New Relic第6章 第1節 - ログ管理の基礎理論と統合可観測性への理解 ​

// 例：Webアプリケーションでのエラー発生時
// APMが異常を検出 → 該当時刻のログを自動表示 → 根本原因特定

// ログ例（自動的にAPMと関連付けられる）
{
  "timestamp": "2025-07-26T14:30:15.123Z",
  "level": "ERROR", 
  "service": "checkout-service",
  "traceId": "abc123...",  // APMトレースと自動連携
  "spanId": "def456...",
  "message": "Payment processing failed",
  "error": {
    "type": "PaymentGatewayException",
    "message": "Connection timeout to payment provider",
    "stack": "...",
    "customAttributes": {
      "userId": "user_789",
      "amount": 15000,
      "paymentMethod": "credit_card"
    }
  }
}

// ビジネスメトリクスとログの統合分析
const businessInsights = {
    customerBehavior: {
        // 購入プロセスの離脱ポイント特定
        checkoutAbandonmentAnalysis: `
            SELECT count(*) as abandonments,
                   latest(logMessage) as lastAction
            FROM Log 
            WHERE service = 'checkout' 
            AND level = 'INFO'
            AND message LIKE '%user_action%'
            GROUP BY sessionId
            HAVING count(*) > 1 AND latest(action) != 'purchase_complete'
        `,
        
        // 機能利用状況とユーザー満足度の相関
        featureUsageCorrelation: `
            SELECT feature, 
                   count(*) as usage_count,
                   filter(count(*), WHERE level = 'ERROR') as error_count
            FROM Log 
            WHERE message LIKE '%feature_usage%'
            GROUP BY feature
        `
    }
};

// Node.js でのリアルタイム相関分析
const newrelic = require('newrelic');

class CorrelationAnalyzer {
    
    async analyzeSystemAnomaly(timestamp, anomalyType) {
        // 異常発生時刻前後のデータを統合分析
        const correlationWindow = {
            start: timestamp - (5 * 60 * 1000), // 5分前
            end: timestamp + (5 * 60 * 1000)    // 5分後
        };
        
        // マルチソースデータ取得
        const [metrics, traces, logs] = await Promise.all([
            this.getMetricsData(correlationWindow),
            this.getTracesData(correlationWindow), 
            this.getLogsData(correlationWindow)
        ]);
        
        // 相関分析実行
        const correlation = {
            // メトリクス異常パターン
            metrics_patterns: this.detectMetricPatterns(metrics),
            
            // トレース分析
            trace_analysis: this.analyzeTraceFlows(traces),
            
            // ログパターン分析
            log_patterns: this.detectLogAnomalies(logs),
            
            // 統合分析結果
            root_cause_candidates: this.correlateCauses(metrics, traces, logs)
        };
        
        // New Relicカスタムイベント記録
        newrelic.recordCustomEvent('SystemAnomalyAnalysis', {
            anomaly_type: anomalyType,
            correlation_score: correlation.confidence,
            root_cause: correlation.most_likely_cause,
            affected_services: correlation.impacted_services.join(',')
        });
        
        return correlation;
    }
    
    detectLogAnomalies(logs) {
        const patterns = {
            error_spikes: this.detectErrorSpikes(logs),
            new_error_types: this.detectNewErrorTypes(logs),
            performance_degradation: this.detectPerformanceLogs(logs),
            security_events: this.detectSecurityEvents(logs)
        };
        
        return patterns;
    }
}

// New Relicでの統合調査（所要時間: 5-15分）

// ステップ1: 異常検出アラートを受信（自動）
const incident = {
    alert_time: "2025-07-26T14:30:15Z",
    affected_service: "checkout-api",
    error_rate: "45%",
    trace_id: "abc123def456"  // 自動生成
};

// ステップ2: 統合ダッシュボードでワンクリック分析
const query = `
    SELECT *
    FROM Log, Transaction, Infrastructure
    WHERE timestamp BETWEEN '2025-07-26 14:25:00' AND '2025-07-26 14:35:00'
    AND (trace.id = '${incident.trace_id}' OR service = '${incident.affected_service}')
`;

