# US 10,481,967 B2 · Automatic correlation of dynamic system events within computing devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,481,967 B2 - Document ID: US10481967B2 - Status: Granted - Kind: B2 - Application number: 15/385,826 - Filed: 2016-12-20 - Published: 2017-04-13 - Granted: 2019-11-19 - Earliest claimed: 2012-12-18 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Jay Kemper Johnston; David C. White, Jr.; Christopher Blayne Dreier - Web page: https://patentgrep.com/patent/US10481967B2 ## CPC - H04L 41/069: using logs of notifications; Post-processing of notifications - G06F 11/07: Responding to the occurrence of a fault, e.g. fault tolerance - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/0775: {Content or structure details of the error report, e.g. specific table structure, specific error fields} - G06F 11/0787: {Storage of error reports, e.g. persistent data storage, storage using memory protection} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/366: {using diagnostics (G06F11/0703 takes precedence)} - G06F 16/1734: {Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs} - G06F 16/2246: {Trees, e.g. B+trees} - G06F 16/2455: Query execution - G06F 16/9027: {Trees} - G06F 40/137: Hierarchical processing, e.g. outlines - H04L 41/0636: {based on a decision tree analysis} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are described herein for logging system events within an electronic machine using an event log structured as a collection of tree-like cause and effect graphs. An event to be logged may be received. A new event node may be created within the event log for the received event. One or more existing event nodes within the event log may be identified as having possibly caused the received event. One or more causal links may be created within the event log between the new event node and the one or more identified existing event nodes. The new event node may be stored as an unattached root node in response to not identifying an existing event node that may have caused the received event. ## Claims ### Claim 1 A method, comprising: providing, using a computing device, an event log electronic database, the database logically structured as a collection of tree-like graphs, with each node of the graph characterizing a computer network event; receiving, using the computing device, information regarding a new computer network event to be logged; automatically creating, using the computing device, a new event node within the event log database for the new computer network event; automatically identifying, using the computing device, any existing event nodes within the event log database that each represent a respective past computer network event that may have caused the new computer network event, at least in part by matching a characteristic of the new event node to a characteristic of the existing event nodes; automatically creating, using the computing device, a causal link within the event log database between the new event node and each of the identified existing event nodes; and automatically storing, using the computing device, the new event node as an unattached root node in response to not identifying an existing event node representing a past computer network event that may have caused the new computer network event. ### Claim 2 (depends on 1) The method of claim 1, wherein identifying any existing event nodes that each represent a respective past computer network event that may have caused the new computer network event comprises computing a correlation metric between the new event node and the existing event nodes. ### Claim 3 (depends on 1) The method of claim 1, wherein identifying any existing event nodes that each represent a respective past computer network event that may have caused the new computer network event comprises searching existing event nodes created within a specified time period. ### Claim 4 (depends on 1) The method of claim 1, further comprising refreshing a last used parameter of each of the identified existing event nodes within the event log database when the causal link is created to the new event node. ### Claim 5 (depends on 1) The method of claim 1, further comprising determining a deletion order of event nodes within the event log database according to a last used parameter associated with the event nodes. ### Claim 6 (depends on 1) The method of claim 1, further comprising displaying tree-like relationships among the event nodes within the event log database. ### Claim 7 A system, comprising: a computing device comprising an event logging module and an event log electronic database configured to: receive information regarding a new computer network event to be logged; automatically create an event node representing the new event within the event log database; automatically storing the event node within the event log database in a structure comprising a collection of tree-like graphs where wherein links within the graphs represent causal relationships between computer network events represented by linked nodes, and wherein one or more of the links is established where one or more existing event nodes within the event log database is identified as possibly having caused the new computer network event by matching a characteristic of the event node to a characteristic of the one or more existing event nodes; automatically storing the event node as an unattached root node in response to not identifying an existing event node representing a past computer network event that may have caused the new computer network event; and providing an output of one or more result tree-like graphs in response to a user search for an event represented by an event node linked within the one or more result tree-like graphs. ### Claim 8 (depends on 7) The system of claim 7, wherein one or more of the links is established where one or more existing event nodes within the event log database is identified as possibly having caused the new computer network event by computing a correlation metric between the event node and the one or more existing event nodes. ### Claim 9 (depends on 7) The system of claim 7, wherein one or more of the links is established where one or more existing event nodes within the event log is identified as possibly having caused the new computer network event by searching existing event nodes created within a specified time period. ### Claim 10 (depends on 7) The system of claim 7, wherein the computing device is further configured to maintain a last used parameter for each of the event nodes within the event log database. ### Claim 11 (depends on 7) The system of claim 7, wherein a last used parameter is associated with the event nodes within the event log database for determining a deletion order of event nodes. ### Claim 12 (depends on 7) The system of claim 7, wherein the computing device is further configured to graphically display tree-like relationships among the event nodes within the event log database. ### Claim 13 A computer program product, comprising: a non-transitory computer-readable medium having computer-readable program code embodied therein that, when executed by one or more computing machines, perform a method comprising: providing an event log electronic database structured as a collection of tree-like graphs, with each node of the graph characterizing a computer network event; receiving information regarding a new event to be logged; automatically creating a new event node within the event log database for the new computer network event; automatically identifying any existing event nodes within the event log database that each represent a respective past computer network event that may have caused the new computer network event by matching a characteristic of the new event node to a characteristic of the existing event nodes; automatically creating a causal link within the event log database between the new event node and each of the identified existing event nodes; and automatically storing the new event node as an unattached root node in response to not identifying an existing event node representing a past computer network event that may have caused the new computer network event. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein identifying any existing event nodes that each represent a respective past computer network event that may have caused the new computer network event comprises computing a correlation metric between the new event node and the existing event nodes. ### Claim 15 (depends on 13) The computer program product of claim 13, wherein identifying any existing event nodes that each represent a respective past computer network event that may have caused the new computer network event comprises searching existing event nodes created within a specified time period. ### Claim 16 (depends on 13) The computer program product of claim 13, further comprising determining a deletion order of event nodes within the event log database according to a last used parameter associated with the event nodes. ### Claim 17 (depends on 13) The computer program product of claim 13, further comprising displaying tree-like relationships among the event nodes within the event log database.