of process” being provided in advance. This is because the log analysis system  100  can extract for itself “information for grouping a series of messages in units of process” on the basis of the normal log  910 . 
       Modified Example of First Exemplary Embodiment 
       [0098]    The division unit  110 , the extraction unit  120 , the selection unit  130 , and the normal-pattern extraction unit  140  each may start the operation, for example, upon receipt of an instruction of a pattern generation start by a user, or another program, software or the like from an unillustrated input device. The division unit  110 , the extraction unit  120 , the selection unit  130 , and the normal-pattern extraction unit  140  each may start the operation, for example, upon an input, an update or the like of a log file. 
         [0099]    The division unit  110  may divide a log file so that a single log group is formed with a predetermined number of log records. For example, the division unit  110  may divide a log file so that a single log group is formed with five log records. The division unit  110  may acquire log files at predetermined time intervals. The division unit  110  may operate in such a way as to acquire log files of five minutes at intervals of five minutes, or to acquire log files of five minutes at intervals of three minutes, for example. 
         [0100]    The extraction unit  120  may extract, as a pattern, events which are not contiguous in time series. For example, the extraction unit  120  may extract the patterns “ABXY”, “ACY”, or “BCY” from the log group 1 “ABCXY”. 
         [0101]    The selection unit  130  may analyze the parent-child relationship on the basis of events which are not contiguous in time series. For example, the selection unit  130  may associate a pattern such as “AC” or “ACX” as a child pattern with the parent pattern “ABCX”. 
       Second Exemplary Embodiment 
       [0102]      FIG. 10  is a block diagram illustrating a configuration of a log analysis system  101  according to a second exemplary embodiment of the present invention. Components which are substantially the same as those illustrated in  FIG. 3  are denoted by the same reference signs, and description thereof is omitted. A log analysis system  101  according to the second exemplary embodiment further includes a conversion unit  150  in addition to the log analysis system  100  according to the first exemplary embodiment. 
         [0103]    In the normal log  910  to be received by the log analysis system  100  in the first exemplary embodiment, event IDs are already assigned to the respective log records as illustrated in  FIG. 2 . In the second exemplary embodiment, a normal log  911  received by the log analysis system  101  is a log file which is closer to raw data. The conversion unit  150  receives a log file, for example, as that presented in  FIG. 11A ,  FIG. 11B , or  FIG. 11C , and converts the received log file into a log as that illustrated in  FIG. 2 . 
         [0104]    Each of  FIG. 11A ,  FIG. 11B , and  FIG. 11C  is a drawing presenting an example of the normal log  911  (log file) received by the conversion unit  150 . The log file is formed with at least one log record. The log record is formed so as to include at least one log element. A log element is an element, such as, time and date, a log ID (identifier), or a message, with which a log record is formed. 
         [0105]    The conversion unit  150  converts the normal log  911  in accordance with a format defined by an operator in advance.  FIG. 12  is a diagram presenting an example of the format defined by the operator in advance. The format presented in  FIG. 12  specifies the period “2013/07/01 09:00:00-2013/07/01 18:00:00” and specifies the log elements “time and date” and “log ID”. Information, such as a regular expression for each log element, by which the log element to be extracted can be identified, may be recorded in the format to extract a log element from a log file. Information, such as a name of a log file as a target, by which a log file can be identified, may be recorded in the format. A structure of a log record, which is formed with log elements, may be recorded as a regular expression in the format. 
         [0106]      FIG. 13  is a diagram presenting another example of the format defined by an operator in advance.  FIG. 13  presents information associating an event ID and an expression (record expression) of the event to which the event ID is to be assigned. A record expression is a character string representing a concerned log record. As a record expression, a log record may be recorded as it is. Information of an extracted log element of a log record may be recorded as a record expression. A regular expression matching a log record may be recorded as a record expression. 
         [0107]    Upon receipt of an input of the normal log  911  as that presented in  FIG. 11A ,  FIG. 11B , or  FIG. 11C , the conversion unit  150  converts the normal log  911  into a log file as that presented in  FIG. 2 , on the basis of the format presented in  FIG. 12  or  FIG. 13 . The conversion unit  150  may read, for example, a log of the period specified in the log format from the information processing system  900 . There may be two or more log files as a target to be read. The conversion unit  150  extracts a log element specified by the format from the log file which is acquired or read. For example, in the case of the format presented in  FIG. 12 , the conversion unit  150  extracts only the time and date and the log ID from log records included in a log file. The conversion unit  150  sorts the converted log in time series, and outputs the log. Through these operations, the division unit  110 , the extraction unit  120 , the selection unit  130 , and the normal-pattern extraction unit  140  can process the normal log  911 . 
         [0108]      FIG. 14  is a flowchart illustrating operation of the log analysis system  101  according to the second exemplary embodiment. The same reference signs are assign to the steps in which the same operations are performed as those illustrated in  FIG. 8 , and the description of the steps is omitted. 
