# US 10,372,595 B1 · System and method to diagnose applications by accessing log files associated with different subsystems of a data center via a common interface > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,595 B1 - Document ID: US10372595B1 - Status: Granted - Kind: B1 - Application number: 15/380,915 - Filed: 2016-12-15 - Granted: 2019-08-06 - Earliest claimed: 2016-12-15 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Shelesh Chopra; Gururaj Kulkarni - Web page: https://patentgrep.com/patent/US10372595B1 ## CPC - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/3688: {for test execution, e.g. scheduling of test suites} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 11/3692: {for test results analysis} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 2201/86: Event-based monitoring - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract According to one embodiment, a computer system receives a user request from a user to diagnose an application, the request having information describing a symptom of a behavior of an application. In response to the request, the system identifies one or more components that provide services to the application. For each of the components, the system identifies a log file that logs events that have occurred during operations of the corresponding component, and parses the log file in view of the request to identify one or more events associated with the symptom of the behavior. The system analyzes the events associated with the symptom of the behavior to identify a potential problem. The system accesses a knowledgebase (KB) corresponding to the component to determine a potential solution to the problem. ## Claims ### Claim 1 A computer-implemented method to diagnose applications, comprising: receiving a user request to diagnose an application, the user request having information describing a symptom of a behavior of an application; in response to the user request, identifying one or more components that provide services to the application; for each of the components, identifying a log file that logs events occurred during operations of the corresponding component, and parsing the log file in view of the user request to identify one or more events associated with the symptom of the behavior, comprising classifying the events logged in the log file based on at least one of: a time stamp, a category, a component, or a log message; analyzing the events associated with the symptom of the behavior to identify a potential problem; accessing a knowledgebase (KB) corresponding to the component to determine a potential solution to the problem, wherein the KB is hosted at a KB server where operations associated with ordering and sorting of articles stored in the KB are parallelized. ### Claim 2 (depends on 1) The method of claim 1, further comprising returning to the user a link to an article stored in the knowledgebase describing the solution. ### Claim 3 (depends on 1) The method of claim 1, further comprising: presenting a plurality of graphical representations representing a plurality of enterprise solutions to a user; in response to a user selection of one of the graphical representations selecting one of the enterprise solutions, automatically discovering one or more subsystems associated with the selected enterprise solution, wherein the application is part of the selected enterprise solution. ### Claim 4 (depends on 3) The method of claim 3, further comprising prompting the user one or more queries to obtain one or more error messages describing the symptom of the behavior, wherein the error messages are included in the user request. ### Claim 5 (depends on 4) The method of claim 4, wherein parsing a log file comprising searching in the log file based on at least one of the error messages to locate the events that are associated with the error message. ### Claim 6 (depends on 4) The method of claim 4, wherein accessing the KB is performed by searching articles stored in the KB based on the error messages to identify one or more articles that are related to the error messages. ### Claim 7 A computer-readable storage medium having instructions stored therein, which when executed by a computer, cause the computer to perform operations, the operations comprising: receiving a user request to diagnose an application, the user request having information describing a symptom of a behavior of an application; in response to the user request, identifying one or more components that provide services to the application; for each of the components, identifying a log file that logs events occurred during operations of the corresponding component, and parsing the log file in view of the user request to identify one or more events associated with the symptom of the behavior, comprising classifying the events logged in the log file based on at least one of: a time stamp, a category, a component, or a log message; analyzing the events associated with the symptom of the behavior to identify a potential problem; accessing a knowledgebase (KB) corresponding to the component to determine a potential solution to the problem, wherein the KB is hosted at a KB server where operations associated with ordering and sorting of articles stored in the KB are parallelized. ### Claim 8 (depends on 7) The computer-readable storage medium of claim 7, wherein the operations further comprise returning to the user a link to an article stored in the knowledgebase describing the solution. ### Claim 9 (depends on 7) The computer-readable storage medium of claim 7, wherein the operations further comprise: presenting a plurality of graphical representations representing a plurality of enterprise solutions to a user; in response to a user selection of one of the graphical representations selecting one of the enterprise solutions, automatically discovering one or more subsystems associated with the selected enterprise solution, wherein the application is part of the selected enterprise solution. ### Claim 10 (depends on 9) The computer-readable storage medium of claim 9, further comprising prompting the user one or more queries to obtain one or more error messages describing the symptom of the behavior, wherein the error messages are included in the user request. ### Claim 11 (depends on 10) The computer-readable storage medium of claim 10, wherein parsing a log file comprising searching in the log file based on at least one of the error messages to locate the events that are associated with the error message. ### Claim 12 (depends on 10) The computer-readable storage medium of claim 10, wherein accessing the KB is performed by searching articles stored in the KB based on the error messages to identify one or more articles that are related to the error messages. ### Claim 13 A data processing system, comprising: a processor: and a memory couple to the process to store instructions, which when executed by the processor, cause the processor to perform operations, the operations include receiving a user request to diagnose an application, the user request having information describing a symptom of a behavior of an application; in response to the user request, identifying one or more components that provide services to the application; for each of the components, identifying a log file that logs events occurred during operations of the corresponding component, and parsing the log file in view of the user request to identify one or more events associated with the symptom of the behavior, comprising classifying the events logged in the log file based on at least one of: a time stamp, a category, a component, or a log message; analyzing the events associated with the symptom of the behavior to identify a potential problem; accessing a knowledgebase (KB) corresponding to the component to determine a potential solution to the problem, wherein the KB is hosted at a KB server where operations associated with ordering and sorting of articles stored in the KB are parallelized. ### Claim 14 (depends on 13) The data processing system of claim 13, wherein the operations further comprise returning to the user a link to an article stored in the knowledgebase describing the solution. ### Claim 15 (depends on 13) The data processing system of claim 13, wherein the operations further comprise: presenting a plurality of graphical representations representing a plurality of enterprise solutions to a user; in response to a user selection of one of the graphical representations selecting one of the enterprise solutions, automatically discovering one or more subsystems associated with the selected enterprise solution, wherein the application is part of the selected enterprise solution. ### Claim 16 (depends on 15) The data processing system of claim 15, wherein the operations further comprise prompting the user one or more queries to obtain one or more error messages describing the symptom of the behavior, wherein the error messages are included in the user request. ### Claim 17 (depends on 16) The data processing system of claim 16, wherein parsing a log file comprising searching in the log file based on at least one of the error messages to locate the events that are associated with the error message. ### Claim 18 (depends on 16) The data processing system of claim 16, wherein accessing the KB is performed by searching articles stored in the KB based on the error messages to identify one or more articles that are related to the error messages.