Source: https://patents.google.com/patent/US20070118575A1/en
Timestamp: 2018-12-10 04:41:42
Document Index: 563728952

Matched Legal Cases: ['Application No. 2005', 'art 131', 'art 131', 'art 131', 'art 131', 'art 131', 'art 131', 'art 131', 'art 131', 'art 131', 'art 131', 'art 131', 'art.\n7']

US20070118575A1 - File server, file server log management system and file server log management method - Google Patents
File server, file server log management system and file server log management method Download PDF
US20070118575A1
US20070118575A1 US11329207 US32920706A US2007118575A1 US 20070118575 A1 US20070118575 A1 US 20070118575A1 US 11329207 US11329207 US 11329207 US 32920706 A US32920706 A US 32920706A US 2007118575 A1 US2007118575 A1 US 2007118575A1
US11329207
US7506375B2 (en )
This application relates to and claims priority from Japanese Patent Application No. 2005-337632 filed on Nov. 22, 2005, the entire disclosure of which is incorporated herein by reference.
The present invention relates to a file server, a file server log management program and a file server log management method.
In order to achieve the efficient management of large quantities of data, which are increasing day by day, file servers which manage numerous files, previously dispersed and managed by means of a plurality of computers, by gathering these files together in a single place have become popular. In particular, file servers of the type known as “NAS” (network attached storage) differ from file servers of the all-purpose type in which an all-purpose file server function is installed in an all-purpose computer in that NAS are designed especially as file servers. Accordingly, NAS show a high processing performance and reliability as file servers, and can be used comparatively easily immediately following introduction. Consequently, such systems are widely used.
However, if the authority of the manager of a log management device is used, log information stored in the log management device can be deleted, and the content can be rewritten. Accordingly, the log information stored in a log management device cannot be relied upon “as is”.
Consequently, for example, a system has also been proposed in which the log information recorded by devices installed on a network is respectively transmitted to a plurality of log management devices by using a syslog protocol (Requests for Comments (3164), http://www.faqs.org/rfcs/rfc3164.html). As a result, the same log information can be redundantly managed in a plurality of log management devices having respectively different managers.
The present invention was devised in light of the abovementioned problem points; it is an object of the present invention to provide a file server, a file server log management system and a file server log management method which are devised so that the reliability of log information management can be improved. It is another object of the present invention to provide a file server, a file server log management system and a file server log management method which are devised so that log information can be transmitted to and held in separate log management devices in which a plurality of log management devices are separated from each other, by installing a communications path that allows the exchange of information relating to log information between a first operation system and a second operating system, thus improving reliability. Other objects of the present invention will become clear from the description of embodiments below.
FIG. 1 is an explanatory diagram showing an outline of an embodiment of the present invention;
FIG. 1 is a structural explanatory diagram showing an overall outline of an embodiment of the present invention. In the present embodiment, the log information of a file management device (file server) is managed by multiplex management using a plurality of management devices that are separated from each other. Specifically, in the present embodiment, as will be described later, log information D1 produced in a virtual OS 1A is stored in log management devices 3 and 4 disposed on respectively different communications networks CN1 and CN2.
For example, this log management system can be constructed so that this system comprises a file server 1, a host computer (hereafter referred to as a “host”) 2, a first log management device 3, and a second log management device 4.
An embodiment of the present invention will be described in detail. FIG. 2 is an explanatory diagram showing the overall construction of the log management system. First, to describe the relationship between this figure and FIG. 1, the NAS device 100 in FIG. 2 corresponds to the file server 1 in FIG. 1, the host 200 in FIG. 2 corresponds to the host 2 in FIG. 1, the trunk network management device 400 in FIG. 2 corresponds to the first log management device 3 in FIG. 1, the NAS security management terminal 600 in FIG. 2 corresponds to the second log management device 4 in FIG. 1, the trunk network CN11 in FIG. 2 corresponds to the first communications network CN1 in FIG. 1, and the management network CN12 in FIG. 2 corresponds to the second communications network CN2 in FIG. 1.
The NAS security management terminal (hereafter abbreviated to “security management terminal” in some cases) 600 respectively acquires and stores respective sets of log information produced in the NAS device 100. In the same manner as described above, the manager OS 132 may gather log information from the respective virtual OS 133 and spontaneously transmit this log information to the security management terminal 600, or may transmit respective sets of log information to the security management terminal 600 in response to requests from the security management terminal 600.
FIG. 3 is a block diagram showing the construction of the NAS device 100. For example, the NAS device can be constructed so that this device comprises a CPU (central processing unit) 110, a plurality of interfaces (interface is hereafter abbreviated to “I/F”) 121 and 122, a memory 130, and a disk device 140.