         [0109]    The conversion unit  150  receives the log file  911  and converts the received log file so that event IDs are assigned to the respective log records (Step S 201 ). The division unit  110  receives the converted log file from the conversion unit  150 . The subsequent operations are the same as those presented in Step S 101  to Step S 104  in  FIG. 3 , and hence the description of the operations is omitted. 
         [0110]    The effects of the log analysis system  101  according to the second exemplary embodiment are described. The log analysis system  101  includes the conversion unit  150 . The conversion unit  150  converts logs output by the information processing system  900  into a form which can be processed by the division unit  110 , the extraction unit  120 , the selection unit  130 , and the normal-pattern extraction unit  140 . As a result of these operations, the log analysis system  101  can process normal logs  911  output in various formats. 
       Third Exemplary Embodiment 
       [0111]      FIG. 15  is a block diagram illustrating a configuration of a fault cause analysis system  300  according to a third exemplary embodiment of the present invention. The fault cause analysis system  300  includes a second conversion unit  310 , a pattern comparison unit  320 , and an abnormal-pattern output unit  330 . 
         [0112]    The second conversion unit  310  acquires an analysis-target log  990 , which is an analysis-target log file and output by the information processing system  900 . In the second conversion unit  310 , “information for grouping a series of messages in units of process” selected by the selection unit  130  is registered in advance. The second conversion unit  310  extracts patterns from the analysis-target log  990  on the basis of the “information for grouping a series of messages in units of process”. 
         [0113]    The pattern comparison unit  320  compares a pattern obtained by conversion of the analysis-target log  990  by the second conversion unit  310 , with the pattern stored in the normal-pattern storage unit  200 . The pattern comparison unit  320  extracts, in the pattern obtained by the conversion of the analysis-target log  990 , a pattern different from the normal pattern  920 . 
         [0114]    The abnormal-pattern output unit  330  outputs an abnormal part of the analysis-target log  990  on the basis of the result of the comparison performed by the pattern comparison unit  320 . 
         [0115]    The fault cause analysis system  300  according to the third exemplary embodiment extracts a message indicating a direct or indirect cause of a fault, from a huge amount of log output by the information processing system  900 , and outputs the extracted message. 
       Fourth Exemplary Embodiment 
       [0116]      FIG. 16  is a block diagram illustrating a configuration of a log analysis system  102  according to a fourth exemplary embodiment of the present invention. As illustrated in  FIG. 16 , the log analysis system  102  includes a division unit  112 , an extraction unit  122 , and a selection unit  132 . 
         [0117]    The division unit  112  divides a log file into a plurality of log groups according to a predetermined rule. The log file includes information in which a plurality of log records, each of which is information in which an event is associated with the time point of the occurrence of the event, are aligned in time series. Each of the log groups is a set of a plurality of log records which are contiguous in time series. 
         [0118]    The extraction unit  122  extracts a plurality of patterns each of which is formed with a plurality of events contiguous in time series, from the plurality of log groups, and associates each of the patterns with the frequency information indicating the number of log records from which each of the patterns is extracted. 
         [0119]    The selection unit  132  selects a pattern to be extracted from the plurality of patterns. In this operation, the selection unit  132  selects the pattern on the basis of the inclusion relationship between a plurality of events which are contiguous in time series and with which a pattern is formed and a plurality of events which are contiguous in time series and with which another pattern is formed, and on the basis of the frequency information associated with the patterns. 
         [0120]    It is possible to implement an appropriate combination of the above-described exemplary embodiments. The present invention is not limited to any of the above-described exemplary embodiments and may be implemented in various modes. 
         [0121]    The separation of blocks presented in each of the block diagrams is a configuration presented for the purpose of illustration. The present invention described by using each of the exemplary embodiments as an example is not limited, for the implementation, to the configurations presented in the block diagrams. 
         [0122]    The exemplary embodiments to carry out the present invention are described above. However, the above-described exemplary embodiments are provided for making the understanding of the present invention easy, and are not to intend limited interpretation of the present invention. Changes and improvements can be made to the present invention without departing from the gist of the present invention, and the equivalents are also included in the present invention. 
         [0123]    The present application claims the priority based on Japanese Patent Application No. 2013-197416, filed on Sep. 24, 2013, the entire disclosure of which is incorporated herein. 
       REFERENCE SIGNS LIST 
       [0000]    
       
           1  CPU 
           2  Memory 
           3  Storage device 
           4  Communication interface 
           5  Input device 
           6  Output device 
           7  Drive 
           8  Storage medium 
           100  Log analysis system 
           101  Log analysis system 
           102  Log analysis system 
           110  Division unit 
           112  Division unit 
           120  Extraction unit 
           122  Extraction unit 
           130  Selection unit 
           132  Selection unit 
           140  Normal-pattern extraction unit 
           150  Conversion unit 
           200  Normal-pattern storage unit 
           300  Fault cause analysis system 
           310  Second conversion unit 
           320  Pattern comparison unit 
           330  Abnormal-pattern output unit 
           900  Information processing system 
           910  Normal log 
           911  Normal log 
           920  Normal pattern 
           990  Analysis-target log