System for decomposing events and unstructured data

Patent metadata

Field	Value
Publication number	US-2022014419-A1
Application number	US-202117483818-A
Country	US
Kind code	A1
Filing date	Sep 24, 2021
Priority date	Jan 27, 2015
Publication date	Jan 13, 2022
Grant date	—

Abstract

A system texecutes automatic attribute inference and includes: a processor; a memory coupled to the memory; a first engine that executes automatic attribute inference; an extraction engine in communication with a managed infrastructure and the first engine, the extraction engine configured to receive managed infrastructure data; and a signaliser engine that includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine, the signaliser engine inputting a list of devices and a list a connections between components or nodes in the managed infrastructure, the signaliser engine determining one or more common characteristics and produces one or more dusters of events.

First claim

What is claimed is:

1 . A system that executes automatic attribute inference, comprising:
a processor; a memory coupled to the memory; a first engine that executes automatic attribute inference; an extraction engine in communication with a managed infrastructure and the first engine, the extraction engine configured to receive managed infrastructure data; and a signaliser engine that includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine, the signaliser engine inputting a list of devices and a list a connections between components or nodes in the managed infrastructure, the signaliser engine determining one or more common characteristics and produces one or more clusters of events.

2 . The system of claim 1 , wherein key attributes of an occurred event of a message are itemized in a first field.

3 . The system of claim 2 , further comprising:
a manager that provides for the occurred event one or more of: an indication of: what the event was, what generated the event, a source of the event; and a host device or host application that generated the event.

4 . The system of claim 2 , wherein a type of the event is determined.

5 . The system of claim 4 , wherein the event is from one or more of:
a database; and from an application.

6 . The system of claim 5 , wherein a plurality of different attributes describes the event to denote a problem that has occurred.

7 . The system of claim 2 , wherein a second field represents the thing that has generated the message.

8 . The system of claim 7 , wherein a third field includes severity information.

9 . The system of claim 1 , wherein everything in a file of the stream of data has the same format.

10 . The system of claim 1 , wherein each of a row represents an unstructured message.

11 . The system of claim 1 , wherein each record is a different form of a semi structured message.

12 . The system of claim 2 , wherein each of a row represents a different type of message.

13 . The system of claim 1 , wherein the system provides an understanding of unstructured data, and enables a single user to understand the unstructured data.

14 . The system of claim 1 , wherein arbitrary format files containing structured unstructured data are converted into a structured format that the rest of the system needs to consume.

15 . The system of claim 14 , wherein the structured format provides an event record structure.

16 . The system of claim 1 , wherein a structured data of a message is an event record.

17 . The system of claim 16 , wherein values are assigned to all of those attributes with the attributes being extracted.

18 . The system of claim 16 , wherein each of a message has a plurality of components.

19 . The system of claim 1 , wherein tokens represent different attributes that a structured message requires.

20 . The system of claim 19 , wherein a token can be a single word or a group of words.

21 . The system of claim 19 , wherein a source attribute is assigned to an event, and different tokens in a message represent different things.

22 . The system of claim 19 , wherein a host is identified and assigned to an event.

23 . The system of claim 19 , wherein three groups of characters representing month, day, and time.

24 . The system of claim 23 , wherein the three groups can represent when an event was created.

25 . The system of claim 19 , wherein the system is configured to identify groups of tokens as part of a same event attribute.

26 . The system of claim 19 , wherein different types of event attributes are deduced from multiple tokens of a message.

27 . The system of claim 19 , wherein an unstructured message is reviewed, and tokens within that message represent different fields that are required in a value record.

28 . The system of claim 27 , wherein one token out of the message can represent source, one token can represent a service, and another token can represent a severity.

29 . The system of claim 19 , wherein a message is presented to a user with a first part including date and time, and the entire thing.

30 . The system of claim 19 , wherein a human readable description can be extracted from a log message.

31 . The system of claim 19 , wherein the system decides which components from an unstructured message are present to a user.

32 . The system of claim 29 , wherein a second part of the message is an alert classification of the first section.

33 . The system of claim 19 , wherein words and tokens are taken out of a log message and assigned to an attribute in an event along with an alert classification.

34 . The system of claim 33 , wherein the log message is looked as a whole and assigned an arbitrary label.

35 . The system of claim 34 , wherein the labels are not necessarily tokens that appear in the message itself.

36 . The system of claim 19 , wherein classification allows assignment of a label to each of an alert.

37 . The system of claim 36 , wherein assignment of a label to each of an alert is done for a whole different set of attributes, including a class of an event, and a type of an event.

38 . The system of claim 19 , wherein a set of user interface (UI) concepts allows a user to label inbound data and create training data from it.

39 . The system of claim 38 , wherein a user can graphically configure a data ingestion process as a whole, and at the same time create training data for the system.

40 . The system of claim 39 , wherein system allows a user to create manual overrides for log messages.

Assignees

• Moogsoft Inc

Inventors

• Tee Philip
• Harper Robert Duncan

Classifications

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• H04L41/0686

  Additional information in the notification, e.g. enhancement of specific meta-data · CPC title

• H04L43/045

  for graphical visualisation of monitoring data · CPC title

• G06N3/048

  Activation functions · CPC title

• G06N3/0499

  Feedforward networks · CPC title