For example, information relating to the kernel part 131, the manager OS 132, the virtual OS 133, and the virtual network I/F 134, is stored in the memory 130. The kernel part 131 corresponds to the “inter-operating-system communications part” or “information exchange part”. The kernel part 131 performs preset specified communications between the respective virtual OS 133 corresponding to the “first operating systems” and the manager OS 132 corresponding to the “second operating system”. The specified communications will be described later; for example, such communications include instructions for the transmission settings of the log information, and notifications that log information has been produced or stored.
FIG. 5 is an explanatory diagram showing the construction of the disk device 140 in model form. The term “data base” will hereafter be abbreviated to “DB”. In relation to the transfer of log information, for example, a manager OS log transfer destination management DB 142, a transfer option management DB 143, a virtual OS log transfer destination management DB 144, and a shared disk region 145, can be installed in the disk device 140.
The shared disk region (hereafter referred to as the “shared disk” in some cases) 145 is used to transfer log information between the management OS 132 and the respective virtual OS 133.
FIG. 7 is an explanatory diagram showing the construction of the transfer option management DB 143. For example, the transfer option management DB 143 shown in FIG. 7 is constructed by associating numbers used to discriminate the respective virtual OS 133, and transfer flags. The transfer flags are items of control information that indicate whether or not log information in the virtual OS 133 is also to be transmitted to the security management terminal 600. In cases where the transfer flag is set as “1”, the log information is respectively transmitted to the trunk network management device 400 and security management terminal 600 (second mode). In cases where the transfer flag is reset to “0”, the log information is transmitted only to the trunk network management device 400, and is not transmitted to the security management terminal 600 (first mode).
The log transfer control program 1331 operates on the basis of the contents of the transfer flag registered in the transfer option management DB 143. In cases where “1” is set in the transfer flag, this program 1331 issues a request to the kernel part 131 to transfer log information to the side of the manager OS 132. Furthermore, this program 1331 also has the function of altering the contents of the transfer flag on the basis of requests from the kernel part 131.
The first type of information comprises NAS node numbers (in the figures, discriminating numbers are indicated as “#”) that are used to discriminate the plurality of NAS devices 100. The security management terminal 600 can be respectively connected to a plurality of NAS devices 100, so that all of the log information acquired from the respective NAS 100 can be managed in a unified manner.
The second type of information is information relating to the respective virtual OS 133 disposed in each NAS device 100. For example, such information relating to the virtual OS 133 may include virtual OS names used to discriminate the respective virtual OS 133, the date and time at which operation of the virtual OS 133 is initiated (such date and time may be recorded as year, month, day, hour, minute and seconds; same below), the date and time at which the operation of the virtual OS 133 is ended, and the status of the virtual OS 133. For instance, examples of the status of the virtual OS 133 include “in operation (normal operating state)”, “stopped”, “in recovery from trouble” and the like.
Here, for example, the status of the file system may include “in operation (normal operating state)”, “stopped”, “in recovery from trouble”, “being backed up” and the like. Furthermore, for example, types of file systems include “ordinary”, “WORM” and the like. WORM (write once read many) refers to a state in which the writing of data is permitted only once. For example, medical treatment information produced by medical institutions or the like, and transaction information produced by financial institutions or the like, must be stored for a specified period of time that is determined by law. Furthermore, there is a strict requirement for the prevention of falsification (deletion or alteration) of such data. Such important data can be properly managed by being stored in a WORM type file system.
Next, the operation of the log management system will be described. FIG. 13 is a flow chart showing the processing that is used to set the log information transfer mode. Furthermore, in the following description, “step” will be abbreviated to “S”.
A manager on the side of the management network CN12 issues an instruction to set the transfer flag via the NAS node setting terminal 500 (S11). Here, a case in which the log information transfer mode is set as the second mode will be described as an example. In cases where the transfer mode is set as the second mode, the transfer flag that is stored in the transfer option management DB 143 may be set as “1”. Furthermore, in cases where this transfer mode is set as the first mode, this transfer flag may be reset to “0”.
When the manager OS 132 receives instructions from the NAS node setting terminal 500 via the management network CN12, the manager OS 132 issues a request for the transfer flag to be set as “1” by the virtual OS 133 (S12). This request is input into the kernel part 131 from the manager OS 132, and is transmitted to the virtual OS 133 via the kernel part 131.
