# US 10,872,007 B2 · Methods and systems to compound alerts in a distributed computing system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,007 B2 - Document ID: US10872007B2 - Status: Granted - Kind: B2 - Application number: 15/971,644 - Filed: 2018-05-04 - Published: 2019-11-07 - Granted: 2020-12-22 - Earliest claimed: 2018-05-04 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Darren Brown; Ron Oded Gery - Web page: https://patentgrep.com/patent/US10872007B2 ## CPC - G06F 11/0775: {Content or structure details of the error report, e.g. specific table structure, specific error fields} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0724: {in a multiprocessor or a multi-core unit (multiprocessors per se G06F15/80)} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/0769: {Readable error formats, e.g. cross-platform generic formats, human understandable formats} - G06F 11/0772: {Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers} - G06F 11/0778: {Dumping, i.e. gathering error/state information after a fault for later diagnosis} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Computational methods and systems described herein are directed to compounding alerts generated in a distributed computing system. A user or system administrator may define a set of multistage process rules that can be used by a log management server application to examine log messages generated by event sources of a multistage process for alerts. A log-message database is searched to identify a log-message file used to record log messages generated by the event sources. A single compound alert indicating that the multistage process rules are satisfied is generated, when log messages of the log-message file that satisfy the rules of the multistage process rules have been identified. Methods may also execute remedial action to correct the multistate process when log messages of the log-message file fail to satisfy at least one rule of the multistage process rules. ## Claims ### Claim 1 A process stored in one or more data-storage devices and executed using one or more processors of a computer system to compound alerts of a multistage process executed in a distributed computing system, the process comprising: searching a log-message database stored in a data-storage device to identify a log-message file generated by event sources of the multistage process; identifying log messages of the log-message file that satisfy rules of a set of multistage process rules defined for the multistage process; and generating a compound alert indicating that the set of multistage process rules are satisfied, when log messages of the log-message file that satisfy the rules of the set of multistage process rules have been identified. ### Claim 2 (depends on 1) The process of claim 1 further comprising executing remedial action to correct the multistage process when log messages of the log-message file fail to satisfy at least one rule of the set of multistage process rules. ### Claim 3 (depends on 1) The process of claim 1 wherein identifying log messages of the log-message file that satisfy rules of the set of multistage process rules defined for the multistage process comprises: for each rule, identifying log messages with time stamps in a time interval associated with the rule; and to each log message in the time interval, applying event-type analysis to determine an event type of the log message, comparing terms of the event type to terms of the rule, and writing the log message to a buffer when the event type matches the rule. ### Claim 4 (depends on 3) The process of claim 3 further comprising when no log messages in the time interval satisfies the rule, generating an alert that indicates no log message satisfies the rule. ### Claim 5 A system to compound alerts of a multistage process executed in a distributed computing system, the system comprising: one or more processors; one or more data-storage devices; and machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors controls the system to perform operations comprising: searching a log-message database stored in a data-storage device to identify log-message files generated by event sources of the multistage process; for each log-message file, searching the log-message file for a first log message that satisfies a first rule of multistage process rules that confirms completion of a first stage of the multistage process, when a first log message that satisfies the first rule is identified, incrementing a first stage counter, searching the log-message file for a second log message that satisfies a second rule of the multistage process rules that confirms completion of a second stage of the multistage process, and when a second log message that satisfies the second rule is identified, incrementing a second stage counter; and when the second stage counter is less than the first stage counter, generating a compound alert indicating that not all stages of the multistage process completed successfully. ### Claim 6 (depends on 5) The system of claim 5 further comprising executing remedial action to correct the process, when no log message of the log-message file satisfies the second rule. ### Claim 7 (depends on 5) The system of claim 5 wherein searching the log-message file for the first log message that satisfies the first rule of multistage process rules comprises: identifying log messages with time stamps in a first stage interval of the first rule; and to each log message in the first stage interval, applying event-type analysis to determine an event type of the log messages, comparing terms of the event type to terms of the first rule, and writing the log message to a buffer when the event type matches the first rule, when terms of the event type match terms of the first rule. ### Claim 8 (depends on 5) The system of claim 5 wherein searching the log-message file for the second log message that satisfies the second rule of multistage process rules comprises: identifying log messages with time stamps in a second stage interval of the second rule; and to each log message in the second stage interval, applying event-type analysis to determine an event type of the log messages, comparing terms of the event type to terms of the second rule, and writing the log message to a buffer when the event type matches the second rule, when terms of the event type match terms of the second rule. ### Claim 9 A non-transitory computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system to perform operations comprising: searching a log-message database stored in a data-storage device to identify a log-message file of an event source that runs in a computer system of a distributed computing system; searching the log-message file for a first log message that satisfies a first rule of multistage process rules that confirms completion of a first stage of a multistage process; when a first log message that satisfies the first rule is identified, searching the log-message file for a second log message that satisfies a second rule of the multistage process rules that confirms completion of a second stage of the multistage process; and generating a compound alert indicating that the process completed successfully when a log message of the log-message file satisfies the second rule. ### Claim 10 (depends on 9) The medium of claim 9 further comprising executing remedial action to correct the process, when no log message of the log-message file satisfies the second rule. ### Claim 11 (depends on 9) The medium of claim 9 wherein searching the log-message file for the first log message that satisfies the first rule of multistage process rules comprises: identifying log messages with time stamps in a first stage interval of the first rule; and to each log message in the first stage interval, applying event-type analysis to determine an event type of the log messages, comparing terms of the event type to terms of the first rule, and writing the log message to a buffer when the event type matches the first rule, when terms of the event type match terms of the first rule. ### Claim 12 (depends on 11) The medium of claim 11 further comprising generating an alert that indicates no log message is in the first stage interval, when no log message of the log-message file satisfies the first rule. ### Claim 13 (depends on 9) The medium of claim 9 wherein searching the log-message file for the second log message that satisfies the second rule of multistage process rules comprises: identifying log messages with time stamps in a second stage interval of the second rule; and to each log message in the second stage interval, applying event-type analysis to determine an event type of the log messages, comparing terms of the event type to terms of the second rule, and writing the log message to a buffer when the event type matches the second rule, when terms of the event type match terms of the second rule. ### Claim 14 (depends on 13) The medium of claim 13 further comprising generating an alert that indicates no log message is in the second stage interval, when no log message of the log-message file satisfies the second rule.