Optimizing log analysis in saas environments

Patent metadata

Field	Value
Publication number	US-2018115477-A1
Application number	US-201715847969-A
Country	US
Kind code	A1
Filing date	Dec 20, 2017
Priority date	Mar 25, 2015
Publication date	Apr 26, 2018
Grant date	—

Abstract

Embodiments of the present invention provide methods, computer program products, and systems for optimizing log analysis, such as in SaaS environments. Embodiments of the present invention can be used to determine an optimal log analysis location and ensure that the log file is processed at the optimal location based, at least in part, on the log file size and available network bandwidth.

First claim

What is claimed is:

1 . A method for optimizing log analysis, comprising:
determining, by one or more computer processors, an optimal log analysis location based, at least in part, on the identified file size, the identified network bandwidth, current processing conditions, and a hierarchy of bandwidth thresholds and log file size thresholds, wherein determining an optimal log analysis location comprises:
determining, by one or more computer processors, whether the identified bandwidth satisfies a first threshold bandwidth,
responsive to determining that the identified bandwidth does not satisfy the first threshold bandwidth, determining, by one or more computer processors, whether the identified bandwidth satisfies a second threshold bandwidth,
responsive to determining that the identified bandwidth satisfies the second threshold bandwidth, determining, by one or more computer processors, whether the identified log file size satisfies a first threshold file size, and
responsive to determining that the identified log file size satisfies the first threshold file size, identifying, by one or more computer processors, the optimal log analysis location as being the second computer system, and
processing, by one or more computer processors, the identified log file based, at least in part, on the identified optimal log analysis location, wherein processing the identified log file includes splitting portions of the identified log file, pushing log analysis software to the first computer system, transmitting at least a first portion of the identified log file to a first computer system for processing, and transmitting at least a second portion of the identified log file to a second computer system for processing.

2 . The method of claim 1 , wherein determining an optimal log analysis location comprises:
determining, by one or more computer processors, whether the identified bandwidth satisfies a first threshold bandwidth; and responsive to determining that the identified bandwidth satisfies the first threshold bandwidth, identifying, by one or more computer processors, the optimal log analysis location as being the first computer system, wherein the first computer system generated the identified log file.

3 . The method of claim 1 , wherein determining an optimal log analysis location comprises:
determining, by one or more computer processors, whether the identified bandwidth satisfies a first threshold bandwidth; responsive to determining that the identified bandwidth does not satisfy the first threshold bandwidth, determining, by one or more computer processors, whether the identified bandwidth satisfies a second threshold bandwidth; responsive to determining that the identified bandwidth satisfies the second threshold bandwidth, determining, by one or more computer processors, whether the identified log file size satisfies a first threshold file size; and responsive to determining that the identified file size does not satisfy the first threshold file size, identifying, by one or more computer processors, the optimal log analysis location as being a combination of the first computer system and the second computer system.

4 . The method of claim 3 , further comprising:
splitting, by one or more computer processors, the identified log file into multiple portions; processing, by one or more computer processors, at least one portion of the identified log file on the first computer system; and transmitting, by one or more computer processors, at least one portion of the identified log file to the second computer system for processing on the second computer system.

5 . The method of claim 1 , wherein determining an optimal log analysis location comprises:
determining, by one or more computer processors, whether the identified bandwidth satisfies a first threshold bandwidth; responsive to determining that the identified bandwidth does not satisfy the first threshold bandwidth, determining, by one or more computer processors, whether the identified bandwidth satisfies a second threshold bandwidth; responsive to determining that the identified bandwidth does not satisfy the second threshold bandwidth, determining, by one or more computer processors, whether the identified log file size satisfies a second threshold file size; and responsive to determining that the identified log file size does not satisfy the second threshold file size, identifying, by one or more computer processors, the optimal log analysis location as being the second computer system.

6 . The method of claim 1 , wherein determining an optimal log analysis location comprises:
determining, by one or more computer processors, whether the identified bandwidth satisfies a first threshold bandwidth; responsive to determining that the identified bandwidth does not satisfy the first threshold bandwidth, determining, by one or more computer processors, whether the identified bandwidth satisfies a second threshold bandwidth; responsive to determining that the identified bandwidth does not satisfy the second threshold bandwidth, determining, by one or more computer processors, whether the identified log file size satisfies a second threshold file size; and responsive to determining that the identified bandwidth satisfies the second threshold file size, identifying, by one or more computer processors, the optimal log analysis location as being a combination of the first computer system and the second computer system.

7 . The method of claim 6 , further comprising:
splitting, by one or more computer processors, the identified log file into multiple portions; processing, by one or more computer processors, at least one portion of the identified log file on the first computer system; and transmitting, by one or more computer processors, at least one portion of the identified log file to the second computer system for processing on the second computer system.

8 . A computer program product for optimizing log analysis, comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
program instructions to determine an optimal log analysis location based, at least in part, on the identified file size, the identified network bandwidth, current processing conditions, and a hierarchy of bandwidth thresholds and log file size thresholds, wherein the program instructions to determine an optimal log analysis location comprise:
program instructions to determine whether the identified bandwidth satisfies a first threshold bandwidth,
program instructions to, responsive to determining that the identified bandwidth does not satisfy the first threshold bandwidth, determine whether the identified bandwidth satisfies a second threshold bandwidth,
program instructions to, responsive to determining that the identified bandwidth satisfies the second threshold bandwidth, determine whether the identified log file size satisfies a first threshold file size, and
program instructions to, responsive to determining that the identified log file size satisfies the first threshold file size, identify the optimal log analysis location as being the second computer system, and

program instructions to process the identified log file based, at least in part, on the identified optimal log analysis location, wherein processing the identified log file includes splitting portions of the identified log file, pushing log analysis software to the first computer system, transmitting at least a first portion of the identified log file to a first computer system for processing, and transmitting at least a second portion of the identified log file to a second computer system for processing.

Assignees

• IBM

Inventors

• Jhoney Albee
• Krishna Hariharan
• Shetty Rohit

Classifications

• H04L43/16

  Threshold monitoring · CPC title

• H04L43/0894 Primary

  Packet rate · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title