Techniques for managing and analyzing log data

Patent metadata

Field	Value
Publication number	US-11314574-B2
Application number	US-201916566804-A
Country	US
Kind code	B2
Filing date	Sep 10, 2019
Priority date	Sep 8, 2017
Publication date	Apr 26, 2022
Grant date	Apr 26, 2022

Abstract

In order to provide effective diagnostics and logging of error messages produced during the execution of processes across multiple components, techniques are disclosed for the generating, managing, and processing centralized logs containing those error messages. In particular, the components may write error messages to a centralized log instead of writing the error messages to local log files. The various error messages in the centralized log can be read, identified, and organized. Furthermore, enrichments and/or analytics may be applied to the error messages based on information from a knowledge source or the application of one or more machine learning models. The organized error messages, enrichments, and analytics can be stored in an output log that can be easily retrieved and viewed through a graphical interface. The organized error messages, enrichments, and analytics work together to allow for more effective diagnosing of execution errors.

First claim

What is claimed is:

1. A computer-implemented method comprising:
reading, by a log management system, a topic retrieved from a log message system, wherein: the topic comprises error messages that were generated by physical and/or virtual nodes of a distributed computer system while executing processes, the topic is a centralized log file, the physical and/or virtual nodes write the error messages to the topic, the processes are executed in response to, or associated with, application processing requests received by the physical and/or virtual nodes, and each of the error messages are associated with an execution context identifier (ECID) used to correlate events associated with a same application processing request across multiple physical and/or virtual nodes;
identifying, by the log management system, an error message of the error messages in the topic;
applying, by the log management system, an enrichment to the error message, wherein the enrichment is a known solution or troubleshooting tip associated with the error message;
analyzing, by the log management system, the error message, wherein the analyzing comprises classifying, by a machine-learning model, the error message, and generating analytics associated with the error message based on the classifying;
determining, by the log management system, that the error message is a specific type of error message, based on the analytics;
in response to determining that the error message is the specific type, determining, by the log management system, a node of the one or more physical and/or virtual nodes that generated the error message;
communicating, by the log management system, instructions to the node to stop one or more of the processes that generated the error message;
updating, by the log management system, the machine-learning model based on the error message, the enrichments, and the analytics, wherein the updating comprises retraining the machine learning model using the error message, the enrichments, and the analytics as training data;
generating, by the log management system, an output topic that includes the error message in association with the enrichments and the analytics, wherein the generating comprises grouping the error message with other error messages generated in the same application processing request based on the ECID associated with the error message and the other error messages; and
displaying the output topic through a graphical interface.

2. The method of claim 1 , further comprising storing, by the log management system, the output topic in a storage device.

3. The method of claim 1 , wherein the analyzing further comprises performing queries of the error message to obtain counts or statistics associated with the error message, and the analytics associated with the error message are generated based on the classifying and the counts or statistics.

4. The method of claim 1 , further comprising determining, by the log management system, a type of exception associated with the error message, wherein the enrichment is applied based on the type of exception associated with the error message.

5. A non-transitory computer-readable memory storing a plurality of instructions executable by one or more processors, the plurality of instructions comprising instructions that when executed by the one or more processors cause the one or more processors to perform processing comprising:
reading a topic retrieved from a log message system, wherein: the topic comprises error messages that were generated by physical and/or virtual nodes of a distributed computer system while executing processes, the topic is a centralized log file, the physical and/or virtual nodes write the error messages to the topic, the processes are executed in response to, or associated with, application processing requests received by the physical and/or virtual nodes, and each of the error messages are associated with an execution context identifier (ECID) used to correlate events associated with a same application processing request across multiple physical and/or virtual nodes;
identifying an error message of the error messages in the topic;
applying an enrichment to the error message or content of the topic, wherein the enrichment is a known solution or troubleshooting tip associated with the error message;
analyzing the error message, wherein the analyzing comprises classifying, by a machine-learning model, the error message, and generating analytics associated with the error message based on the classifying;
determining that the error message is a specific type of error message, based on the analytics;
in response to determining that the error message is the specific type, determining a node of the one or more physical and/or virtual nodes that generated the error message;
communicating instructions to the node to stop one or more of the processes that generated the error message;
updating the machine-learning model based on the error message, the enrichments, and the analytics, wherein the updating comprises retraining the machine learning model using the error message, the enrichments, and the analytics as training data;
generating an output topic that includes the error message, the enrichments, and the analytics, wherein the generating comprises grouping the error message with other error messages generated in the same application processing request based on the ECID associated with the error message and the other error messages; and
displaying the output topic through a graphical interface.

6. The non-transitory computer-readable memory of claim 5 , wherein the processing further comprises storing the output topic in a storage device.

7. The non-transitory computer-readable memory of claim 5 , wherein the analyzing further comprises performing queries of the error message to obtain counts or statistics associated with the error message, and the analytics associated with the error message are generated based on the classifying and the counts or statistics.

8. The non-transitory computer-readable memory of claim 5 , wherein the processing further comprises determining a type of exception associated with the error message, wherein the enrichment is applied based on the type of exception associated with the error message.

9. A system comprising:
one or more processors;
a memory coupled to the one or more processors, the memory storing a plurality of instructions executable by the one or more processors, the plurality of instructions comprising instructions that when executed by the one or more processors cause the one or more processors to perform processing comprising:
reading a topic retrieved from a log message system, wherein: the topic comprises error messages that were generated by physical and/or virtual nodes of a distributed computer system while executing processes, the topic is a centralized log file, the physical and/or virtual nodes write the error messages to the topic, the processes are executed in response to, or associated with, application processing requests received by the physical and/or virtual nodes, and each of the error messages are associated with an execution context identifier (ECID) used to correlate events associated with a same application processing request across multiple physical and/or virtual nodes;
identifying an error message of the error messages in the topic;
applying an enrichment to the error message or content of the topic, wherein the enrichment is a known solution or troubleshooting tip associated with the error message;
analyzing the error message, wherein the analyzing comprises classifying, by a machine-learning model, the error message, and generating analytics associated with the error message based on the classifying;
determin

Assignees

• Oracle Int Corp

Inventors

• Handa Nitin
• Soni Rohit

Classifications

• G06F11/0772

  Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/0778

  Dumping, i.e. gathering error/state information after a fault for later diagnosis · CPC title