// 自動的に以下が統合表示される:
const integrated_view = {
    logs: "全マイクロサービスのログを時系列で統合表示",
    apm_traces: "リクエストフローの可視化",
    infrastructure: "CPU、メモリ、ネットワークの状況",
    correlations: "自動相関分析による根本原因候補"
};

// ステップ3: AI支援による根本原因特定
const ai_analysis = {
    anomaly_detection: "過去のパターンとの比較で異常を特定",
    root_cause_suggestion: "最も可能性の高い原因を提示",
    remediation_steps: "過去の同様事例に基づく対処方法提案"
};

// Applied Intelligence による高度な分析例
const appliedIntelligence = {
    
    // 異常検出
    anomalyDetection: {
        baseline_learning: "正常パターンの自動学習",
        dynamic_thresholds: "動的閾値による精密な異常検出", 
        seasonal_patterns: "季節性パターンを考慮した分析",
        multivariate_analysis: "複数メトリクスの複合的異常検出"
    },
    
    // インシデント相関
    incidentCorrelation: {
        noise_reduction: "重複アラートの自動統合",
        root_cause_analysis: "因果関係の自動分析",
        impact_assessment: "ビジネス影響度の自動評価"
    },
    
    // 予測分析
    predictiveAnalysis: {
        capacity_forecasting: "容量計画のための予測分析",
        failure_prediction: "障害発生の事前予測",
        trend_analysis: "長期トレンド分析と予測"
    }
};

// SaaSアプリケーションでのユーザー行動分析
class SaaSUserExperienceAnalyzer {
    
    async analyzeFeatureUsage() {
        """機能利用状況とユーザー満足度の相関分析"""
        
        const usageAnalysis = await this.executeNRQL(`
            SELECT 
              feature_name,
              count(*) as usage_count,
              uniqueCount(user_id) as unique_users,
              average(session_duration) as avg_session_duration,
              filter(count(*), WHERE user_feedback = 'positive') as positive_feedback,
              filter(count(*), WHERE user_feedback = 'negative') as negative_feedback
            FROM Log
            WHERE service = 'app-core'
            AND message LIKE '%feature_usage%'
            AND timestamp >= 7 days ago
            GROUP BY feature_name
        `);
        
        // 機能別満足度スコア計算
        const featureInsights = usageAnalysis.map(feature => ({
            name: feature.feature_name,
            adoption_rate: feature.unique_users / this.getTotalActiveUsers(),
            satisfaction_score: feature.positive_feedback / (feature.positive_feedback + feature.negative_feedback),
            engagement_level: feature.avg_session_duration,
            business_value: this.calculateFeatureBusinessValue(feature)
        }));
        
        // 改善推奨事項の生成
        const improvements = this.generateImprovementRecommendations(featureInsights);
        
        return {
            feature_insights: featureInsights,
            improvement_recommendations: improvements,
            priority_actions: this.prioritizeActions(improvements)
        };
    }
    
    async detectChurnRiskUsers() {
        """ログパターンによる解約リスクユーザー検出"""
        
        const churnRiskQuery = `
            SELECT 
              user_id,
              count(*) as activity_count,
              latest(action) as last_action,
              max(timestamp) as last_activity,
              filter(count(*), WHERE level = 'ERROR') as error_count,
              filter(count(*), WHERE action = 'support_contact') as support_contacts
            FROM Log
            WHERE timestamp >= 30 days ago
            GROUP BY user_id
            HAVING activity_count < 5 OR error_count > 10 OR support_contacts > 3
        `;
        
        const riskUsers = await this.executeNRQL(churnRiskQuery);
        
        // リスクスコア計算とセグメント分類
        const riskAnalysis = riskUsers.map(user => {
            const riskScore = this.calculateChurnRiskScore(user);
            const intervention = this.recommendIntervention(riskScore, user);
            
            return {
                user_id: user.user_id,
                risk_score: riskScore,
                risk_category: this.categorizeRisk(riskScore),
                last_activity: user.last_activity,
                recommended_intervention: intervention
            };
        });
        
