Determining topology using log messages

Patent metadata

Field	Value
Publication number	US-10530640-B2
Application number	US-201615280940-A
Country	US
Kind code	B2
Filing date	Sep 29, 2016
Priority date	Sep 29, 2016
Publication date	Jan 7, 2020
Grant date	Jan 7, 2020

Abstract

In some examples, a first pair of parameters in respective first and second log message streams associated with respective first and second source components and a second pair of parameters in the respective first and second log message streams may be identified. The first pair may be identical and the second pair may be identical. It may be determined that first pair of parameters was simultaneously generated and that the second pair of parameters was simultaneously generated in the first and in the second log message streams. A linkage score may be determined between the first and the second source components. The linkage score may be based on the determination that each of the respective first and the second pairs of parameters was simultaneously generated. It may be determined that that the first and second source components are topologically linked based on the linkage score.

First claim

The invention claimed is:

1. A non-transitory computer-readable storage medium comprising instructions executable by a system comprising a processor to:
identify a first pair of parameters in respective first and second log message streams associated with respective first and second source components, and a second pair of parameters in the respective first and second log message streams, the first pair of parameters being identical and the second pair of parameters being identical;
determine that the first pair of parameters are simultaneous and that the second pair of parameters are simultaneous in the first and in the second log message streams;
determine a linkage score between the first and the second source components, the linkage score based on the determination that each of the respective first and the second pairs of parameters are simultaneous;
calibrate the linkage score to produce a calibrated linkage score wherein the calibrated linkage score being greater than a threshold value indicates that a number of the first pair of parameters that are simultaneous and a number of the second pair of parameters that are simultaneous are not due to random noise; and
determine that the first and second source components are topologically linked based on the calibrated linkage score.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the first and the second log message streams each includes at least one respective fixed parameter, wherein the first and the second pairs of parameters comprise variable parameters.

3. The non-transitory computer-readable storage medium of claim 2 , further comprising instructions executable by the system to:
classify log messages from the first and the second log message streams with a log message template; and
designate the first and the second pairs of parameters as the variable parameters based on a threshold amount of variation of the first and the second pairs of parameters across log messages of the first and second log message streams.

4. The non-transitory computer-readable storage medium of claim 1 , further comprising instructions executable by the system to:
generate a parameter stream comprising a plurality of parameters that include the first and the second pairs of parameters.

5. The non-transitory computer-readable storage medium of claim 4 , further comprising instructions executable by the system to filter the parameter stream to remove parameters of the plurality of parameters that comprise timestamps.

6. The non-transitory computer-readable storage medium of claim 4 , further comprising instructions executable by the system to filter the parameter stream to remove parameters of the plurality of parameters that include fewer than a predetermined threshold number of characters.

7. The non-transitory computer-readable storage medium of claim 4 , wherein each parameter of the first pair of parameters comprises a different substring than each parameter of the second pair of parameters.

8. The non-transitory computer-readable storage medium of claim 7 , wherein the linkage score is determined using a weighted sum comprising a first count of the first pair of parameters that are simultaneous and a second count of the second pair of parameters that are simultaneous.

9. The non-transitory computer-readable storage medium of claim 8 , wherein a first weight of the weighted sum corresponding to the first pair of parameters is greater than a second weight of the weighted sum corresponding to the second pair of parameters in response to the first pair of parameters being less common in the parameter stream than the second pair of parameters.

10. The non-transitory computer-readable storage medium of claim 4 , further comprising instructions executable by the system to:
store the plurality of parameters in a simultaneous parameter buffer,
wherein determining that each of the respective first and the second pairs of parameters are simultaneous comprises:
determining that the first pair of parameters are simultaneous in response to a first parameter of the first pair of parameters and a second parameter of the first pair of parameters being stored in the simultaneous parameter buffer at a same time; and
determining that the second pair of parameters are simultaneous in response to a first parameter of the second pair of parameters and a second parameter of the second pair of parameters being stored in the simultaneous parameter buffer at a same time.

11. The non-transitory computer-readable storage medium of claim 4 , wherein the linkage score is based on a count of the plurality parameters received within a predetermined time period since a current time.

12. The non-transitory computer-readable storage medium of claim 1 , further comprising instructions executable by the system to update the linkage score based on a determination that a third pair of parameters are simultaneous within the first log message stream and in the second log message stream.

13. The non-transitory computer-readable storage medium of claim 1 , further comprising instructions executable by the system to:
determine another linkage score between a third component and the first source component or a fourth component; and
normalize the linkage score and the other linkage score relative to each other,
wherein the determination that the first and second source components are topologically linked is based on the normalized linkage score and the normalized other linkage score.

14. The non-transitory computer-readable storage medium of claim 13 , wherein each respective linkage score of the linkage scores is normalized by dividing by a sum of linkage scores involving a same source component as one of the source components associated with the respective linkage score.

15. The non-transitory computer-readable storage medium of claim 13 , wherein each respective linkage score of the linkage scores is normalized by dividing by a root mean square of linkage scores involving a same source component as one of the source components associated with the respective linkage score.

16. The non-transitory computer-readable storage medium of claim 1 , further comprising instructions executable by the system to:
determine another linkage score between a third component and the first source component or a fourth component;
normalize the linkage score and the other linkage score relative to each other; and
remove the other linkage score in response to a sum of linkage scores involving a same source component as one of the source components associated with the other linkage score being below a predetermined threshold,
wherein the determination that the first and second source components are topologically linked is based on the normalized linkage score and not based on the removed other linkage score.

17. The non-transitory computer-readable storage medium of claim 1 , wherein determining that the first and second source components are topologically linked based on the calibrated linkage score comprises determining that the first and second source components are topologically linked based on the calibrated linkage score exceeding the threshold value.

18. The non-transitory computer-readable storage medium of claim 1 , wherein the calibrating of the linkage score comprises adjusting the linkage score based on a count of occurrences of each of the first and second pairs of parameters within a predetermined time period.

19. A system comprising:
a processor; and
a non-transitory storage medium comprising instructions e

Assignees

• Hewlett Packard Entpr Dev Lp
• Micro Focus Llc

Inventors

• Alon Gal
• Shaked Doron
• Giller Igor
• Lyan Marina
• Maurer Ron
• Fraenkel Noam
• Nor Igor
• Horovitz Yair

Classifications

• G06F3/04182

  Filtering of noise external to the device and not generated by digitiser components · CPC title

• H04L41/069 Primary

  using logs of notifications; Post-processing of notifications · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title