Thus, instructions from the manager OS 132 are relayed via the kernel part 131 and transmitted to the virtual OS 133. When the virtual OS 133 confirm instructions from the manager OS 132, the virtual OS 133 set the transfer flag of the transfer option management DB 143 as “1” (S14). The virtual OS 133 then notify the kernel part 131 that the setting of the transfer flag has been completed (S15). When the kernel part 131 recognizes the transfer flag setting completion notification as information of the reception ID 3, the kernel part 131 transfers this setting completion notification to the manager OS 132 by means of the request ID 4 (S16).
Furthermore, similar processing can also be performed in cases where the transfer flag is reset to “0”. In such cases, a set consisting of the reception ID and request ID used for resetting is added to the management table T1. Alternatively, a construction may also be used in which an instruction for the setting of the transfer flag is sent from the NAS node setting terminal 500, and the value of the transfer flag is alternately switched between “0” and “1”.
When the virtual OS 133 receives instructions from the virtual NAS setting terminal 300 via the trunk network CN11, the virtual OS 133 produces log information relating to the setting alteration that is instructed (S22). This log information is stored in the shared disk region 145. The virtual OS 133 refers to the transfer option management DB 143 (S23), and ascertains whether or not the transfer flag is set as “1” (S24).
As was described above, cases in which the transfer flag is set as “1” are cases in which the log information is to be transmitted to and held in both the trunk network management device 400 and security management terminal 600.
A second embodiment will be described with reference to FIG. 18. The following embodiments including the present embodiment correspond to modifications of the first embodiment. In the present embodiment, an NAS function is provided inside the storage control device.
FIG. 19 is a flow chart showing the monitoring processing that is executed in the log management system of a third embodiment. There are cases in which at least a portion of this flow chart can be executed by a computer. Here, however, for convenience of description, this will be described as the flow of a procedure performed by a human monitor.
Furthermore, the flow chart shown in FIG. 19 was described as a procedure performed by a human monitor; however, this can also be applied in cases where monitoring is automatically performed by a monitoring device. Specifically, a monitoring device constructed as a computer device can be connected to the log management system, and the two sets of log information can be compared and analyzed by means of this monitoring device. In this case, the term “human monitor” in the descriptive text of the abovementioned flow chart may be changed to “monitoring device”.
1. A file server in which a first operating system and second operating system are respectively operated, comprising:
an inter-operating-system communications part which is used to exchange information between said first operating system and said second operating system;
a log information producing part which produces, in cases where settings are changed in the first operating system, log information relating to the change in the settings;
2. The file server according to claim 1, wherein said inter-operating-system communications part exchanges only specified instructions registered in a preset instruction table, and responses to these instructions, between said first operating system and said second operating system.
3. The file server according to claim 1, further comprising a discriminating information storage part which stores discriminating information that is used to discriminate whether or not said log information is to be transmitted to said second log management device, wherein said second log transmitting part transmits said log information to said second log management device via said second communications network in cases where an indication that said log information is to be transmitted to said second log management device is set in said discriminating information.
4. The file server according to claim 3, wherein said inter-operating-system communications part exchanges only specified instructions registered in a preset instruction table, and responses to these instructions, between said first operating system and said second operating system, and said specified instructions include instructions used to set said discriminating information.
5. The file server according to claim 3, wherein said first operating system is connected via said first communications network to a first setting terminal for performing said change in settings in said first operating system, said second operating system is connected via said second communications network to a second setting terminal that is used to set said discriminating information, and said discriminating information cannot be manipulated from said first setting terminal.
6. The file server according to claim 1, wherein said first log transmitting part transmits said log information to said first log management device in cases where said second log transmitting part transmits said log information to said second log management part.
7. The file server according to claim 1, further comprising a shared storage part that is used by both said first operating system and said second operating system, said produced log information is stored in said shared storage part from said first operating system, and said second log transmitting part acquires said log information from said shared storage part on the basis of a storage completion notification that is input from said first operating system via said inter-operating-system communications part, and transmits this log information to said second management device via said second communications network.
8. The file server according to claim 7, wherein said inter-operating-system communications part exchanges only specified instructions registered in a preset instruction table, and responses to these instructions, between said first operating system and said second operating system, and said specified instructions include said storage completion notification.
9. The file server according to claim 7, wherein said log information stored in said shared storage part is erased when said second log transmitting part transmits said log information acquired from said shared storage part to said second log management device.
10. The file server according to claim 1, wherein said first operating system can be provided in a plurality, and said log information producing part respectively produces log information for each of said first operating systems in cases where settings are changed in said respective first operating systems.
11. The file server according to claim 1, further comprising:
12. The file server according to claim 1, wherein said first communications network is constructed as a virtual communications network that is virtually disposed in a physical communications network.
