Recovery of first failure data capture logs

Patent metadata

Field	Value
Publication number	US-2018136993-A1
Application number	US-201615350600-A
Country	US
Kind code	A1
Filing date	Nov 14, 2016
Priority date	Nov 14, 2016
Publication date	May 17, 2018
Grant date	—

Abstract

An approach for recovering event logs. The approach detects corruption in an event log. The approach determines whether a start pointer in a log buffer header is corrupt. Responsive to a determination that the start pointer is corrupt, the approach recovers the start pointer. The approach determines whether an end pointer in the log buffer header is corrupt. Responsive to a determination that the end pointer is corrupt, the approach recovers the end pointer. The approach determines whether an eye catcher in the log buffer header is corrupt. Responsive to a determination that the eye catcher is corrupt, the approach recovers the eye catcher. The approach presents one or more log entries to a management console.

First claim

What is claimed is:

1 . A method for recovering event logs, the method comprising:
detecting, by one or more computer processors, corruption in an event log; determining, by the one or more computer processors, whether a start pointer in a log buffer header of the event log, is corrupt; responsive to a determination that the start pointer is corrupt, recovering, by the one or more computer processors, the start pointer, wherein the start pointer references an initial entry in the event log; determining, by the one or more computer processors, whether an end pointer in the log buffer header of the event log is corrupt; responsive to a determination that the end pointer is corrupt, recovering, by the one or more computer processors, the end pointer, wherein the end pointer references a final entry in the event log; and presenting, by the one or more computer processors, one or more recovered entries in the event log to a management console, wherein the one or more recovered entries are located between the start pointer and the end pointer.

2 . The method of claim 1 , further comprising:
determining, by the one or more computer processors, whether an eye catcher in the log buffer header is corrupt; and responsive to a determination that the eye catcher is corrupt, recovering, by the one or more computer processors, the eye catcher.

3 . The method of claim 2 , wherein recovering, by the one or more computer processors, the eye catcher, further comprising:
verifying, by the one or more computer processors, one or more entries in the event log; and writing, by the one or more computer processors, a non-corrupt eye catcher.

4 . The method of claim 1 , wherein detecting, by the one or more computer processors, corruption in the event log, further comprising:
monitoring, by the one or more computer processors, one or more requests to access the event log, including monitoring one or more requests to write to the event log by an event logger and one or more requests to read the event log by the management console; and detecting, by the one or more computer processors, a failed request to access the event log.

5 . The method of claim 1 , wherein recovering, by the one or more computer processors, the start pointer, further comprising:
identifying, by the one or more computer processors, the initial entry in the event log, wherein the initial entry is not corrupt; and writing, by the one or more computer processors, a non-corrupt start pointer, wherein the non-corrupt start pointer references the initial entry.

6 . The method of claim 1 , wherein recovering, by the one or more computer processors, the end pointer, further comprising:
identifying, by the one or more computer processors, the final entry in the event log, wherein the final entry is not corrupt; and writing, by the one or more computer processors, a non-corrupt end pointer, wherein the non-corrupt end pointer references the final entry.

7 . The method of claim 1 , wherein presenting, by the one or more computer processors, the one or more recovered entries to the management console, further comprising:
identifying, by the one or more computer processors, the one or more recovered entries, wherein the one or more recovered entries are one or more non-corrupt entries in the event log; and presenting, by the one or more computer processors, the one or more recovered entries to the management console.

8 . A computer program product for recovering event logs, the computer program product comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the stored program instructions comprising: program instructions to detect corruption in an event log; program instructions to determine whether a start pointer in a log buffer header of the event log, is corrupt; responsive to a determination that the start pointer is corrupt, program instructions to recover the start pointer, wherein the start pointer references an initial entry in the event log; program instructions to determine whether an end pointer in the log buffer header of the event log is corrupt; responsive to a determination that the end pointer is corrupt, program instructions to recover the end pointer, wherein the end pointer references a final entry in the event log; and program instructions to present one or more recovered entries in the event log to a management console, wherein the one or more recovered entries are located between the start pointer and the end pointer.

9 . The computer program product of claim 8 , further comprising:
program instructions to determine whether an eye catcher in the log buffer header is corrupt; and responsive to a determination that the eye catcher is corrupt, program instructions to recover the eye catcher.

10 . The computer program product of claim 9 , wherein the program instructions to recover the eye catcher, further comprising:
program instructions to verify one or more entries in the event log; and program instructions to write a non-corrupt eye catcher.

11 . The computer program product of claim 8 , wherein the program instructions to detect corruption in the event log, further comprising:
program instructions to monitor one or more requests to access the event log, including monitoring one or more requests to write to the event log by an event logger and one or more requests to read the event log by the management console; and program instructions to detect a failed request to access the event log.

12 . The computer program product of claim 8 , wherein the program instructions to recover the start pointer, further comprising:
program instructions to identify the initial entry in the event log, wherein the initial entry is not corrupt; and program instructions to write a non-corrupt start pointer, wherein the non-corrupt start pointer references the initial entry.

13 . The computer program product of claim 8 , wherein the program instructions to recover the end pointer, further comprising:
program instructions to identify the final entry in the event log, wherein the final entry is not corrupt; and program instructions to write a non-corrupt end pointer, wherein the non-corrupt end pointer references the final entry.

14 . The computer program product of claim 8 , wherein the program instructions to present the one or more recovered entries to the management console, further comprising:
program instructions to identify the one or more recovered entries, wherein the one or more recovered entries are one or more non-corrupt entries in the event log; and program instructions to present the one or more recovered entries to the management console.

15 . A computer system for recovering event logs, the computer system comprising:
one or more computer processors; one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media, the stored program instructions comprising: program instructions to detect corruption in an event log; program instructions to determine whether a start pointer in a log buffer header of the event log, is corrupt; responsive to a determination that the start pointer is corrupt, program instructions to recover the start pointer, wherein the start pointer references an initial entry in the event log; program instructions to determine whether an end pointer in the log buffer header of the event log is corrupt; responsive to a determination that the end pointer is corrupt, program instructions to recover the end pointer,

Assignees

• IBM

Inventors

• Agrrawal Ankur
• Bhat Karthik
• D'Mello Clarence
• Hullahalli Rajashekar Naveen Kumar
• Somasundaram Muruganandam
• Taubert Martin

Classifications

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/0778

  Dumping, i.e. gathering error/state information after a fault for later diagnosis · CPC title

• G06F11/302

  where the computing system component is a software system · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/0706

  the processing taking place on a specific hardware platform or in a specific software environment · CPC title