Abstract: A generation unit that generates a new abstraction log based on the distribution of log values corresponding to a variable in an abstraction log is included. The abstraction log includes at least one or more variables. The variable includes at least one or more log values. The new abstraction log is obtained by replacing the variable in the abstraction log with the log value.

Abstract: A log monitoring unit configured to output an alert in a case where a log message to be monitored satisfies a predetermined condition, and an associated log extraction unit configured to extract an associated log that is a log associated with the alert from the log message based on the alert outputted by the log monitoring unit are included. The alert outputted by the log monitoring unit and information corresponding to the associated log extracted by the associated log extraction unit are outputted.

Abstract: Provided are a log analysis system, a log analysis method, and a storage medium that can generate information indicating a state of a system without requiring to manually define a state of the target system in advance. The log analysis system includes: a feature extraction unit that extracts at least one feature of a text log file including a plurality of text log messages corresponding to information in which an event in a target system and a time when the event occurred are associated with each other; and an index generation unit that, based on the feature and numerical data including numerical information related to the target system and a time when the numerical information was stored, generates an index indicating a state of the target system.

Abstract: The present invention provides a log analysis system, a log analysis method, and a log analysis program that can aggregate and output logs having a correlation. A log analyzing system 100 according to one example embodiment of the present invention includes a sequence determination unit 130 that determines which predetermined sequence is matched with a plurality of logs of an analysis target log 10; and a log aggregation unit 140 that, based on the sequence, aggregates and outputs the plurality of logs determined to match the sequence by the sequence determination unit.

Abstract: The present invention provides a log analysis method, a system, and a program that can accurately output information associated with a particular event without prior knowledge of a log content. A log analysis system 100 according to one example embodiment of the present invention includes: a log input unit 110 that inputs at least one analysis target log including a plurality of logs; a correlation determination unit 130 that determines presence or absence of a time series correlation between the plurality of logs within a predetermined time range before or after an event; and an event detection unit 140 that detects the event based on a result of the determination by the correlation determination unit. Therefore, the log analysis system outputs information on a known event without using prior knowledge of the log content (meaning of a log message or the like).

Abstract: The present invention provides an anomaly detection method, an anomaly detection system, and an anomaly detection program that can detect an anomaly at high accuracy by using log output quantity distributions generated for to different aggregate units and different devices. An anomaly detection system according to one example embodiment of the present invention has: a reference distribution, which is a time-series distribution of a log output quantity acquisition unit that acquires a plurality of distributions generated for each device that outputs logs and for each unit of a time range in which logs are aggregated; and an anomaly detection unit that detects an anomaly by using the plurality of distributions.

Abstract: A log analysis system according to one example embodiment of the present invention includes: a log input unit that inputs first logs as an analysis target log; a first order-determination unit that determines first order that is occurrence order of first partial logs having an identifier indicating being associated with each other out of logs included in the first logs; a second order-determination unit that determines second order that is occurrence order of logs not having the identifier out of logs included in second logs obtained by removing the first partial logs from the first logs; and a third order-output unit that outputs third order that is occurrence order of logs included in the analysis target log by using the first order and the second order.

Abstract: In order to specify and analyze a failure occurring in an information processing system with a high degree of accuracy, an log analysis system includes an analysis unit comparing a structural pattern of a log message group constituted by at least one log message with a known pattern, and associating, with the structural pattern of the log message group, reference information including information about the known pattern matching a structural pattern of another log message group supplementary the log message group, and a pattern generation unit generating a new pattern from the log message group having a structural pattern different from the known pattern in accordance with an analysis result given by the analysis unit.

Abstract: The present invention provides a log analysis method, a log analysis system, and a log analysis program that can cause multiple types of analysis to cooperate to analyze an anomaly of logs in a stepwise manner. The log analysis system according to one example embodiment of the present invention includes: a simple anomaly analysis unit that performs first analysis to detect an anomaly based on output of logs; and a detail anomaly analysis unit that performs second analysis to analyze the anomaly based on contents of the logs output within a time range including occurrence time of the anomaly detected by the first analysis.

Abstract: The present invention provides a log analysis system, a log analysis method, and a log analysis program that can determine whether or not to disregard an abnormal log based on a situation where the abnormal log was output. A log analysis system 100 according to one example embodiment of the present invention includes an anomaly instance information storage unit 173 that records information indicating a situation where a log disregarded based on a past user input was output; and a disregard determination unit 140 that, when information indicating a situation where a log to be determined was output is similar to the information indicating the situation where the disregarded log was output, determines to disregard the log to be determined.

