Metric recommendations in an event log analytics environment

Patent metadata

Field	Value
Publication number	US-10061816-B2
Application number	US-201514709032-A
Country	US
Kind code	B2
Filing date	May 11, 2015
Priority date	May 11, 2015
Publication date	Aug 28, 2018
Grant date	Aug 28, 2018

Abstract

A system and method are disclosed for providing metric recommendations by a cloud event log analytics system. The log analytics system includes a user interface which allows users to view metric recommendations, view, modify, annotate, delete, or create log metrics. In a first embodiment, centroid vectors are created from metadata associated with user access of log metrics. The centroid vectors are compared to metrics vectors created from log metrics and the results are ranked and provided to users as metric recommendations. In a second embodiment, classification rules are inferred for metric matrix tables containing metadata about log metric usage. Classification rules are assigned to a decision tree used to calculate composite probabilities of interest of log metrics. A recommendation matrix incorporate the composite probabilities of interest to predict the degree of interest an analytics user may have in a log metric for a given role.

First claim

What is claimed is:

1. A computer executed method for generating log metric recommendations for a user of a log analytics system, the method comprising:
storing in a database a plurality of log metrics, each log metric defining a query on a database of log events in an enterprise system, each log metric having a metric name, a metric description, and one or more metric parameters;
storing in the database metric usage data indicating usage of the log metrics by users;
for each log metric in the database, generating a metric vector comprising a term vector having plurality of term weights, wherein the terms of the term vectors are selected from terms used in the metric name, metric description, or the one or more metric parameters, and wherein the term weights correspond to a measure of frequency of the terms appearing in the log metric;
querying the database metric usage data to select metric vectors used by the user and generating a user vector for the user as a centroid of the selected metric vectors;
selecting a target set of log metrics from the database and determining a corresponding set of metric vectors;
for each metric vector in the set of metric vectors, generating a similarity score between the metric vector and the user vector;
ranking the metric vectors in the set of metric vectors based on their similarity scores to obtain one or more highest ranking metric vectors; and
displaying an output in the log analytics system of at least one log metric corresponding to at least one of the one or more highest ranking metric vectors.

2. The method of claim 1 , further comprising determining a user classification by one or more of:
assignment of user classification selected by the user through a user interface;
assignment of user classification through account information at the time of registration; or
assignment of user classification through a clustering of log metrics by a clustering algorithm.

3. The method of claim 2 , wherein the clustering algorithm is a k-prototype clustering algorithm.

4. The method of claim 1 , wherein term weights are generated using a term-frequency or inverse document frequency value for each term.

5. The method of claim 1 , wherein values of log metric terms are extracted from event logs.

6. The method of claim 1 , wherein each log metric is structured according to a metric parameterization model.

7. The method of claim 1 , wherein values of terms from the term vector are populated with values of terms from the log metric.

8. The method of claim 1 , wherein values of terms from the term vector are populated with values from a metric query table.

9. The method of claim 8 , wherein the metric query table is a chronological record of log metric access by users of the log analytics system.

10. The method of claim 1 , wherein log metrics are accessed through a user interface, the user interface comprising:
a first display interface configured to display recommended log metrics;
a second display interface configured to display log metrics; and
an editing interface configured to receive edits of log metrics.

11. A computer executed method for generating log metric recommendations for a user of a log analytics system, the method comprising:
storing in a database a plurality of log metrics, each log metric defining a query on a database of log events in an enterprise system, each log metric having a metric name, metric description, and one or more metric parameters;
storing in the database metric usage data indicating usage of the log metrics by users, each user having a role in a plurality of organizational roles;
for each log metric in the database, generating a metric vector comprising a term vector having plurality of term weights, wherein the terms of the term vectors are selected from terms used in the metric name, metric description, or the one or more metric parameters, and wherein the term weights correspond to a measure of frequency of the terms appearing in the log metric;
querying the database metric usage data to select metric vectors used by the user and generating a user vector for the user as a centroid of the selected metric vectors;
selecting a target set of log metrics from the database and determining a corresponding set of metric vectors;
for each role in the plurality of organization roles:
querying the database metric usage data to select metric vectors used by users in the role and generating a role vector for the role as a centroid of the selected metric vectors;
for each metric vector in the set of metric vectors, generating a similarity score between the metric vector and the role vector; and
ranking the metric vectors in the set of metric vectors based on their similarity scores to the role vector to determine one or more highest ranking metric vectors for the role vector;

for each role vector, generating a second similarity score between the role vector and the user vector;
ranking the role vectors based on their second similarity scores, to determine a highest ranking role vector for the user vector;
querying the database for the one or more highest ranking metric vectors for the highest ranked role vector; and
displaying an output in the log analytics system of at least one log metric corresponding to at least one of the one or more highest ranking metric vectors.

12. A computer executed method for generating log metric recommendations for a user of a log analytics system, the method comprising:
storing in a database a plurality of log metrics, each log metric defining a query on a database of log events in an enterprise system, each log metric having a metric name, metric description, and one or more metric parameters;
storing in the database metric usage data indicating usage of the log metrics by users, each user having a geographic territory in a plurality of geographic territories;
for each log metric in the database, generating a metric vector comprising a term vector having plurality of term weights, wherein the terms of the term vectors are selected from terms used in the metric name, metric description, or one or more metric parameters, and wherein the term weights correspond to a measure of frequency of the terms appearing in the log metric;
querying the database metric usage data to select metric vectors used by the user and generating a user vector for the user as a centroid of the selected metric vectors;
selecting a target set of log metrics from the database and determining a corresponding set of metric vectors;
for each geographic territory in the plurality of geographic territories:
querying the database metric usage data to select metric vectors used by users in the geographic territory and generating a territory vector for the geographic territory as a centroid of the selected metric vectors;
for each metric vector in the set of metric vectors, generating a similarity score between the metric vector and the territory vector; and
ranking the metric vectors in the set of metric vectors based on their similarity scores to the territory vector to determine one or more highest ranking metric vectors for the territory vector;

for each territory vector, generating a second similarity score between the territory vector and the user vector;
ranking the territory vectors based on their second similarity scores to obtain a highest ranking territory vector for the user vector;
querying the database for the one or more highest ranking metric vectors for the highest ranked territory vector; and
displaying an output in the log analytics system of at least one log metric corresponding to at least one of the one or more highest ranking metric vectors.

Assignees

• Informatica Llc

Inventors

• Convertino Gregorio
• Detweiler Mark
• Sun Maoyuan

Classifications

• G06F16/24578 Primary

  using ranking · CPC title

• G06F16/24573

  using data annotations, e.g. user-defined metadata · CPC title

• G06F16/248

  Presentation of query results · CPC title

• G06F16/2358

  Change logging, detection, and notification (replication G06F16/27) · CPC title

• G06F17/30368

  Physics · mapped topic