JP2013175220A - Storage device and log management program - Google Patents

Abstract

System errors are dealt with in a short time to improve maintainability, and past log information required for security audits can be used.
A storage apparatus 1 having a storage server 11 for managing data in storage media 12 and 13, wherein the storage server records a log at the time of normal operation and a log at the time of error occurrence. And a first storage medium 110 that stores a second log file 112 that records a log when a system error occurs. The log when the system error occurs is included in both the first log file and the second log file. The old log in the first and second log files recorded and stored in the first storage medium at a predetermined timing was backed up and backed up to the second storage medium 130 outside the storage server. Data corresponding to the old log is deleted from the first and second log files.
[Selection] Figure 2

Description

  The present invention relates to a storage apparatus and a log management program.

  In recent years, with the progress of digitalization, the amount of information (digital data) in various fields including companies has been rapidly increasing. Specifically, for example, medical image information in hospitals, various electronic documents and long-term storage documents in national and local governments, design data such as CAD / CAM in the field of manufacturing and architecture, digital images and articles in the field of broadcasting, newspapers and publishing A large amount of digital data such as data and electronic books, or images and video contents and e-mail related information by Internet providers are used in various fields.

  An archive storage device is provided as a storage device that stores such a large amount of digital data while achieving both low cost and high speed access.

  FIG. 1 is a block diagram schematically illustrating an example of a storage system including a storage apparatus, and schematically illustrates a CAM (Content Archive Manager) system including an archive storage apparatus as an example of the storage apparatus. It is.

  1, reference numeral 1 is an archive storage device (storage device), 11 is a CAM server (storage server), 12 is a disk array (hard disk array), 13 is a tape medium, 21, 22,... Are CAM clients (clients). Reference numeral 3 denotes a LAN (network).

  As shown in FIG. 1, the archive storage device 1 includes a CAM server 11, a disk array 12, and a tape medium 13. The CAM server 11 combines the disk array 12 and the tape medium 13 to efficiently store and manage a large amount of digital data. Processing is executed according to a program installed in the CAM server 11. The CAM server 11 includes a CPU, a memory such as a RAM and a ROM (not shown), an I / O device, and a built-in hard disk 110 shown in the figure.

  That is, the data storage in the archive storage device 1 is performed, for example, by automatically copying the data stored in the disk array 12 to the tape medium 13 and securely storing it as original information. In general, the archive storage device 1 employs a write once (WORM) structure so that information once stored is completely protected from data tampering and erroneous erasure.

  Also, the archive storage device 1 is provided with management information for identification to save data in order to promote the reuse of the saved information. For example, information saved in the tape medium 13 which is a secondary tier storage can be stored in another system. Various functions are also provided such that the information can be read or the stored information can be transferred to a next-generation storage device or media standard.

  Here, the disk array 12 is configured as a raid device having a plurality of hard disk drives, and the tape medium 13 is a predetermined number (for example, several tens) of magnetic tapes having a predetermined capacity (for example, several hundred gigabytes). It consists of a cartridge. As this tape medium 13, for example, a large-capacity storage medium such as HD-DVD or a braille is used instead, or in addition to the tape medium 13, a large-capacity storage medium may be provided to constitute the archive storage apparatus 1. Needless to say.

  The CAM server 11 stores, for example, logs from each CAM client 21, 22,... And various errors as an access log file in the built-in hard disk 110 of the CAM server 11.

  In the CAM system, the CAM clients 21, 22,..., For example, use a dedicated API (Application Program Interface) to prohibit intrusion from unauthorized servers and use of data, and save information with the same name. By managing the re-archiving as separate content information, updates and tampering are prevented.

  By the way, in a conventional information recording apparatus in which an access log or the like is recorded, an unload instruction is issued from the host device as a device that reliably stores data until the storage expiration without managing the storage location and storage expiration by the host or operator. Is issued (for example, once a day), one of the unused magnetic tapes whose volume management information is registered in the unused volume pool is mounted on the drive, and the current date is related. In addition to assigning a volume name, the volume management information is changed from the unused volume pool to the labeled volume list, and the number of volume management information registered in the labeled volume list is a predetermined value (for example, 365 if the retention period is 1 year). ) If this is the case, the volume management information with the old registration time is used Which replace has been proposed (e.g., see Patent Document 1).