        // カスタマーサクセスチームへの自動通知
        await this.notifyCustomerSuccess(riskAnalysis);
        
        return riskAnalysis;
    }
}

// 開発チームの生産性向上効果測定
const developmentProductivityMetrics = {
    
    debuggingEfficiency: {
        // バグ修正時間の短縮
        before: {
            average_debug_time_hours: 6.5,
            context_gathering_time: 2.8,  // ログ収集・分析
            root_cause_identification: 2.9,
            fix_implementation: 0.8
        },
        
        after: {
            average_debug_time_hours: 2.1,
            context_gathering_time: 0.3,  // 統合ビューで即座に把握
            root_cause_identification: 1.0,  // AI支援による高速化
            fix_implementation: 0.8
        },
        
        improvement: "67%の時間短縮"
    },
    
    deploymentConfidence: {
        // デプロイメント後の安心感向上
        deployment_monitoring_setup_time: {
            before: "2-3時間（手動設定）",
            after: "5-10分（自動設定）"
        },
        
        post_deployment_validation: {
            before: "30-60分（手動チェック）",
            after: "5分（自動レポート）"
        },
        
        rollback_decision_time: {
            before: "15-30分（データ収集と分析）",
            after: "2-5分（リアルタイム可視化）"
        }
    }
};

// リアルタイム相関分析の実装例
class RealTimeCorrelationEngine {
    
    constructor() {
        this.correlationWindow = 5 * 60 * 1000; // 5分間のウィンドウ
        this.correlationThreshold = 0.7; // 相関係数の閾値
    }
    
    async performMultiDimensionalCorrelation(eventTimestamp) {
        """多次元相関分析の実行"""
        
        const timeWindow = {
            start: eventTimestamp - this.correlationWindow,
            end: eventTimestamp + this.correlationWindow
        };
        
        // 並列データ取得
        const [logs, metrics, traces, infrastructure] = await Promise.all([
            this.getLogsInWindow(timeWindow),
            this.getMetricsInWindow(timeWindow), 
            this.getTracesInWindow(timeWindow),
            this.getInfrastructureDataInWindow(timeWindow)
        ]);
        
        // 相関分析実行
        const correlations = {
            // ログ-メトリクス相関
            log_metric_correlation: await this.correlateLogs AndMetrics(logs, metrics),
            
            // ログ-トレース相関
            log_trace_correlation: await this.correlateLogsAndTraces(logs, traces),
            
            // ログ-インフラ相関
            log_infrastructure_correlation: await this.correlateLogsAndInfrastructure(logs, infrastructure),
            
            // 横断的パターン分析
            cross_dimensional_patterns: await this.findCrossDimensionalPatterns(logs, metrics, traces, infrastructure)
        };
        
        // 高相関イベントの特定
        const significantCorrelations = this.filterSignificantCorrelations(correlations);
        
        // 因果関係の推定
        const causalRelationships = await this.estimateCausalRelationships(significantCorrelations);
        
        return {
            correlations: significantCorrelations,
            causal_chains: causalRelationships,
            confidence_scores: this.calculateConfidenceScores(significantCorrelations),
            actionable_insights: this.generateActionableInsights(causalRelationships)
        };
    }
    
    async correlateLogsAndMetrics(logs, metrics) {
        """ログとメトリクスの相関分析"""
        
        // ログパターンの数値化
        const logFeatures = {
            error_frequency: this.calculateErrorFrequency(logs),
            warning_frequency: this.calculateWarningFrequency(logs),
            unique_error_types: this.countUniqueErrorTypes(logs),
            log_volume: this.calculateLogVolume(logs)
        };
        
        // メトリクス特徴量
        const metricFeatures = {
            response_time: metrics.response_time,
            cpu_utilization: metrics.cpu_utilization,
            memory_usage: metrics.memory_usage,
            error_rate: metrics.error_rate
        };
        
        // ピアソン相関係数計算
        const correlationMatrix = this.calculateCorrelationMatrix(logFeatures, metricFeatures);
        
        // 統計的有意性検定
        const significanceTests = this.performSignificanceTests(correlationMatrix);
        
        return {
            correlation_matrix: correlationMatrix,
            significant_correlations: significanceTests.significant,
            p_values: significanceTests.p_values,
            interpretation: this.interpretCorrelations(correlationMatrix)
        };
    }
}