Prioritizing log tags and alerts

Patent metadata

Field	Value
Publication number	US-10831711-B2
Application number	US-201715715608-A
Country	US
Kind code	B2
Filing date	Sep 26, 2017
Priority date	Sep 26, 2017
Publication date	Nov 10, 2020
Grant date	Nov 10, 2020

Abstract

A computer-implemented method includes associating a tag with a message in a log, where the message describes a logged event. A life parameter associated with the tag is calculated, using a computer processor, where the life parameter indicates a dynamic time period during which the tag remains in a state that is active. Alerting of the tag occurs by way of a first alert manner while the state of the tag is active. It is detected that the dynamic time period indicated by the life parameter has ended. The state of the tag is changed from active to dormant, where changing the state includes ceasing the alerting of the tag by way of the first alert manner.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
associating a tag with a message in a log, wherein the message describes a logged event;
calculating, using a computer processor, a life parameter associated with the tag, wherein the life parameter indicates a dynamic time period during which the tag remains in a state that is active;
alerting of the tag by way of a first alert manner while the state of the tag is active;
detecting a remedial activity performed manually in response to the tag and a duration between the alerting and the performance of the remedial activity;
modifying the life parameter based on the remedial activity and based on the duration wherein the modification to the life parameter is inversely related to the duration;
detecting that the dynamic time period indicated by the life parameter has ended; and
changing the state of the tag from active to dormant, wherein the changing the state comprises ceasing the alerting of the tag by way of the first alert manner.

2. The computer-implemented method of claim 1 , wherein the calculating comprises:
determining a quotient based on one or more characteristics of the tag, wherein the quotient is determined through statistical analysis; and
mapping the quotient to the life parameter.

3. The computer-implemented method of claim 1 , wherein the tag is based on a problem signature comprising the logged event and one or more other events.

4. The computer-implemented method of claim 1 , further comprising alerting of the tag by way of a second alert manner while the state of the tag is dormant, wherein the second manner differs from the first manner.

5. The computer-implemented method of claim 1 , further comprising:
identifying a remedial activity performed manually in response to a previous tag related to the tag; and
performing the remedial activity in response to the tag, based on the remedial activity being performed manually in response to the previous tag related to the tag.

6. The computer-implemented method of claim 1 , wherein the calculating the life parameter is based at least in part on a priority of the tag.

7. The computer-implemented method of claim 1 , wherein modifying the life parameter based on the remedial activity and based on the duration includes increasing the life parameter based on the remedial activity.

8. A system comprising:
a memory having computer-readable instructions; and
one or more processors for executing the computer-readable instructions, the computer-readable instructions comprising:
associating a tag with a message in a log, wherein the message describes a logged event;
calculating a life parameter associated with the tag, wherein the life parameter indicates a dynamic time period during which the tag remains in a state that is active;
alerting of the tag by way of a first alert manner while the state of the tag is active;
detecting a remedial activity performed manually in response to the tag and a duration between the alerting and the performance of the remedial activity;
modifying the life parameter based on the remedial activity and based on the duration, wherein the modification to the life parameter is inversely related to the duration;
detecting that the dynamic time period indicated by the life parameter has ended; and
changing the state of the tag from active to dormant, wherein the changing the state comprises ceasing the alerting of the tag by way of the first alert manner.

9. The system of claim 8 , wherein the calculating comprises:
determining a quotient based on one or more characteristics of the tag, wherein the quotient is determined through statistical analysis; and
mapping the quotient to the life parameter.

10. The system of claim 8 , wherein the tag is based on a problem signature comprising the logged event and one or more other events.

11. The system of claim 8 , the computer-readable instructions further comprising alerting of the tag by way of a second alert manner while the state of the tag is dormant, wherein the second manner differs from the first manner.

12. The system of claim 8 , the computer-readable instructions further comprising:
identifying a remedial activity performed manually in response to a previous tag related to the tag; and
performing the remedial activity in response to the tag, based on the remedial activity being performed manually in response to the previous tag related to the tag.

13. The system of claim 8 , wherein the calculating the life parameter is based at least in part on a priority of the tag.

14. A computer-program product for prioritizing log tags and alerts, the computer-program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:
associating a tag with a message in a log, wherein the message describes a logged event;
calculating a life parameter associated with the tag, wherein the life parameter indicates a dynamic time period during which the tag remains in a state that is active;
alerting of the tag by way of a first alert manner while the state of the tag is active;
detecting a remedial activity performed manually in response to the tag and a duration between the alerting and the performance of the remedial activity;
modifying the life parameter based on the remedial activity and based on the duration wherein the modification to the life parameter is inversely related to the duration;
detecting that the dynamic time period indicated by the life parameter has ended; and
changing the state of the tag from active to dormant, wherein the changing the state comprises ceasing the alerting of the tag by way of the first alert manner.

15. The computer-program product of claim 14 , wherein the calculating comprises:
determining a quotient based on one or more characteristics of the tag, wherein the quotient is determined through statistical analysis; and
mapping the quotient to the life parameter.

16. The computer-program product of claim 14 , wherein the tag is based on a problem signature comprising the logged event and one or more other events.

17. The computer-program product of claim 14 , wherein the method further comprises alerting of the tag by way of a second alert manner while the state of the tag is dormant, wherein the second manner differs from the first manner.

18. The computer-program product of claim 14 , wherein the method further comprises:
identifying a remedial activity performed manually in response to a previous tag related to the tag; and
performing the remedial activity in response to the tag, based on the remedial activity being performed manually in response to the previous tag related to the tag.

Assignees

• IBM

Inventors

• Chakra Al
• Dunne Jonathan
• Harpur Liam S
• Patel Sumit

Classifications

• G06F16/1734

  Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs · CPC title

• G06F16/164 Primary

  File meta data generation · CPC title