JP 2005-332043 A

  As described above, a storage device (archive storage device) that efficiently stores and manages a large amount of digital data by combining the disk array 12 and the tape medium 13 by the CAM server 11 has been conventionally provided.

  The CAM server 11 stores, for example, logs from each CAM client 21, 22,... And various errors as an access log file in the built-in hard disk 110 of the CAM server 11.

  By the way, in recent years, it has become necessary to perform security audits for auditing illegal access and illegal take-out of data and log analysis that goes back to the past. However, the conventional archive storage apparatus may not be able to output information necessary for performing a security audit, for example.

  That is, in the conventional archive storage apparatus, a log at the time of normal operation such as “what, when, from what host (CAM client), what is operated for which archive ID, and what result is obtained”. In addition, it is impossible to output the error status of login using an incorrect password, and it is difficult to check the past access status.

  Conventionally, log information is not so important, and when a predetermined area of the internal hard disk 110 in the CAM server 11 that records the log becomes full, the old log is deleted in order and a new log is recorded. It was. Conventionally, such log information has not been backed up.

  For this reason, the conventional CAM server 11 can refer only to the log recorded in the internal hard disk 110 and cannot refer to the old log exceeding the predetermined area of the internal hard disk 110.

  Furthermore, the conventional CAM server 11 cannot secure a memory of a predetermined size, for example, when performing a certain process, or an error message appears when data is written to the tape medium 13, and cannot be written. There was no dedicated log management for system errors.

  Here, most of the logs recorded in the internal hard disk 110 in the CAM server 11 are logs during normal operation, and it is not easy to find a log relating to a system error from such a large number of logs during normal operation. It took a long time to find and deal with a log related to a system error, resulting in a decrease in maintainability.

  SUMMARY OF THE INVENTION The present invention has been made in view of the above-described problems of the prior art, and provides a dedicated log file for recording a system error so that the system error can be dealt with in a short time to improve maintainability. Another object of the present invention is to make it possible to use past log information required for security audits and the like by backing up old log information recorded on the internal hard disk of the storage server to an external tape medium or the like. And

  According to the first aspect of the present invention, there is provided a storage apparatus having a storage server that manages data in a storage medium, wherein the storage server records a log at the time of normal operation and a log at the time of error occurrence. And a first storage medium storing a second log file for recording a log when a system error occurs, and the log when the system error occurs includes both the first log file and the second log file And backs up old logs in the first and second log files stored in the first storage medium at a predetermined timing to a second storage medium provided outside the storage server. The data corresponding to the backed up old log is stored in the first storage medium in the first and second logs. Storage apparatus designed to remove from the file is provided.

  According to the second aspect of the present invention, the normal operation stored in the storage server's internal storage medium at a predetermined timing in the storage server having a storage server that manages data in the storage medium A first log file for recording a log at the time of occurrence and a log at the time of occurrence of an error, and a second log file for recording a log at the time of occurrence of a system error. The procedure recorded in both the first log file and the second log file, and the old log in the first and second log files stored in the internal storage medium provided outside the storage server Back up to a storage medium and store the data corresponding to the backed up old log A step of deleting from the built storage medium stored in the first and second log file, is executed, the log management program to perform the management of the log is provided.

  According to the present invention, by providing a dedicated log file for recording a system error, it is possible to deal with the system error in a short time and improve maintainability. Furthermore, according to the present invention, the old log information recorded on the internal hard disk of the storage server is backed up to an external tape medium or the like, so that it is possible to use past log information required for security audits, etc. It becomes.

1 is a block diagram schematically illustrating an example of a storage system including a storage device. 1 is a block diagram schematically showing an embodiment of a storage apparatus according to the present invention. It is a flowchart for demonstrating one form of the log management process in the storage apparatus which concerns on this invention. 4 is a flowchart for explaining an example of error processing in the storage apparatus according to the present invention. It is a flowchart for demonstrating the other form of the log management process in the storage apparatus which concerns on this invention. It is a flowchart for demonstrating an example of the list display process in the storage apparatus which concerns on this invention. 5 is a flowchart for explaining an example of a restore process in the storage apparatus according to the present invention. It is a figure for demonstrating the example of the medium which recorded the log management program and log management program to which this invention is applied.

  Embodiments of a storage apparatus and a log management program (log management method) according to the present invention will be described below in detail with reference to the accompanying drawings.

