# US 11,907,171 B2 · Dynamic intelligent log analysis tool > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,171 B2 - Document ID: US11907171B2 - Status: Granted - Kind: B2 - Application number: 17/514,362 - Filed: 2021-10-29 - Published: 2023-05-04 - Granted: 2024-02-20 - Earliest claimed: 2021-10-29 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Anviti Srivastava; Nirjar Gandhi; Akash Gupta; Sudhir Verma; Divyanshu Bajpai - Web page: https://patentgrep.com/patent/US11907171B2 ## CPC - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 16/1805: {Append-only file systems, e.g. using logs or journals to store data} - G06F 11/0775: {Content or structure details of the error report, e.g. specific table structure, specific error fields} - G06F 11/0781: {Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level} - G06F 11/0787: {Storage of error reports, e.g. persistent data storage, storage using memory protection} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for implementing a dynamic intelligent log analysis tool are disclosed. In some embodiments, a computer system performs operations comprising: obtaining a log file comprising a plurality of log entries, each log entry comprising an error message; identifying a set of unique words from the error messages; for each error message, computing a term-frequency vector based on a frequency of occurrence for each unique word of the set of unique words in the error message; for each error message, computing a similarity measure between the term-frequency vectors of the error message and every other error message of the log entries; for each error message, computing a score based on a sum of the similarity measures; and displaying an indication of one or more of the error messages on a computing device based on the scores for the one or more of the error messages. ## Claims ### Claim 1 A computer-implemented method performed by a computer system having a memory and at least one hardware processor, the computer-implemented method comprising: obtaining a log file comprising a plurality of log entries, each log entry in the plurality of log entries comprising a corresponding error message; identifying a set of unique words from the error messages of the plurality of log entries; for each error message in the error messages of the plurality of log entries, computing a corresponding term-frequency vector based on a corresponding frequency of occurrence for each unique word of the set of unique words in the error message; for each error message in the error messages of the plurality of log entries, computing a corresponding similarity measure between the term-frequency vectors of the error message and every other error message of the plurality of log entries; for each error message in the error messages of the plurality of log entries, computing a corresponding score based on a computation of a sum of the corresponding computed similarity measures between the computed term-frequency vectors of the error message and every other error message of the plurality of log entries; and displaying an indication of one or more of the error messages of the plurality of log entries on a computing device based on the corresponding scores for the one or more of the error messages of the plurality of log entries. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the computer system comprises a client-side software tool running on the computing device. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the identifying the set of unique words from the error messages of the plurality of log entries comprises: for each log entry in the plurality of log entries, dividing text of the log entry into a plurality of tokens using natural language processing, the plurality of tokens comprising an error field; grouping the plurality of log entries based on their error fields; and identifying the set of unique words using a bag-of-words model on the error fields of the grouped plurality of log entries. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein identifying the set of unique words from the error messages of the plurality of log entries comprises selecting the plurality of log entries for use in the identifying the set of unique words based on a determination that each log entry in the plurality of log entries satisfies one or more filter criteria input by a user, the one or more filter criteria comprising: a user-specified severity level; a user-specified thread that was used to perform a task when the log entry was recorded in the log file; or a user-specified identification of another user included in the log entry. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the displaying the indication of the one or more of the error messages of the plurality of log entries on the computing device comprises: ranking the error messages of the plurality of log entries based on their corresponding scores; and displaying the indication of the one or more of the error messages of the plurality of log entries based on the ranking. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, from the computing device, a user selection of a selectable user interface element displayed in association with the corresponding indication of one of the one or more of the error messages of the plurality of log entries; and in response to the receiving the user selection: modifying the plurality of log entries to exclude the log entry corresponding to the indication of the one of the one or more of the error messages for which the associated selectable user interface element was selected via the user selection; identifying another set of unique words from the error messages of the modified plurality of log entries; for each error message in the error messages of the modified plurality of log entries, computing another corresponding term-frequency vector based on another corresponding frequency of occurrence for each unique word of the other set of unique words in the error message; for each error message in the error messages of the modified plurality of log entries, computing another corresponding similarity measure between the error message and every other error message of the modified plurality of log entries; for each error message in the error messages of the modified plurality of log entries, computing another corresponding score based on another sum of the other corresponding similarity measures between the error message and every other error message of the modified plurality of log entries; and displaying another indication of one or more of the error messages of the modified plurality of log entries on the computing device based on the other corresponding scores for the one or more of the error messages of the modified plurality of log entries. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, from the computing device, a user selection of a selectable user interface element displayed in association with the corresponding indication of one of the one or more of the error messages of the plurality of log entries; and in response to the receiving the user selection, displaying log details of the log entry corresponding to the indication of the one of the one or more of the error messages for which the associated selectable user interface element was selected via the user selection. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, from the computing device, a user selection of a selectable user interface element displayed in association with the corresponding indication of one of the one or more of the error messages of the plurality of log entries; and in response to the receiving the user selection, displaying a stack trace of the log entry corresponding to the indication of the one of the one or more of the error messages for which the associated selectable user interface element was selected via the user selection. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising displaying, on the computing device, a frequency distribution of the error messages of the plurality of log entries by date. