Event log management

Patent metadata

Field	Value
Publication number	US-11960943-B2
Application number	US-202217698579-A
Country	US
Kind code	B2
Filing date	Mar 18, 2022
Priority date	Dec 20, 2021
Publication date	Apr 16, 2024
Grant date	Apr 16, 2024

Abstract

Some implementations described herein relate to a system that is configured to obtain one or more event logs associated with a tenant of the system. The system may be configured to determine, based on the one or more event logs, an event rate associated with the tenant and thereby determine, based on the event rate, a rotation interval. The system may be configured to cause, based on the rotation interval, a data structure to be generated for storing event logs associated with the tenant that are obtained during a time window. The system may be configured to obtain, within the time window, one or more additional event logs associated with the tenant and to cause, based on obtaining the one or more additional event logs within the time window, the one or more additional event logs to be stored in the data structure.

First claim

What is claimed is:

1. A system, comprising:
one or more memories; and
one or more processors to:
obtain one or more event logs associated with a tenant of the system;
determine, based on the one or more event logs, an event rate associated with the tenant;
determine, based on the event rate, a rotation interval;
cause, based on the rotation interval, a data structure to be generated for storing event logs associated with the tenant that are obtained during a time window;
obtain, within the time window, one or more additional event logs associated with the tenant; and
cause, based on obtaining the one or more additional event logs within the time window, the one or more additional event logs to be stored in the data structure.

2. The system of claim 1 , wherein the one or more processors, to determine the rotation interval, are to:
process, using a machine learning model, the event rate and one or more previous event rates associated with the tenant to determine a predicted event rate; and
determine the rotation interval based on the predicted event rate.

3. The system of claim 1 , wherein the one or more processors, to determine the rotation interval, are to:
process, using a univariate time series forecasting model, the event rate and one or more previous event rates associated with the tenant to determine a predicted event rate; and
determine the rotation interval based on the predicted event rate.

4. The system of claim 1 , wherein the one or more processors, to determine the rotation interval, are to:
determine, based on the event rate, a predicted event rate;
identify a representative capacity of a data structure;
determine, based on the predicted event rate, a number of event logs to be received during a particular time interval;
determine that the number of event logs to be received during the particular time interval is less than or equal to the representative capacity; and
identify the particular time interval as the rotation interval.

5. The system of claim 1 , wherein the one or more processors, to determine the rotation interval, are to:
determine, based on the event rate, a predicted event rate;
identify a representative capacity of a data structure;
determine, based on the predicted event rate, a number of event logs to be received during a particular time interval;
determine that the number of event logs to be received during the particular time interval is greater than the representative capacity; and
cause the rotation interval to be greater than the particular time interval.

6. The system of claim 1 , wherein a name of the data structure identifies at least one of:
the tenant;
the time window; or
a category of event logs to be stored in the data structure.

7. The system of claim 1 , wherein the one or more processors are further to:
obtain an event log search request;
determine, based on the event log search request, a span of time associated with the event log search request;
search, based on the span of time associated with the event log search request, another data structure to identify a set of data structures,
wherein each data structure, of the set of data structures, stores event logs associated with the tenant that were obtained during a particular time window that is at least partially coextensive with the span of time associated with the event log search request,

perform, based on the event log search request, one or more data structure queries on the set of data structures to identify event log search information; and
provide the event log search information.

8. The system of claim 7 , wherein the other data structure is a binary search tree.

9. The system of claim 1 , wherein the one or more processors are further to:
obtain a remaining storage capacity request;
determine, based on the remaining storage capacity request, an amount of available storage for the tenant;
determine, based on the amount of the available storage for the tenant, a number of event logs that can be stored in the available storage for the tenant;
determine, based on the number of event logs that can be stored in the available storage for the tenant and the event rate associated with the tenant, a remaining storage capacity for the tenant represented in an amount of time; and
provide the remaining storage capacity for the tenant represented in the amount of time.

10. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a system, cause the system to:
determine, based on one or more event logs associated with a tenant of the system, an event rate associated with the tenant;
determine, based on the event rate, a predicted event rate associated with the tenant;
determine, based on the predicted event rate, a rotation interval;
cause, based on the rotation interval, a data structure to be generated for storing event logs associated with the tenant that are obtained during a time window;
obtain, within the time window, one or more additional event logs associated with the tenant; and
cause, based on obtaining the one or more additional event logs within the time window, the one or more additional event logs to be stored in the data structure.

11. The non-transitory computer-readable medium of claim 10 , wherein the one or more instructions, that cause the system to determine the predicted event rate, cause the system to:
process, using a machine learning model, the event rate to determine the predicted event rate.

12. The non-transitory computer-readable medium of claim 10 , wherein the one or more instructions, that cause the system to determine the predicted event rate, cause the system to:
process, using a univariate time series forecasting model, the event rate to determine the predicted event rate.

13. The non-transitory computer-readable medium of claim 10 , wherein the one or more instructions, that cause the system to determine the rotation interval, cause the system to:
determine, based on the predicted event rate, a number of event logs to be received during a particular time interval;
determine that the number of event logs to be received during the particular time interval is less than or equal to a representative capacity of a data structure; and
identify the particular time interval as the rotation interval.

14. The non-transitory computer-readable medium of claim 10 , wherein the one or more instructions, that cause the system to determine the rotation interval, cause the system to:
determine, based on the predicted event rate, a number of event logs to be received during a particular time interval;
determine that the number of event logs to be received during the particular time interval is greater than a representative capacity of a data structure; and
cause the rotation interval to be greater than the particular time interval.

15. The non-transitory computer-readable medium of claim 10 , wherein the one or more instructions further cause the system to:
obtain an event log search request;
determine, based on the event log search request, a span of time associated with the event log search request;
search, based on the span of time associated with the event log search request, another data structure to identify a set of data structures that store event logs associated with the tenant and that are associated with the span of time associated with the event log search request,
perform, based on the event log search request, one or more data structure queries on the set of data structures

Assignees

• Juniper Networks Inc

Inventors

• R Jayanthi
• Reddy Bhaskar T
• A Chandrasekhar

Classifications

• G06F9/542 Primary

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title