Techniques for managing and analyzing log data

Patent metadata

Field	Value
Publication number	US-10452465-B2
Application number	US-201715699743-A
Country	US
Kind code	B2
Filing date	Sep 8, 2017
Priority date	Sep 8, 2017
Publication date	Oct 22, 2019
Grant date	Oct 22, 2019

Abstract

In order to provide effective diagnostics and logging of error messages produced during the execution of processes across multiple components, systems and methods are disclosed for the generating, managing, and processing centralized logs containing those error messages. In particular, the components may write error messages to a centralized log instead of writing the error messages to local log files. These error messages may include exception messages and diagnostics messages. These various error messages in the centralized log can be read, identified, and organized. Furthermore, enrichments and/or analytics may be applied to the error messages based on information from a knowledge source or the application of one or more machine learning models. The organized error messages, enrichments, and analytics can be stored in an output log that can be easily retrieved and viewed through a graphical interface. The organized error messages, enrichments, and analytics may work together to allow for more effective diagnosing of execution errors.

First claim

What is claimed is:

1. A computer-implemented method comprising:
obtaining, by a computer system of a log management system, from a message system, log data including first log data and second log data, wherein the first log data is generated based on an execution of a first process, and wherein the second log data is generated based on an execution of a second process;
identifying, by the computer system, in the first log data, a first exception message having a first exception type and corresponding to a first execution event occurring during the execution of the first process at a first time period;
identifying, by the computer system, a second exception message having a second exception type and corresponding to a second execution event occurring during the execution of the second process at a second time period, wherein the second time period occurs after the first time period;
determining whether the first execution event corresponding to the first exception message relates to a critical execution event that is critical to a normal flow of the execution of the first process;
upon determining that the first execution event corresponding to the first exception message relates to the critical execution event , modifying the log data to add an indicator to the first exception message, wherein the indicator identifies that the first execution event relates to the critical execution event;
determining that the first exception type is identical to the second exception type; and
based on determining that the second execution event occurred after the first execution event and based on determining that the first execution event relates to the critical execution event, modifying the log data to add an alert indicator to the second exception message, wherein the alert indicator identifies that the second execution event relates to a new kind of execution event.

2. The computer-implemented method of claim 1 , wherein the log data further includes third log data generated based on an execution of a third process, and wherein the method further comprises:
identifying, by the computer system, in the third log data, a third exception message having a third exception type and corresponding to a third execution event occurring during the execution of the third process at a third time period;
determining that the first exception type is identical to the third exception type; and
based on determining that the third execution event occurred after the second execution event and based on determining that the first execution event relates to the critical execution event, sending instructions to a component to stop the execution of the second process.

3. The computer-implemented method of claim 2 , wherein the component is in the computer system.

4. The computer-implemented method of claim 2 , wherein the component is in a second computer system.

5. The computer-implemented method of claim 2 , wherein the method further comprises:
based on determining that the third execution event occurred after the second execution event and based on determining that the first execution event relates to the critical execution event, sending instructions to the component to stop the execution of the third process.

6. The computer-implemented method of claim 1 , wherein the method further comprises:
upon determining that the first execution event corresponding to the first exception message relates to the critical execution event, executing a third process.

7. The computer-implemented method of claim 1 , wherein the first exception message includes an exception context identifier, and wherein the method further comprises:
identifying, by the computer system, in the log data, a diagnostic message having the execution context identifier and corresponding to the first process; and
based upon determining that the execution context identifier of the first exception message matches the execution context identifier of the diagnostic message, modifying the log data to associate the diagnostic message with the first exception message.

8. The computer-implemented method of claim 1 , wherein determining whether the first execution event relates to the critical execution event includes querying a knowledge source to identify one or more execution events that are identified as critical.

9. The computer-implemented method of claim 1 , wherein determining whether the first execution event relates to the critical execution event includes applying, to the first execution event, a machine learning model to classify whether the first execution event is critical or non-critical.

10. The computer-implemented method of claim 1 , wherein the method further comprises:
based on determining that the second execution event occurred after the first execution event and based on determining that the first execution event relates to the critical execution event, executing a third process.

11. The computer-implemented method of claim 1 , wherein the method further comprises:
identifying, by the computer system, in the log data, a set of exception types from a plurality of exception messages in the log data;
determining, by the computer system, from the log data, a count for each exception type in the set of exception types;
determining, by the computer system, from the set of exception types, a subset of exception types with the highest count; and
modifying the log data to include exception information indicating the subset of exception types with the highest count and the count for each exception type of the subset of exception types.

12. The computer-implemented method of claim 1 , wherein the method further comprises:
identifying, by the computer system, in the log data, a set of components from a plurality of exception messages in the log data;
determining, by the computer system, from the log data, a count for each component in the set of components; and
modifying the log data to include component information indicating the count for each component in the set of components.

13. The computer-implemented method of claim 1 , wherein the log data further includes third log data generated based on an execution of a third process, and wherein the method further comprises:
identifying, by the computer system, in the third log data, a third exception message having a third exception type and corresponding to a third execution event occurring during the execution of the third process at a third time period,
and wherein determining whether the first execution event corresponding to the first exception message relates to the critical execution event is based on the first exception message, the first exception type , the third exception message, and the third exception type.

14. A system comprising:
one or more processors; and
a memory accessible to the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to:
obtain, from a message system, log data including first log data and second log data, wherein the first log data is generated based on an execution of a first process, and wherein the second log data is generated based on an execution of a second process;
identify, in the first log data, a first exception message having a first exception type and corresponding to a first execution event occurring during the execution of the first process at a first time period;
identify a second exception message having a second exception type and corresponding to a second execution event occurring during the execution of the second process at a second time period, wherein the second time period occurs after the first time period;

Assignees

• Oracle Int Corp

Inventors

• Handa Nitin
• Soni Rohit

Classifications

• G06F11/0772

  Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers · CPC title

• G06F11/0778

  Dumping, i.e. gathering error/state information after a fault for later diagnosis · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title