# US 12,007,829 B2 · Extended dynamic intelligent log analysis tool > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,007,829 B2 - Document ID: US12007829B2 - Status: Granted - Kind: B2 - Application number: 17/977,683 - Filed: 2022-10-31 - Published: 2024-05-02 - Granted: 2024-06-11 - Earliest claimed: 2022-10-27 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Nirjar Gandhi; Anviti Srivastava; Sudhir Verma; Martin Adam; Vitezslav Visek - Web page: https://patentgrep.com/patent/US12007829B2 ## CPC - G06F 11/0778: {Dumping, i.e. gathering error/state information after a fault for later diagnosis} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0769: {Readable error formats, e.g. cross-platform generic formats, human understandable formats} - G06F 11/0781: {Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract This disclosure describes implementations for categorizing and displaying a Gantt chart of categorized errors, as well as performing an odd pattern analysis to identify anomalous errors including obtaining a log file that includes a number of log entries where each log entry includes an error message. Converting each error message into an error vector using a predictive model. Determining a category for each error vector using a K-nearest neighbor algorithm, and generating a Gantt chart representing error messages arranged hierarchically by category as a function of time for display at a user interface. ## Claims ### Claim 1 A computer implemented method comprising: obtaining a log file comprising a plurality of log entries, each log entry comprising an error message and a timestamp; identifying communities of errors, where identifying communities of errors comprises: creating an error type for each unique error message in the plurality of log entries; dividing the log file into a plurality of sessions, each session representing a predetermined period of time; generating a graph, wherein each error type is plotted as a node in the graph; determining, for a plurality of node pairs, a number of sessions in which both nodes of each node pair occur; plotting edges between each node pair of the plurality of node pairs; assigning a weight to each edge based on the determined number of sessions; and performing a community detection algorithm on the graph to identify communities of errors; and identifying anomalous sessions by identifying sessions comprising errors from more than one community. ### Claim 2 (depends on 1) The method of claim 1, wherein the community detection algorithm is a Louvain method. ### Claim 3 (depends on 1) The method of claim 1, comprising receiving a user input identifying a desired length of sessions; and overwriting a default session length with the desired length of sessions as the predetermined period of time. ### Claim 4 (depends on 1) The method of claim 1, comprising: parsing the log file to extract each error message from the plurality of log entries; and generating, for each error message, an error object, the error object comprising at least one attribute associated with the error. ### Claim 5 (depends on 4) The method of claim 4, wherein at least one attribute comprises a date and time of the error and a text phrase associated with the error. ### Claim 6 (depends on 1) The method of claim 1, wherein identifying communities of errors comprises: determine, for each particular node, a plurality of centrality values, each centrality value representing a closeness of the particular node with a particular community to which it is not assigned; and for each particular node with a centrality value greater than a predetermined threshold, assign that node to the particular community associated with the centrality value in addition to the identified communities of errors. ### Claim 7 (depends on 1) The method of claim 1, wherein identifying communities of errors is done in response to a user interaction at a graphical user interface. ### Claim 8 A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising: obtaining a log file comprising a plurality of log entries, each log entry comprising an error message and a timestamp; identifying communities of errors, where identifying communities of errors comprises: creating an error type for each unique error message in the plurality of log entries; dividing the log file into a plurality of sessions, each session representing a predetermined period of time; generating a graph, wherein each error type is plotted as a node in the graph; determining, for a plurality of node pairs, a number of sessions in which both nodes of each node pair occur; plotting edges between each node pair of the plurality of node pairs; assigning a weight to each edge based on the determined number of sessions; and performing a community detection algorithm on the graph to identify communities of errors; and identifying anomalous sessions by identifying sessions comprising errors from more than one community. ### Claim 9 (depends on 8) The computer-readable medium of claim 8, wherein the community detection algorithm is a Louvain method. ### Claim 10 (depends on 8) The computer-readable medium of claim 8, comprising receiving a user input identifying a desired length of sessions; and overwriting a default session length with the desired length of sessions as the predetermined period of time. ### Claim 11 (depends on 8) The computer-readable medium of claim 8, comprising: parsing the log file to extract each error message from the plurality of log entries; and generating, for each error message, an error object, the error object comprising at least one attribute associated with the error. ### Claim 12 (depends on 11) The computer-readable medium of claim 11, wherein at least one attribute comprises a date and time of the error and a text phrase associated with the error. ### Claim 13 (depends on 8) The computer-readable medium of claim 8, wherein identifying communities of errors comprises: determine, for each particular node, a plurality of centrality values, each centrality value representing a closeness of the particular node with a particular community to which it is not assigned; and for each particular node with a centrality value greater than a predetermined threshold, assign that node to the particular community associated with the centrality value in addition to the identified communities of errors. ### Claim 14 (depends on 8) The computer-readable medium of claim 8, wherein identifying communities of errors is done in response to a user interaction at a graphical user interface. ### Claim 15 A computer-implemented system, comprising: one or more computers; and one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising: obtaining a log file comprising a plurality of log entries, each log entry comprising an error message and a timestamp; identifying communities of errors, where identifying communities of errors comprises: creating an error type for each unique error message in the plurality of log entries; dividing the log file into a plurality of sessions, each session representing a predetermined period of time; generating a graph, wherein each error type is plotted as a node in the graph; determining, for a plurality of node pairs, a number of sessions in which both nodes of each node pair occur; plotting edges between each node pair of the plurality of node pairs; assigning a weight to each edge based on the determined number of sessions; and performing a community detection algorithm on the graph to identify communities of errors; and identifying anomalous sessions by identifying sessions comprising errors from more than one community. ### Claim 16 (depends on 15) The system of claim 15, wherein the community detection algorithm is a Louvain method. ### Claim 17 (depends on 15) The system of claim 15, comprising receiving a user input identifying a desired length of sessions; and overwriting a default session length with the desired length of sessions as the predetermined period of time. ### Claim 18 (depends on 15) The system of claim 15, comprising: parsing the log file to extract each error message from the plurality of log entries; and generating, for each error message, an error object, the error object comprising at least one attribute associated with the error. ### Claim 19 (depends on 18) The system of claim 18, wherein at least one attribute comprises a date and time of the error and a text phrase associated with the error. ### Claim 20 (depends on 15) The system of claim 15, wherein identifying communities of errors comprises: determine, for each particular node, a plurality of centrality values, each centrality value representing a closeness of the particular node with a particular community to which it is not assigned; and for each particular node with a centrality value greater than a predetermined threshold, assign that node to the particular community associated with the centrality value in addition to the identified communities of errors.