FIG. 2 is a block diagram schematically showing an embodiment of the storage apparatus according to the present invention.
The storage device (archive storage device) 1 of this embodiment basically has the same hardware configuration as that described with reference to FIG. 1, and includes a CAM server (storage server) 11, a disk array (first A large-capacity storage medium) 12 and a tape medium (second large-capacity storage medium) 13.

  The CAM server 11 combines the disk array 12 and the tape medium 13 to efficiently store and manage a large amount of digital data. Processing is executed according to a program installed in the CAM server 11. As described above, the CAM server 11 includes a CPU, a memory such as a RAM and a ROM (not shown), an I / O device, and a built-in hard disk 110 shown in the figure. The configuration and functions of the archive storage system including the archive storage device 1 and the CAM clients (21, 22,...) Are basically the same as those described with reference to FIG.

  Here, in the archive storage apparatus 1 described with reference to FIG. 1, for example, a log during normal operation such as access from each CAM client 21, 22,. (Access log file) was recorded in the internal hard disk (third storage medium, internal storage medium) 110 of the CAM server 11.

  On the other hand, the archive storage device 1 (CAM server 11) of the present embodiment logs the normal operation log on the internal hard disk 110 of the CAM server 11 as described later with reference to FIGS. In addition to the access log file 111 that records logs such as when errors occur, a dedicated log file (error log file) 112 that records only logs when errors occur, particularly when system errors occur, is provided (stored). It is like that.

  Further, the archive storage device 1 (CAM server 11) of the present embodiment stores old log information recorded in the internal hard disk 110 of the CAM server 11 as a tape medium (first medium) as described later with reference to FIGS. (4 storage medium, external storage medium) 130 so that past log information required for security audits and the like can be used. Needless to say, backup of old log information is not limited to the tape medium 130, and HD-DVD, Blu-ray, or other storage media can be used.

  FIG. 3 is a flowchart for explaining one form of log management processing in the storage apparatus according to the present invention, for explaining log recording processing when an error occurs.

  As shown in FIG. 3, in the storage apparatus according to the present invention, when an error occurs, first, in step ST11, a log output function is generated, and the process further proceeds to step ST12, where log information is stored in the access log file 111. Output. That is, log information is recorded in the area for the access log file 111 in the internal hard disk 110 of the CAM server 11. Here, the access log file 111 records not only an error occurrence log but also a normal operation log, which is recorded on the internal hard disk 110 of the conventional CAM server 11 described above. Corresponds to the log to be generated.

  Next, the process proceeds to step ST13 to determine the error type. That is, in step ST13, if it is determined that the error type is an error unrelated to the system (for example, a system input error) such as a password input error, the process is terminated.

  On the other hand, in step ST13, for example, a memory of a predetermined size cannot be secured when performing certain processing, or an error message appears when data is written to the tape medium 13, and writing cannot be performed. If it is determined that the error is related to the system (system error), the process proceeds to step ST14, where log information (error log information) is output to the error log file 112, and the process is terminated. That is, log information is recorded in an area for the error log file 112 in the internal hard disk 110 of the CAM server 11.

  Therefore, the system error log is recorded in both the access log file 111 and the error log file 112. Note that only the system error log is recorded in the error log file 112.

  FIG. 4 is a flowchart for explaining an example of error processing in the storage apparatus according to the present invention.

  As shown in FIG. 4, when a system error occurs, in step ST21, for example, the system administrator refers to the error log file 112 and performs error handling. Here, since the normal log is not included in the error log file 112, the system administrator can easily refer to the system error log and can deal with the system error in a short time. become.

  Next, proceeding to step ST22, for example, the system administrator executes a reset of the error log file 112, whereby the error log file 112 becomes empty, and the process ends. As a result, the system administrator can easily refer to the log of the next system error.

  As described above, according to the present embodiment, for example, a memory of a predetermined size cannot be secured when performing a certain process, or an error message appears and data can be written when data is written to the tape medium 13. Even when a system error such as no system error occurs, the system error log can be easily referred to by referring to the error log file 112, and the system error can be dealt with in a short time.

  FIG. 5 is a flowchart for explaining another form of the log management processing in the storage apparatus according to the present invention, for explaining the log backup processing performed at a predetermined timing.

  As shown in FIG. 5, in the storage apparatus according to the present invention, for example, backup of the log file (access log file) 120 in the internal hard disk 110 of the CAM server 11 at a predetermined timing such as 12:00 every day or 1st of every month. Processing is executed. In step ST31, the backup function first obtains the previous backup date from the backup management list and proceeds to step ST32. Here, the backup management list is recorded in the built-in hard disk 110 of the CAM server 11, and is read out.

