Information processing device, information processing program, and information processing method
An information processing device includes: a collection unit configured to collect an event log corresponding to an event generated in a control system including at least one network; an extraction and specification unit configured to extract at least one event log corresponding to an event generated arising from an identical factor from the collected event log, and to specify an event log representing the event generated arising from the identical factor in the at least one event log extracted; and an output unit configured to output the event log representing the event generated arising from the identical factor and event logs corresponding to other events generated arising from the identical factor while distinguishing the event log representing the event generated arising from the identical factor and the event logs corresponding to other events generated arising from the identical factor from each other.
1. An information processing device comprising a processor configured with a program to perform operations comprising:
operation as a collection unit configured to collect a plurality of event logs corresponding to a plurality of events in a control system comprising at least one network;
operation as an extraction and specification unit configured to:
group the plurality of event logs into at least one group, each group comprising at least one event log such that each event, from among the plurality of events, corresponding to each event log in the group, arises from an identical factor by grouping the plurality of event logs such that each group comprises: one event log; or event logs having generation times that are close to each other; and
specify, for each group, a main event log from among the at least one event log in the group, the main event log corresponding to an event representing the identical factor; and
operation as an output unit configured to output, for each group:
the main event log; and
in response to the group comprising a plurality of event logs, at least one secondary event log corresponding to other events arising from the identical factor while distinguishing the main event log and the at least one secondary event log from each other, wherein the processor is configured with the program such that each of the plurality of event logs are issued according to at least one of: an abnormality of hardware constituting the control system; an abnormality of the at least one network included in the control system; and an abnormality of an application executed by the control system.
2. The information processing device according to claim 1 , wherein the processor is configured with the program such that operation as the output unit comprises operation as the output unit that, for each group, displays only the main event log.
3. The information processing device according to claim 2 , wherein the processor is configured with the program such that operation as the output unit comprises operation as the output unit that, for each group, in response to a selection of the main event log, outputs the at least one secondary event log.
4. The information processing device according to claim 3 , wherein the processor is configured with the program such that operation as the output unit comprises operation as the output unit that, for each group, hierarchically expresses the main event log and the at least one secondary event log.
5. The information processing device according to claim 1 , wherein the processor is configured with the program such that operation as the extraction and specification unit comprises operation as the extraction and specification unit that, for each group, specifies the main event log based on a network configuration of the control system.
6. The information processing device according to claim 1 , wherein each of the plurality of event logs comprises a content of the corresponding event, a generation time of the corresponding event, and a generation source of the corresponding event.
7. A non-transitory computer-readable storage medium storing an information processing program executed by a computer connected to a control system comprising at least one network, the information processing program causing a computer to perform operations comprising:
collecting a plurality of event logs corresponding to a plurality of events in the control system;
grouping the plurality of event logs into at least one group, each group comprising at least one event log such that each event, from among the plurality of events, corresponding to each event log in the group arises from an identical factor by grouping the plurality of event logs such that each group comprises: one event log; or event logs having generation times that are close to each other;
specifying, for each group, a main event log from among the at least one event log in the group, the main event log corresponding to an event representing the identical factor; and
outputting, for each group:
the main event log; and
in response to the group comprising a plurality of event logs, at least one secondary event log corresponding to other events arising from the identical factor while distinguishing the main event log and the at least one secondary event log from each other, wherein the processor is configured with the program such that each of the plurality of event logs are issued according to at least one of: an abnormality of hardware constituting the control system; an abnormality of the at least one network included in the control system; and an abnormality of an application executed by the control system.
8. An information processing method performed by an information processing device connected to a control system comprising at least one network, the information processing method comprising:
collecting a plurality of event logs corresponding to a plurality of events in the control system;
grouping the plurality of event logs into at least one group, each group comprising at least one event log such that each event, from among the plurality of events, corresponding to each event log in the group arises from an identical factor by grouping the plurality of event logs such that each group comprises: one event log; or event logs having generation times that are close to each other;
specifying, for each group, a main event log from among the at least one event log in the group, the main event log corresponding to an event representing the identical factor; and
outputting, for each group:
the main event log; and
in response to the group comprising a plurality of event logs, at least one secondary event log corresponding to other events arising from the identical factor while distinguishing the main event log and the at least one secondary event log from each other, wherein each of the plurality of event logs are issued according to at least one of: an abnormality of hardware constituting the control system; an abnormality of the at least one network included in the control system; and an abnormality of an application executed by the control system.
9. The method according to claim 8 further comprising outputting, for each group, only the main event log.
10. The method according to claim 9 , further comprising outputting, for each group, in response to a selection of the main event log, the at least one secondary event log.
11. The method according to claim 10 , further comprising, for each group, hierarchically expressing the main event log and the at least one secondary event log.
12. The method according to claim 8 , wherein specifying, for each group, the main event log comprises specifying, for each group, the main event log based on a network configuration of the control system.
13. The method according to claim 8 , wherein each of the plurality of event logs comprises a content of the corresponding event, a generation time of the corresponding event, and a generation source of the corresponding event.