Abstract: An objective of the present invention is to appropriately extract, or assist in extracting, a normal operation pattern from a normal operation log. A log file including information wherein a plurality of log records is ordered in time series is segmented into a plurality of log groups according to prescribed rules. A plurality of patterns which are configured by a plurality of events which are contiguous in time series is extracted from the plurality of log groups, and the patterns are associated with frequency information which represents how many log records the pattern is extracted from. The pattern to be outputted from the plurality of patterns is selected on the basis of an inclusion relation between the plurality of events which are contiguous in time series and configure a given pattern and the plurality of events which are contiguous in time series and configure other patterns, and on the basis of the frequency information which is associated with the patterns.

Abstract: A log analysis system according to of the present invention is a log analysis system for performing analysis of an analysis target log including a periodic log output at a cycle, the log analysis system including: a form determination unit that determines a form of each of logs included in the analysis target log; a temporal distribution acquisition unit that aggregates a temporal frequency of appearance of the logs for each form; a cycle determination unit that determines the cycle for each form based on the temporal frequency of appearance; and a model learning unit that extracts, out of the logs, a log which is included in a time range including the cycle as the periodic log for each form and, based on the form and the cycle of the periodic log, generates information used as a reference as to whether or not the log is abnormal.

Abstract: The present invention provides log analysis system, method, and program that can output information suggesting a cause of an anomaly even when a rule indicating a cause of the anomaly has not been defined. A log analysis system 100 according to one example embodiment of the present invention includes a format determination unit 120 that determines which of a plurality of predetermined forms is matched with each log included in an analysis target log; a component classification unit 130 that extracts components from each log included in the analysis target log, collects the number of occurrences of the components in the analysis target log for each of the forms, and performs classification of the components based on the number of occurrences for each of the forms; and a weighting unit 150 that performs weighting of the analysis target log based on the classification of the components.

Abstract: In order to specify and analyze a failure occurring in an information processing system with a high degree of accuracy, an log analysis system includes an analysis unit comparing a structural pattern of a log message group constituted by at least one log message with a known pattern, and associating, with the structural pattern of the log message group, reference information including information about the known pattern matching a structural pattern of another log message group supplementary the log message group, and a pattern generation unit generating a new pattern from the log message group having a structural pattern different from the known pattern in accordance with an analysis result given by the analysis unit.

Abstract: An apparatus includes: a log element extraction unit that extracts a log element from log information a combined unit that attaches, to each of the log elements, related system constituent element information and combine the log elements; a pattern extraction unit that extracts a pattern from the combined log information; a conversion unit, when an analysis target pattern includes system constituent element information of conversion target not included in a comparison target pattern, that performs conversion between the system constituent element information of the conversion target and the system constituent element information similar to the conversion target in the comparison target pattern or the analysis target pattern; a comparison unit that detects a difference the analysis target pattern and the comparison target pattern; and a presenting unit that presents, as a portion of a cause of a fault, the system constituent element information indicated by the difference.

Abstract: An objective of the present invention is to appropriately extract, or assist in extracting, a normal operation pattern from a normal operation log. A log file including information wherein a plurality of log records is ordered in time series is segmented into a plurality of log groups according to prescribed rules. A plurality of patterns which are configured by a plurality of events which are contiguous in time series is extracted from the plurality of log groups, and the patterns are associated with frequency information which represents how many log records the pattern is extracted from. The pattern to be outputted from the plurality of patterns is selected on the basis of an inclusion relation between the plurality of events which are contiguous in time series and configure a given pattern and the plurality of events which are contiguous in time series and configure other patterns, and on the basis of the frequency information which is associated with the patterns.

Abstract: An apparatus includes: a log element extraction unit that extracts a log element from log information a combined unit that attaches, to each of the log elements, related system constituent element information and combine the log elements; a pattern extraction unit that extracts a pattern from the combined log information; a conversion unit, when an analysis target pattern includes system constituent element information of conversion target not included in a comparison target pattern, that performs conversion between the system constituent element information of the conversion target and the system constituent element information similar to the conversion target in the comparison target pattern or the analysis target pattern; a comparison unit that detects a difference the analysis target pattern and the comparison target pattern; and a presenting unit that presents, as a portion of a cause of a fault, the system constituent element information indicated by the difference.

Abstract: A log acquisition unit (106) determines log types to be extracted from logs of a monitoring target system, on the basis of a type definition (112) and input information acquired by an input unit (104), thereby creating first log data. A log distribution estimation unit (108) estimates a distribution density function, which indicates actual distribution, in second log data which is extracted on the basis of the type definition (112) and the first log data. The log distribution estimation unit (108) selects a range, which satisfies a specific condition, in the distribution density function, thereby creating third log data from the second log data. A resource usage rate prediction unit (110) calculates predicted values of resource usage rates from a load definition (114) and a prediction expression of the resource usages calculated on the basis of the third log data of a certain threshold value or more.