Rule-based continuous diagnosing and alerting from application logs

Patent metadata

Field	Value
Publication number	US-10977152-B2
Application number	US-201916385798-A
Country	US
Kind code	B2
Filing date	Apr 16, 2019
Priority date	Apr 16, 2019
Publication date	Apr 13, 2021
Grant date	Apr 13, 2021

Abstract

One or more embodiments analyze log records of applications to determine whether a composite rule pertaining to events associated with the log records occurring within a specified time window are satisfied. Satisfaction of the composite rule may facilitate real-time diagnosis and detection of patterns in logs which indicate problems, threats, systemic issues, or performance issues relating to the applications. The composite rule may specify events associated with log records from multiple different applications that occur within a same specified time window and are associated with a same tenant and entity. Satisfaction of the composite rule may be analyzed by a state machine that tracks satisfaction of the individual rules within the composite rule in a sequence of stages. A notification, alert, or alarm may be generated when the composite rule is satisfied.

First claim

What is claimed is:

1. One or more non-transitory machine-readable media storing instructions which, when executed by one or more processors, cause:
identifying a plurality of fields referenced by a composite rule comprising a first rule corresponding to log data generated by a first application and a second rule corresponding to log data generated by a second application;
analyzing a plurality of log records to identify a subset of log records that include values for fields referenced by at least one rule of the composite rule;
selecting a particular set of log records from the subset of log records, for evaluating the composite rule, that are (a) associated with a same entity and (b) associated with a same time window, wherein the particular set of log records includes a particular first set of log records corresponding to the first application and a particular second set of log records corresponding to the second application;
determining that the composite rule is triggered based on:
determining that the first rule is triggered by the particular first set of log records corresponding to the first application; and
determining that the second rule is triggered by the particular second set of log records corresponding to the second application; and

generating a notification based on the triggering of the composite rule.

2. The one or more non-transitory machine-readable media of claim 1 , wherein determining that a respective one of the first rule or second rule is triggered comprises:
determining that a first stage condition is met;
responsive to the first stage condition being met, determining that a second stage condition is met within the same time window.

3. The one or more non-transitory machine-readable media of claim 2 , wherein determining that the first stage condition is met comprises advancing a state machine from a first state to a second state.

4. The one or more non-transitory machine-readable media of claim 3 , wherein determining that the second stage condition is met comprises advancing the state machine from the second state to a third state.

5. The one or more non-transitory machine-readable media of claim 1 , wherein:
identifying the plurality of fields referenced by the composite rule further comprises a third rule corresponding to log data generated by a third application;
the particular set of log records includes a particular third set of log records corresponding to the third application; and
determining that the composite rule is triggered is further based on determining that the third rule is triggered by the particular third set of log records corresponding to the third application.

6. The one or more non-transitory machine-readable media of claim 1 , further storing instructions which, when executed by one or more processors, cause:
responsive to determining that the composite rule is triggered, outputting the particular first set of log records corresponding to the first application and the particular second set of log records corresponding to the second application.

7. The one or more non-transitory machine-readable media of claim 1 , wherein the entity is a user of the first application and the second application.

8. A method for rule-based diagnosis from application logs, the method comprising:
identifying, by a processor, a plurality of fields referenced by a composite rule comprising a first rule corresponding to log data generated by a first application and a second rule corresponding to log data generated by a second application;
analyzing, by a processor, a plurality of log records to identify a subset of log records that include values for fields referenced by at least one rule of the composite rule;
selecting, by a processor, a particular set of log records, from the subset of log records, that are (a) associated with a same entity and (b) associated with a same time window, wherein the particular set of log records includes a particular first set of log records corresponding to the first application and a particular second set of log records corresponding to the second application;
determining, by a processor, that the composite rule is triggered based on:
determining that the first rule is triggered by the particular first set of log records corresponding to the first application; and
determining that the second rule is triggered by the particular second set of log records corresponding to the second application; and

generating, by a processor, a notification based on the triggering of the composite rule.

9. The method of claim 8 , wherein determining that a respective one of the first rule or second rule is triggered comprises:
determining that a first stage condition is met;
responsive to the first stage condition being met, determining that a second stage condition is met within the same time window.

10. The method of claim 9 , wherein determining that the first stage condition is met comprises advancing a state machine from a first state to a second state.

11. The method of claim 10 , wherein determining that the second stage condition is met comprises advancing the state machine from the second state to a third state.

12. The method of claim 8 , wherein:
identifying the plurality of fields referenced by the composite rule further comprises a third rule corresponding to log data generated by a third application;
the particular set of log records includes a particular third set of log records corresponding to the third application; and
determining that the composite rule is triggered is further based on determining that the third rule is triggered by the particular third set of log records corresponding to the third application.

13. The method of claim 8 , further comprising:
responsive to determining that the composite rule is triggered, outputting the particular first set of log records corresponding to the first application and the particular second set of log records corresponding to the second application.

14. The method of claim 8 , wherein the entity is a user of the first application and the second application.

15. A system for rule-based diagnosis from application logs, the system including at least one device with a hardware processor, the system being configured to perform operations comprising:
identifying, by a processor, a plurality of fields referenced by a composite rule comprising a first rule corresponding to log data generated by a first application and a second rule corresponding to log data generated by a second application;
analyzing, by a processor, a plurality of log records to identify a subset of log records that include values for fields referenced by at least one rule of the composite rule;
selecting, by a processor, a particular set of log records, from the subset of log records, that are (a) associated with a same entity and (b) associated with a same time window, wherein the particular set of log records includes a particular first set of log records corresponding to the first application and a particular second set of log records corresponding to the second application;
determining, by a processor, that the composite rule is triggered based on:
determining that the first rule is triggered by the particular first set of log records corresponding to the first application; and
determining that the second rule is triggered by the particular second set of log records corresponding to the second application; and

generating, by a processor, a notification based on the triggering of the composite rule.

16. The system of claim 15 , wherein determining that a respective one of the fir

Assignees

• Oracle Int Corp

Inventors

• Chatterjee Raja
• Weaver James Elder

Classifications

• G06F11/302 Primary

  where the computing system component is a software system · CPC title

• G06F11/079

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/3409

  for performance assessment · CPC title

• G06F11/3476 Primary

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/3065

  Monitoring arrangements determined by the means or processing involved in reporting the monitored data (error or fault reporting or logging G06F11/0766) · CPC title