Event log analysis

Patent metadata

Field	Value
Publication number	US-2016253229-A1
Application number	US-201315033200-A
Country	US
Kind code	A1
Filing date	Oct 30, 2013
Priority date	Oct 30, 2013
Publication date	Sep 1, 2016
Grant date	—

Abstract

Various methods and systems for analyzing event log elements are described that utilize numerous techniques to group and compare the large event log files logged by different computers and programs. In one example, a method includes receiving a first set of event log elements from a plurality of computers, and receiving a second set of event log elements from a target computer. The method continues by comparing the first set of event log elements and the second set of event log elements to identify a configuration difference between the target computer and the plurality of computers. The differences can be displayed to a user of the target computer.

First claim

What is claimed is:

1 . A method, comprising:
receiving a first set of event log elements from a plurality of computers; receiving a second set of event log elements from a target computer; comparing the first set of event log elements and the second set of event log elements to identify a configuration difference between the target computer and the plurality of computers; and displaying the difference to a user of the target computer.

2 . The method of claim 1 , wherein the event log elements are compiled through clustering into message templates before comparing.

3 . The method of claim 2 , wherein each set of event log elements are assigned to a message cluster according to a message template of similarity between the respective text of the event log element and the template text of the message cluster.

4 . The method of claim 2 , wherein a message cluster is periodically divided on the basis of pre-determined splitting criteria that includes greater than a minimum number of event messages being assigned to a message cluster.

5 . The method of claim 2 , wherein the clustered message templates are used in generating a set of machine-readable atoms grouped by flows, wherein:
an atom is a set of elements that is common in a plurality of data sets such that a new or existing set can be sparsely represented using such atoms.

6 . The method of claim 5 , wherein generating a set of atoms comprises minimizing a cost function using an iterative process to identify the one or more atoms.

7 . The method of claim 5 , wherein training data representing an initial data set including text representing at least one concept embodied by the data set is received; the training data is processed in order to generate a set of atoms, each atom comprising at least one word that represents one or more concepts of the initial data set: and wherein an initial data set represents a user, and an atom is used in order to predict an item of interest for the user.

8 . A system for analyzing event log elements, comprising:
a storage engine to receive and store system event log elements as machine-readable data sets; a comparison engine to compare event log elements from a plurality of computers to event log elements from a target computer; a differentiation engine to identify a configuration difference between the event log elements from the target computer and the event log elements from the plurality of computers; and a display engine to display the configuration difference that is identified.

9 . The system of claim 8 , wherein the comparison engine compares event log elements based on pre-determined distribution parameters that can be configured and reconfigured.

10 . The system of claim 9 , wherein the distribution parameters are user defined based on event log error messages received at the target computer.

11 . The system of claim 8 , wherein the comparison engine organizes the event leg elements into sets of message clusters and compares the message clusters.

12 . The system of claim 8 , wherein the comparison engine organizes the event log elements by atomic flows and compares the flows.

13 . A non-transitory, computer-readable medium, comprising instruction configured to direct a processor to:
receive system event log elements as organized data sets; compare the received event log elements of a target processor on a network of processors to other processors on the network of processors; and automatically identity configuration differences between the event log element distribution of the target network processor and the event log element distribution of the entire network system of processors.

14 . The non-transitory, computer-readable medium of claim 13 , wherein the target network processor comprises a personal computer, a server, a digital printer, or any other processor connected to the network system of processors.

15 . The non-transitory, computer readable medium of claim 13 , wherein the target network processor requires troubleshooting, and the event log elements of interest relate to error logs that are being logged by the target network processor.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Sade Alon
• Brodin Ilya
• Samuni Eran

Classifications

• G06F11/3072

  where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting · CPC title

• H04L41/0873

  Checking configuration conflicts between network elements · CPC title

• G06F11/0709

  in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems · CPC title

• H04L41/06

  Management of faults, events, alarms or notifications · CPC title

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title