13. A file server log management system constituting a log management system that is used to manage a log produced by a file server, said system comprising:
a kernel part which is disposed in said file server, and which is used for the respective transfer of information relating to log information between said plurality of virtual operating systems and said management operating system;
14. The file server log management system according to claim 13, wherein a discriminating information storage part which stores discriminating information that is used to discriminate whether or not said log information is to be transmitted to said second log management device is disposed in said file server, and wherein said second log transmitting part transmits said log information to said second log management device after said log information has been transmitted to said first log management device by said first log transmitting part in cases where an indication that said log information is to be transmitted to said second log management device is set in said discriminating information.
15. A file server log management system constituting a log management system that is used to manage a log produced by a file server, said system comprising:
16. A file server log management method for managing log information produced by a single file server in which a first operating system and a second operating system that is used to manage this first operating system respectively operate in parallel,
wherein a first setting terminal that is used to change settings in said first operating system and a first log management device that is used to acquire and store said log information produced by said first operating system are connected to said first operating system via a first communications network, and
producing and holding log information relating to changes in settings in cases where such settings are changed in said first operating system;
transferring said log information from said first operating system to said second operating system in cases where an indication that said log information is to be transmitted to said second log management device is set in said discriminating information;
17. The file server log management method according to claim 16, wherein in said step of producing and holding log information, said log information is stored in a shared storage part that is shared by said first operating system and said second operating system, and
18. The file server log management method according to claim 16, wherein said method further comprises, following the step of transmitting said log information from said first operating system to said first log management device via said first communications network, a step of acquiring said log information stored in said first log management device and said log information stored in said second log management device respectively, and a step of comparing said log information stored in said first log management device and said log information stored in said second log management device, and judging as to whether or not the contents of both sets of information agree.
US11329207 2005-11-22 2006-01-11 File server, file server log management system and file server log management method Active 2027-04-12 US7506375B2 (en)
JP2005-337632 2005-11-22
JP2005337632A JP4762693B2 (en) 2005-11-22 2005-11-22 File server, file server log management system and file server log management method
US12320727 US8869285B2 (en) 2005-11-22 2009-02-03 File server, file server log management system and file server log management method
US12320727 Continuation US8869285B2 (en) 2005-11-22 2009-02-03 File server, file server log management system and file server log management method
US20070118575A1 true true US20070118575A1 (en) 2007-05-24
US7506375B2 US7506375B2 (en) 2009-03-17
ID=36940608
US11329207 Active 2027-04-12 US7506375B2 (en) 2005-11-22 2006-01-11 File server, file server log management system and file server log management method
US12320727 Active 2028-02-15 US8869285B2 (en) 2005-11-22 2009-02-03 File server, file server log management system and file server log management method
US (2) US7506375B2 (en)
EP (1) EP1796011B1 (en)
JP (1) JP4762693B2 (en)
EP2034404B1 (en) * 2007-09-05 2017-04-12 HTC Corporation Method and system for supporting network sharing and data synchronization simultaneously
JP5497282B2 (en) * 2007-10-18 2014-05-21 株式会社日立製作所 Information providing method and advertisement providing method
JP2009110102A (en) * 2007-10-26 2009-05-21 Chugoku Electric Power Co Inc:The Log monitoring system and log monitoring method
CN104462955B (en) * 2014-12-25 2017-04-05 中国科学院信息工程研究所 Based on the virtualization host proactive behavior detection system and method
CN105607945A (en) * 2015-12-22 2016-05-25 中国科学院信息工程研究所 Asynchronous monitoring interception system and method of host behavior on the basis of virtualization
JPH08263330A (en) 1995-03-20 1996-10-11 Fujitsu Ltd Log accumulation system
JP2004164226A (en) * 2002-11-12 2004-06-10 Seer Insight Security Inc Information processor and program
JP2005025617A (en) * 2003-07-04 2005-01-27 Toshiba Corp History information management method and history information management device
JP4749255B2 (en) * 2006-07-03 2011-08-17 株式会社日立製作所 Control device for a storage system having a plurality of types of storage devices
US20090150455A1 (en) 2009-06-11 application
JP2007141171A (en) 2007-06-07 application
JP4762693B2 (en) 2011-08-31 grant
EP1796011B1 (en) 2011-08-03 grant
US7506375B2 (en) 2009-03-17 grant
EP1796011A1 (en) 2007-06-13 application
US8869285B2 (en) 2014-10-21 grant
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KANDA, AKITSUGU;AKAGAWA, ETSUTARO;ISHII, YOHSUKE;REEL/FRAME:017452/0533