  Next, in step ST32, today's date is acquired, and the process proceeds to step ST33 to extract data to be backed up. That is, for example, logs from the previous backup date obtained in step ST31 to today's date obtained in step ST32 are extracted as backup target data.

  Further, the process proceeds to step ST34, and the data to be backed up (log information from the previous backup date to today's date) is copied from the built-in hard disk 110 (access log file 111) of the CAM server 11 to the dedicated tape medium 130. (Backup) and then proceed to step ST35.

  In step ST35, the backup management list is updated, the process proceeds to step ST36, the old backup data is deleted, the new data is left in the built-in hard disk 110 of the CAM server 11, and the process is terminated. Here, the log information remaining in the internal hard disk 110 may be only a new log excluding data backed up from the internal hard disk 110 to the tape medium 130 in step ST34. For example, the log information may be a predetermined one week or one month. The log information for this period may be left in the internal hard disk 110 and the log for the predetermined period may be recorded on both the internal hard disk 110 and the tape medium 130.

  In the above, the log file backup timing from the internal hard disk 110 to the tape medium 130 is not limited to 12:00 every day or the first day of every month, and can be changed as appropriate, and various backup capacities are set. be able to.

  FIG. 6 is a flowchart for explaining an example of list display processing in the storage apparatus according to the present invention.

  For example, when performing a security audit, as shown in FIG. 6, first, a list is displayed at an arbitrary timing when such a security audit is required. That is, in step ST41, the backup data storage location of the backup date and time is acquired from the backup management list recorded on the internal hard disk 110 of the CAM server 11 described above. Here, if the required log is included in the log file (access log file 111) recorded in the internal hard disk 110, the log is read out from the internal hard disk 110 as it is, but the old log has already been backed up to the tape medium 130. If so, a list of log information recorded on the tape medium 130 is displayed and the process is terminated.

  FIG. 7 is a flowchart for explaining an example of restore processing in the storage apparatus according to the present invention.

  For example, a security audit can be performed to confirm the time when fraud is detected, and when the log at the time of fraud is deleted from the internal hard disk 110 of the CAM server 11 and backed up only to the tape medium 130, the restore function is used. Become. That is, first, in step ST51, the backup data storage location at the specified date and time is searched from the backup management list recorded on the internal hard disk 110 of the CAM server 11, and the process proceeds to step ST52. It is assumed that the necessary log at the time of fraud detection is included in the backup backup data of the tape medium 130.

  In step ST52, the backup data is copied from the tape medium 130 to the internal hard disk 110, and the process ends. Note that the necessary log at the time of fraud detection is read from the copied internal hard disk 110 and referred to.

  FIG. 8 is a diagram for explaining an example of a log management program to which the present invention is applied and a medium on which the log management program is recorded. In FIG. 8, reference numeral 10 denotes a processing device, 20 denotes a program (data) provider, and 30 denotes a portable recording medium.

  The present invention is given as a program (data) for the processing device 410 (CAM server 11) as shown in FIG. The processing device 410 includes an arithmetic processing device main body 411 including a processor, and a processing device side memory (for example, a RAM (Random Access Memory) that stores a result of giving or processing a program (data) to the arithmetic processing device main body 411. ) And hard disk) 412 and the like. The program provided to the processing device 410 is loaded and executed on the main memory of the processing device 410.

  The program provider 420 has means (line-destination memory: for example, DASD (Direct Access Storage Device)) 421 for storing the program, and provides the program to the processing device 410 via a line such as the Internet, or The data is provided to the processing device 410 via a portable recording medium 430 such as an optical disk such as a CD-ROM or DVD, a magnetic disk, or a magnetic tape. Needless to say, the medium on which the log management program according to the present invention is recorded includes the processing device side memory 412, the line destination memory 421, the portable recording medium 430, and the like.

(Appendix 1)
A storage device having a first mass storage medium, a second mass storage medium, and a storage server that manages data in the first and second mass storage media,
The storage server has a third storage medium for storing an access log file for recording a log for normal operation and an error occurrence log, and a dedicated error log file for recording only a log for system error occurrence. A storage apparatus comprising:

(Appendix 2)
A storage device having a first mass storage medium, a second mass storage medium, and a storage server that manages data in the first and second mass storage media,
The storage server includes a third storage medium that stores a log file that records a log during normal operation and a log when an error occurs,
The old log in the log file stored in the third storage medium at a predetermined timing is backed up to a fourth storage medium provided outside the storage server, and the data corresponding to the backed up old log Is deleted from the log file stored in the third storage medium.

