# US 10,484,506 B2 · Systems and processes for computer log analysis

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,506 B2
- Document ID: US10484506B2
- Status: Granted
- Kind: B2
- Application number: 15/641,282
- Filed: 2017-07-04
- Published: 2017-10-19
- Granted: 2019-11-19
- Earliest claimed: 2014-10-05
- Assignees: Yscope Inc.
- Applicants: YScope Inc.
- Inventors: Muhammad Faizanullah; David Lion; Yu Luo; Michael Stumm; Ding Yuan; Xu Zhao; Yongle Zhang
- Web page: https://patentgrep.com/patent/US10484506B2

## CPC

- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- G06F 8/443: {Optimisation}
- G06F 11/3447: {Performance evaluation by modeling}
- G06F 11/3466: {Performance evaluation by tracing or monitoring}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F 11/3608: {using formal methods, e.g. model checking, abstract interpretation (theorem proving G06N5/013)}
- G06F 11/3612: {by runtime analysis (performance monitoring G06F11/3466)}
- G06F 11/323: {Visualisation of programs or trace data}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Existing program code, which is executable on one or more computers forming part of a distributed computer system, is analyzed. The analysis identifies log output instructions present in the program code. Log output instructions are those statements or other code that generate log messages related to service requests processed by the program code. A log model is generated using the analysis. The log model is representative of causal relationships among service requests defined by the program code. The log model can then be applied to logs containing log messages generated by execution of the program code, during its normal operation, to group log messages for improved analysis, including visualization, of the performance and behaviour of the distributed computer system.

## Claims

### Claim 1

A process for performing computer log analysis, the process comprising:
performing an analysis on existing program code that is executable on one or more computers forming part of a distributed computer system, the analysis identifying log output instructions present in the program code, the log output instructions being configured to generate log messages related to service requests processed by the program code;
generating a log model using the analysis, the log model being representative of causal relationships among service requests defined by the program code, generating the log model including automatically generating one or more groups for grouping log messages based on the analysis on the existing program code, generating the log model further including generating a direct acyclic graph containing log points reachable from a top-level method associated with a particular service request to group a first log message with other log messages associated with the particular service request; and
applying the log model to a plurality of log messages generated by execution of the program code to add log messages of the plurality of log messages into the one or more groups.

### Claim 2 (depends on 1)

The process of claim 1, wherein generating the log model comprises identifying a log output statement in the program code and parsing the log output statement to determine a format of the log output statement and any variable referenced by the log output statement to generate a signature of the log output statement.

### Claim 3 (depends on 2)

The process of claim 2, further comprising using a value of a variable referenced by the log output statement to generate the signature for the log output statement.

### Claim 4 (depends on 3)

The process of claim 3, storing in the signature of the log output statement as a regular expression.

### Claim 5 (depends on 1)

The process of claim 1, wherein generating the log model comprises analyzing dataflow of variables of the program code and storing in the log model one or more indications of one or more variables not modified by a particular service as a request identifier of the particular service request.

### Claim 6 (depends on 5)

The process of claim 5, wherein generating the log model comprises identifying a top-level method in the program code as a first method of any thread dedicated to the processing of a single type of service request and storing an identifier of the top-level method in the log model.

### Claim 7 (depends on 6)

The process of claim 6, further comprising determining that the particular service request is processed by the top-level method and storing in the log model the request identifier of the particular service request in association with the identifier of the top-level method.

### Claim 8 (depends on 1)

The process of claim 1, wherein generating the log model comprises identifying log output statements in the program code and generating indications of temporal associations or dissociations among the log output statements.

### Claim 9 (depends on 1)

The process of claim 1, wherein generating the log model comprises identifying log output statements in the program code, identifying threads that contain the log output statements, determining which pairs of the threads communicate with each other, and storing an indication of any determined communicating pairs of threads in the log model.

### Claim 10 (depends on 9)

The process of claim 9, wherein determining which pairs of the threads communicate with each other comprises detecting thread creation.

### Claim 11 (depends on 9)

The process of claim 9, wherein determining which pairs of the threads communicate with each other comprises determining whether two instructions reachable from two top-level methods operate on a shared object, wherein each of the two top-level methods is a first method of any thread dedicated to the processing of a single type of service request.

### Claim 12 (depends on 11)

The process of claim 11, wherein applying the log model comprises adding a particular log message to a particular group on a condition that the particular log message shares a common top-level method with the group.

### Claim 13 (depends on 12)

The process of claim 12, wherein the adding is further based on a condition that one or more request identifiers of the particular log message are not different from one or more request identifiers of the group.

### Claim 14 (depends on 13)

The process of claim 13, wherein the one or more request identifiers of the particular log message and the one or more request identifiers of the group are indicative of variables in the program code that are not modified during processing of a service request.

### Claim 15 (depends on 12)

The process of claim 12, wherein the adding is further based on a condition that a log point of the particular log message matches a temporal sequence in a control flow of the program code.

### Claim 16 (depends on 12)

The process of claim 12, further comprising storing the log model at a logging computer of the distributed computer system, the logging computer performing the applying of the log model.

### Claim 17

A log processing system comprising:
at least one computer to perform an analysis on existing program code that is executable on one or more computers forming part of a distributed computer system, the analysis identifying log output instructions present in the program code, the log output instructions being configured to generate log messages related to service requests processed by the program code;
the at least one computer further to use the analysis to generate a log model of causal relationships among service requests defined by the program code, generation of the log model including automatically generating one or more groups for grouping log messages based on the analysis on the existing program code, generating of the log model further including generating a directed acyclic graph containing log points reachable from a top-level method associated with a particular service request to group a first log message with other log messages associated with the particular service request; and
the at least one computer further to apply the log model to a plurality of log messages generated by execution of the program code to add log messages of the plurality of log messages into the one or more groups.

### Claim 18 (depends on 17)

The system of claim 17, further comprising a results database configured to store indications of the one or more groups.

### Claim 19 (depends on 18)

The system of claim 18, further comprising a visualization engine configured to display data contained in the results database.