Correlating logs from multiple sources based on log content

A log consolidation engine system for a consolidation of log file entries, said system comprising:

• a receiving unit for receiving a first log file and a second log file;
• a first determination unit for determining a first characterizing feature set of a first log file entry of said first log file and a second characterizing feature set of a second log file entry of said second log file;
• a second determination unit for determining a correlation factor value of a correlation between said first log file entry and said second log file entry by a classification of a relationship of said first log file entry and said second log file entry using said characterizing feature sets;
• wherein in response to determining that said correlation factor value is above a predetermined correlation factor threshold value, said second determination unit determines that said first log file entry and said second log file entry relate to each other and belong to a same action flow;
• wherein based on the determination that said first log file entry and said second log file entry relate to each other and belong to the same action flow, said second determination unit consolidates said first log file entry and said second log file entry into the same action flow;
• and
• wherein said second determination unit reconstructs an action flow sequence for the same action flow based on said first log file entry and said second log file entry.

A computer program product for consolidating log file entries, said computer program product comprising a computer readable storage medium having program instructions embodied therewith, said program instructions being executable by one or more computing systems or controllers to cause said one or more computing systems to:

• receive a first log file and a second log file;
• determine a first characterizing feature set of a first log file entry of said first log file and a second characterizing feature set of a second log file entry of said second log file;
• determine a correlation factor value of a correlation between said first log file entry and said second log file entry by classifying a relationship of said first log file entry and said second log file entry using said characterizing feature sets;
• in response to determining that said correlation factor value is above a predetermined correlation factor threshold value, determine that said first log file entry and said second log file entry relate to each other and belong to a same action flow;
• based on the determination that said first log file entry and said second log file entry relate to each other and belong to the same action flow, consolidating said first log file entry and said second log file entry into the same action flow;
• and
• reconstructing an action flow sequence for the same action flow based on said first log file entry and said second log file entry.