(Appendix 3)
In the storage device according to appendix 1 or 2,
The first mass storage medium is a hard disk array;
The second mass storage medium is a tape medium;
The storage device, wherein the third storage medium is a hard disk built in the storage server.

(Appendix 4)
A storage server log management method for managing data in a first mass storage medium and a second mass storage medium,
Record the log at the time of error occurrence in the access log file together with the log at normal operation,
Determining whether the error is a system error;
When the error is determined to be a system error, a log at the time of occurrence of the system error is recorded in a dedicated error log file.

(Appendix 5)
A storage server log management method for managing data in a first mass storage medium and a second mass storage medium,
Check the log file stored in the internal storage medium of the storage server at a predetermined timing,
The old log in the log file stored in the internal storage medium is backed up to an external storage medium provided outside the storage server, and the data corresponding to the backed up old log is stored in the internal storage medium A log management method characterized by deleting from a file.

(Appendix 6)
The storage server in the storage device having a first mass storage medium, a second mass storage medium, and a storage server that manages data in the first and second mass storage media,
A procedure for recording an error log in an access log file together with a log for normal operation;
Determining whether the error is a system error; and
When the error is determined to be a system error, a log management program that executes a procedure for recording a log at the time of occurrence of the system error in a dedicated error log file to perform log management.

(Appendix 7)
The storage server in the storage device having a first mass storage medium, a second mass storage medium, and a storage server that manages data in the first and second mass storage media,
A procedure for confirming a log file stored in a built-in storage medium of the storage server at a predetermined timing;
The old log in the log file stored in the internal storage medium is backed up to an external storage medium provided outside the storage server, and the data corresponding to the backed up old log is stored in the internal storage medium And a log management program for executing log management.

(Appendix 8)
A medium on which the log management program according to appendix 6 or 7 is recorded.

  The present invention can be widely applied to various storage apparatuses including an archive storage apparatus. For example, medical image information in hospitals, various electronic documents and long-term storage documents in national and local governments, manufacturing and architecture fields Stores and manages a large amount of digital data such as CAD / CAM design data, digital video / article data and e-books in the broadcasting, newspaper and publishing fields, or image / video content and e-mail related information from Internet providers The present invention is applied to a storage device and a storage server provided in the storage device.

1 Storage device (archive storage device)
11 Storage server (CAM server)
12 Disk array (Hard disk array: Raid device)
13,130 Tape medium 21,22 Client (CAM client)
3 LAN
110 Internal hard disk 111 Access log file 112 Error log file 410 Processing device (CAM server)
411 arithmetic processing unit main body 412 processing unit side memory 420 program (data) provider 421 means for storing program (line destination memory)
430 Portable recording medium

Claims (4)

A storage device having a storage server for managing data in a storage medium,
The storage server comprises a first storage medium storing a first log file for recording a log for normal operation and a log for when an error occurs, and a second log file for recording a log for when a system error occurs,
The log when the system error occurs is recorded in both the first log file and the second log file,
The old log in the first and second log files stored in the first storage medium at a predetermined timing is backed up to a second storage medium provided outside the storage server and the backed up A storage apparatus, wherein data corresponding to an old log is deleted from the first and second log files stored in the first storage medium. The storage apparatus according to claim 1, wherein
The storage device, wherein the first storage medium is a hard disk built in the storage server. In the storage server in the storage device having a storage server for managing data in the storage medium,
A first log file for recording a log for normal operation and a log for when an error occurs, and a second log for recording a log for when a system error occurs, stored in the internal storage medium of the storage server at a predetermined timing A procedure for confirming a log file, wherein the log when the system error occurs is recorded in both the first log file and the second log file;
The old log in the first and second log files stored in the internal storage medium is backed up to an external storage medium provided outside the storage server, and data corresponding to the backed up old log is stored in the internal storage A log management program for executing log management by executing a procedure for deleting from the first and second log files stored in the medium. The log management program according to claim 3,
The log management program, wherein the built-in storage medium is a hard disk built in the storage server.

Images