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, further comprising displaying, one the computing device, a distribution of the plurality of log entries by components present in the plurality of log files. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, further comprising displaying, by the computing device, a distribution of the plurality of log entries by users present in the plurality of log files. ### Claim 12 A system of comprising: at least one hardware processor; and a non-transitory computer-readable medium storing executable instructions that, when executed, cause the at least one hardware processor to perform operations comprising: obtaining a log file comprising a plurality of log entries, each log entry in the plurality of log entries comprising a corresponding error message; identifying a set of unique words from the error messages of the plurality of log entries; for each error message in the error messages of the plurality of log entries, computing a corresponding term-frequency vector based on a corresponding frequency of occurrence for each unique word of the set of unique words in the error message; for each error message in the error messages of the plurality of log entries, computing a corresponding similarity measure between the term-frequency vectors of the error message and every other error message of the plurality of log entries; for each error message in the error messages of the plurality of log entries, computing a corresponding score based on a computation of a sum of the corresponding computed similarity measures between the computed term-frequency vectors of the error message and every other error message of the plurality of log entries; and displaying an indication of one or more of the error messages of the plurality of log entries on a computing device based on the corresponding scores for the one or more of the error messages of the plurality of log entries. ### Claim 13 (depends on 12) The system of claim 12, wherein the computer system comprises a client-side software tool running on the computing device. ### Claim 14 (depends on 12) The system of claim 12, wherein the identifying the set of unique words from the error messages of the plurality of log entries comprises: for each log entry in the plurality of log entries, dividing text of the log entry into a plurality of tokens using natural language processing, the plurality of tokens comprising an error field; grouping the plurality of log entries based on their error fields; and identifying the set of unique words using a bag-of-words model on the error fields of the grouped plurality of log entries. ### Claim 15 (depends on 12) The system of claim 12, wherein identifying the set of unique words from the error messages of the plurality of log entries comprises selecting the plurality of log entries for use in the identifying the set of unique words based on a determination that each log entry in the plurality of log entries satisfies one or more filter criteria input by a user, the one or more filter criteria comprising: a user-specified severity level; a user-specified thread that was used to perform a task when the log entry was recorded in the log file; or a user-specified identification of another user included in the log entry. ### Claim 16 (depends on 12) The system of claim 12, wherein the displaying the indication of the one or more of the error messages of the plurality of log entries on the computing device comprises: ranking the error messages of the plurality of log entries based on their corresponding scores; and displaying the indication of the one or more of the error messages of the plurality of log entries based on the ranking. ### Claim 17 (depends on 12) The system of claim 12, wherein the operations further comprise: receiving, from the computing device, a user selection of a selectable user interface element displayed in association with the corresponding indication of one of the one or more of the error messages of the plurality of log entries; and in response to the receiving the user selection: modifying the plurality of log entries to exclude the log entry corresponding to the indication of the one of the one or more of the error messages for which the associated selectable user interface element was selected via the user selection; identifying another set of unique words from the error messages of the modified plurality of log entries; for each error message in the error messages of the modified plurality of log entries, computing another corresponding term-frequency vector based on another corresponding frequency of occurrence for each unique word of the other set of unique words in the error message; for each error message in the error messages of the modified plurality of log entries, computing another corresponding similarity measure between the term-frequency vectors of the error message and every other error message of the modified plurality of log entries; for each error message in the error messages of the modified plurality of log entries, computing another corresponding score based on another sum of the other corresponding similarity measures between the term-frequency vectors of the error message and every other error message of the modified plurality of log entries; and displaying another indication of one or more of the error messages of the modified plurality of log entries on the computing device based on the other corresponding scores for the one or more of the error messages of the modified plurality of log entries. ### Claim 18 (depends on 12) The system of claim 12, wherein the operations further comprise: receiving, from the computing device, a user selection of a selectable user interface element displayed in association with the corresponding indication of one of the one or more of the error messages of the plurality of log entries; and in response to the receiving the user selection, displaying log details of the log entry corresponding to the indication of the one of the one or more of the error messages for which the associated selectable user interface element was selected via the user selection. ### Claim 19 (depends on 12) The system of claim 12, wherein the operations further comprise: receiving, from the computing device, a user selection of a selectable user interface element displayed in association with the corresponding indication of one of the one or more of the error messages of the plurality of log entries; and in response to the receiving the user selection, displaying a stack trace of the log entry corresponding to the indication of the one of the one or more of the error messages for which the associated selectable user interface element was selected via the user selection. ### Claim 20 A non-transitory machine-readable storage medium tangibly embodying a set of instructions that, when executed by at least one hardware processor, causes the at least one processor to perform operations comprising: obtaining a log file comprising a plurality of log entries, each log entry in the plurality of log entries comprising a corresponding error message; identifying a set of unique words from the error messages of the plurality of log entries; for each error message in the error messages of the plurality of log entries, computing a corresponding term-frequency vector based on a corresponding frequency of occurrence for each unique word of the set of unique words in the error message; for each error message in the error messages of the plurality of log entries, computing a corresponding similarity measure between the error message and every other error message of the plurality of log entries; for each error message in the error messages of the plurality of log entries, computing a corresponding score based on a computation of a sum of the corresponding computed similarity measures between the computed term-frequency vectors of the error message and every other error message of the plurality of log entries; and displaying an indication of one or more of the error messages of the plurality of log entries on a computing device based on the corresponding scores for the one or more of the error messages of the plurality of log entries.