Automated log analysis
AssigneeCisco Technology, Inc.
InventorsXinyuan Huang, Manoj Sharma, Debojyoti Dutta
Life of this patent
Estimating the term…
Abstract
There is disclosed in an example a computer-implemented method of providing automated log analysis, including: receiving a log stream comprising a plurality of transaction log entries, the log entries comprising a time stamp, a component identification (ID), and a name value pair identifying a transaction; creating an index comprising mapping a key ID to a name value pair of a log entry; and selecting from the index a key ID having a relatively large number of repetitions. There is also disclosed an apparatus and computer-readable medium for performing the method.
Claims20
A computer-implemented method of providing automated log analysis, the method comprising the steps of:
- receiving a log stream with a plurality of transaction log entries;
- pre-processing, by parsing and structuring, the plurality of transaction log entries to a name-value format, each of the plurality of transaction log entries including a time stamp, a component identification, and a name-value pair identifying a transaction, the name-value pair including a name field paired with a value field;
- before creating an index, filtering the plurality of transaction log entries to eliminate any false positives;
- when the plurality of transaction log entries include the name-value format per the pre-processing:
- creating the index of the plurality of transaction log entries, with a key identification (ID) mapped to the component identification of each of the plurality of transaction log entries,
- selecting, from the index, the key ID based on a number of repetitions of the key ID;
- and
- based on the selection of the key ID, building without a priori knowledge, a transaction model;
- and
- when the plurality of transaction log entries do not include the name-value format per the pre-processing, diverting or rejecting the plurality of transaction log entries.
A computing apparatus comprising:
- a log analysis engine comprising at least a processor and a memory, the log analysis engine configured to:
- receive a log stream with a plurality of transaction log entries;
- pre-process, by parsing and structuring, the plurality of transaction log entries to a name-value format, each of the plurality of transaction log entries including a time stamp, a component identification, and a name-value pair identifying a transaction, the name-value pair including a name field paired with a value field;
- before creation of an index, filter the plurality of transaction log entries to eliminate any false positives;
- when the plurality of transaction log entries include the name-value format per the pre-process:
- create the index of the plurality of transaction log entries, with a key identification (ID) mapped to the component identification of each of the plurality of transaction log entries,
- select, from the index, the key ID based on a number of repetitions;
- and
- based on the selection of the key ID, build without a priori knowledge, a transaction model;
- and
- when the plurality of transaction log entries do not include the name-value format per the pre-process, divert or reject the plurality of transaction log entries.
One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions for instructing a processor to provide a log analysis engine configured to:
- receive a log stream with a plurality of transaction log entries;
- pre-process, by parsing and structuring, the plurality of transaction log entries to a name-value format, each of the plurality of transaction log entries including a time stamp, a component identification, and a name-value pair identifying a transaction, the name-value pair including a name field paired with a value field;
- before creation of an index, filter the plurality of transaction log entries to eliminate any false positives;
- when the plurality of transaction log entries include the name-value format per the pre-process:
- create the index of the plurality of transaction log entries, with a key identification (ID) mapped to the component identification of each of the plurality of transaction log entries,
- select, from the index, the key ID based on a number of repetitions;
- and
- based on the selection of the key ID, build without a priori knowledge, a transaction model;
- and
- when the plurality of transaction log entries do not include the name-value format per the pre-process, divert or reject the plurality of transaction log entries.
Dependencies are inferred from the claim text.