Back to results
US 11,457,029 B2Granted
Log analysis based on user activity volume
AssigneeMicro Focus LLC
InventorsEran Samuni, Daniel Adrian, Yohay Golan
Life of this patent
Estimating the term…
Abstract
In one example implementation, a log analysis system can comprise an activity engine to monitor user activity of a computer system, a baseline engine to generate an expected baseline of a log, and an abnormality engine to compare the log to the expected baseline to identify an abnormality, compare the abnormality to a user activity volume based on a correlation between the user activity volume and the log activity, and classify the log.
Claims20
A log analysis system comprising:
- a processor;
- and
- a memory to store instructions that, when executed by the processor, cause the processor to:
- monitor user activity of a computer system to determine historical log activity;
- monitor user activity of the computer system to determine a user activity volume by determining a number of multiple real users interacting with the computer system, wherein the user activity volume corresponds to the number of multiple real users;
- generate an expected baseline of a log based on the historical log activity, wherein the log comprises event messages describing states experienced by the computer system;
- compare the log to the expected baseline to identify an abnormality;
- compare the abnormality to the user activity volume based on a correlation between the user activity volume and the historical log activity;
- generate a degree of the abnormality based on a context of the log, wherein the context of the log includes the correlation, and the correlation is based on a degree of user activity volume on the log;
- and
- classify the log based on the abnormality, the correlation, the user activity volume, and the degree of the abnormality.
8 more elements
A computer readable storage medium comprising a set of instructions executable by a processor resource to:
- generate a first graph, the first graph to represent an expected baseline of log activity of a log associated with a computer system based on a log template of the log activity and a seasonal effect of the log activity, wherein the log activity comprises activity represented by event messages that describe states experienced by a computer system and the log template represents a type of event message;
- generate a second graph, the second graph to represent a user activity volume of the computer system, wherein the user activity volume is determined by a number of multiple real users interacting with the computer system, wherein the user activity volume corresponds to the number of multiple real users;
- compare the first graph to the second graph to identify a correlation between the expected baseline and the user activity volume;
- identify an abnormality of the log activity based on the correlation and a difference between the first graph and the log activity;
- generate a degree of the abnormality based on a context of the log, wherein the context of the log includes the correlation, and the correlation is based on a degree of user activity volume on the log;
- and
- score the log activity based on the expected baseline of log activity, the correlation, the user activity volume, and the degree of the abnormality.
4 more elements
A method comprising:
- identifying a log template based on a set of entries of a log, wherein the log comprises event messages describing states experienced by a computer system and the log template represents a type of event message of the log;
- generating a baseline graph associated with expected log activity based on the log template;
- generating a user activity graph associated with a volume of user activity, wherein the volume of user activity is determined by a number of multiple real users interacting with the computer system, wherein the volume of user activity corresponds to the number of multiple real users;
- comparing the user activity graph to the baseline graph to identify a correlation between the log template and the volume of user activity;
- comparing a potential abnormality of the log to the volume of user activity associated with the log, the potential abnormality being a difference between the log and a baseline;
- generating a degree of the potential abnormality based on a context of the log, wherein the context of the log includes the correlation, and the correlation is based on a degree of the volume of user activity on the log;
- and
- visually indicating a status of the log based on a correlation between the potential abnormality and the volume of user activity.
5 more elements
Dependencies are inferred from the claim text.