# US 11,307,959 B2 · Correlating logs from multiple sources based on log content > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,307,959 B2 - Document ID: US11307959B2 - Status: Granted - Kind: B2 - Application number: 16/416,557 - Filed: 2019-05-20 - Published: 2020-11-26 - Granted: 2022-04-19 - Earliest claimed: 2019-05-20 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Uwe K. Hansmann; Klaus Rindtorff; Daniel Blum; Timo Kussmaul; Thomas Steinheber - Web page: https://patentgrep.com/patent/US11307959B2 ## CPC - G06F 18/24: Classification techniques - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 17/15: Correlation function computation {including computation of convolution operations (arithmetic circuits for sum of products per se, e.g. multiply-accumulators G06F7/5443; digital filters, e.g. FIR, IIR, adaptive filters H03H17/00)} - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06N 3/08: Learning methods - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A computer-implemented method for consolidating log file entries may be provided. The method comprises receiving a first log file and a second log file, determining a first characterizing feature set of a first log file entry of the first log file and a second characterizing feature set of a second log file entry of the second log file, and determining a correlation factor value of a correlation between the first log file entry and the second log file entry by classifying a relationship of the first log file entry and the second log file entry using the characterizing feature sets. The method further comprises upon determining that the correlation factor value is above a predetermined correlation factor threshold value, determining that the first log file entry and the second log file entry relate to each other and belong to a same action flow. ## Claims ### Claim 1 A method for correlating log file entries, said method comprising: receiving a first log file and a second log file; determining a first characterizing feature set of a first log file entry of said first log file and a second characterizing feature set of a second log file entry of said second log file; determining a correlation factor value of a correlation between said first log file entry and said second log file entry by classifying a relationship of said first log file entry and said second log file entry using characterizing feature sets; in response to determining that said correlation factor value is above a predetermined correlation factor threshold value, determining that said first log file entry and said second log file entry relate to each other and belong to a same action flow; based on the determination that said first log file entry and said second log file entry relate to each other and belong to the same action flow, consolidating said first log file entry and said second log file entry into the same action flow; and reconstructing an action flow sequence for the same action flow based on said first log file entry and said second log file entry. ### Claim 2 (depends on 1) The method according to claim 1, wherein said characterizing feature set is selected from a group comprising at least one of a timestamp of an entry in a log file, a log entry origin identifier, a log entry target identifier, a log entry purpose value, user information, content data, a network address, a log origin importance value, and a log request identifier. ### Claim 3 (depends on 1) The method according to claim 1, wherein said first log file and said second log file relate to different service programming and/or service executing frameworks. ### Claim 4 (depends on 1) The method according to claim 1, wherein said classifying of said relationship of said first log file entry and said second log file entry is performed by a first machine-learning system that generates a model for classifying log file entries. ### Claim 5 (depends on 1) The method according to claim 1, wherein, for at least a subset of corresponding features of said characterizing feature sets of said first log entry and said second log entry, a numerical score value is determined. ### Claim 6 (depends on 5) The method according to claim 5, comprising: determining said correlation factor value by determining a difference between a weighted sum of said subset of corresponding features of said first log entry and a weighted sum of said subset of corresponding features of said second log entry based on the numerical score value. ### Claim 7 (depends on 6) The method according to claim 6, comprising: using a second machine-learning system for generating models for determining tags, each model characterizing a log file entry of said first log file and said second log file based on a usability factor for each feature of a log file entry. ### Claim 8 (depends on 1) The method according to claim 1, wherein said action flow is a sequence of correlated and activated services comprising a contextual correlation. ### Claim 9 (depends on 1) The method according to claim 1, comprising: generating a result log comprising said first log file entries and said second log file entries relating to each other and belonging to said same action flow. ### Claim 10 (depends on 2) The method according to claim 2, comprising: extracting said content data from a log entry; requesting originating requestor identifier from a plurality of search engines for a predefined time window associated with said log entry related to said content data; and generating a universal request identifier relating to log file entries for which said content data and said originating requestor identifiers match. ### Claim 11 (depends on 10) The method according to claim 10, wherein said determination of said correlation factor value comprises a function of said universal request identifier indicating a relationship between related log file entries. ### Claim 12 A log consolidation engine system for a consolidation of log file entries, said system comprising: a receiving unit for receiving a first log file and a second log file; a first determination unit for determining a first characterizing feature set of a first log file entry of said first log file and a second characterizing feature set of a second log file entry of said second log file; a second determination unit for determining a correlation factor value of a correlation between said first log file entry and said second log file entry by a classification of a relationship of said first log file entry and said second log file entry using said characterizing feature sets; wherein in response to determining that said correlation factor value is above a predetermined correlation factor threshold value, said second determination unit determines that said first log file entry and said second log file entry relate to each other and belong to a same action flow; wherein based on the determination that said first log file entry and said second log file entry relate to each other and belong to the same action flow, said second determination unit consolidates said first log file entry and said second log file entry into the same action flow; and wherein said second determination unit reconstructs an action flow sequence for the same action flow based on said first log file entry and said second log file entry. ### Claim 13 (depends on 12) The system according to claim 12, wherein said characterizing feature set is selected from a group comprising at least one of a timestamp of an entry in a log file, a log entry origin identifier, a log entry target identifier, a log entry purpose value, user information, content data, a network address, a log origin importance value, and a log request identifier. ### Claim 14 (depends on 12) The system according to claim 12, wherein said first log file and said second log file relate to different service programming and/or service executing frameworks. ### Claim 15 (depends on 12) The system according to claim 12, comprising: a first machine-learning system for classifying said relationship of said first log file entry and said second log file entry, wherein said first machine-learning system generates a model for classifying log file entries. ### Claim 16 (depends on 12) The system according to claim 12, wherein said first determination unit determines a numerical score value for at least a subset of corresponding features of said characterizing feature sets of said first log entry and said second log entry. ### Claim 17 (depends on 12) The system according to claim 12, wherein said second determination unit determines said correlation factor value by determining a difference between a weighted sum of said subset of corresponding features of said first log entry and a weighted sum of said subset of corresponding features of said second log entry based on the numerical score value. ### Claim 18 (depends on 17) The system according to claim 17, comprising: a second machine-learning system trained for generating models for determining tags, each model characterizing a log file entry of said first log file or said second log file based on a usability factor for each feature of a log file entry. ### Claim 19 (depends on 12) The system according to claim 12, comprising: an extraction unit for extracting said content data from a log entry; a requesting unit for requesting originating requestor identifier from a plurality of search engines for a predefined time window associated with said log entry related to said content data; and a generator unit for generating a universal request identifier relating to log file entries for which said content data and said originating requestor identifiers match. ### Claim 20 A computer program product for consolidating log file entries, said computer program product comprising a computer readable storage medium having program instructions embodied therewith, said program instructions being executable by one or more computing systems or controllers to cause said one or more computing systems to: receive a first log file and a second log file; determine a first characterizing feature set of a first log file entry of said first log file and a second characterizing feature set of a second log file entry of said second log file; determine a correlation factor value of a correlation between said first log file entry and said second log file entry by classifying a relationship of said first log file entry and said second log file entry using said characterizing feature sets; in response to determining that said correlation factor value is above a predetermined correlation factor threshold value, determine that said first log file entry and said second log file entry relate to each other and belong to a same action flow; based on the determination that said first log file entry and said second log file entry relate to each other and belong to the same action flow, consolidating said first log file entry and said second log file entry into the same action flow; and reconstructing an action flow sequence for the same action flow based on said first log file entry and said second log file entry.