# US 2009/0089252 A1 · Searching for associated events in log data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2009/0089252 A1 - Document ID: US20090089252A1 - Status: Published application - Kind: A1 - Application number: 11/866,337 - Filed: 2007-10-02 - Published: 2009-04-02 - Earliest claimed: 2007-10-02 - Assignees: LogLogic, Inc. - Inventors: Boris Galitsky; Sherif Botros - Web page: https://patentgrep.com/patent/US20090089252A1 ## CPC - G06F 16/245: Query processing - G06F 16/332: Query formulation - G06F 16/3335: {Syntactic pre-processing, e.g. stopword elimination, stemming} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract To retrieve a sequence of associated events in log data, a request expression is parsed to retrieve types of dependencies between events which are searched, and the constraints (e.g., keywords) which characterize each event. Based on the parsing results, query components can be formed, expressing the constraints for individual events and interrelations (e.g., time spans) between events. A resultant span query comprising the query components can then be run against an index of events, which encodes a mutual location of associated events in storage. ## Claims ### Claim 1 A method of searching for associated events in log data, comprising: storing one or more events as log messages; creating an index of terms in the log messages in a form so that one or more events can be retrieved in response to a first query; parsing the first query; running the first query; obtaining results from running of first query; forming a second query for associated events based on the results; and performing the second query on the index to determine associated events. ### Claim 2 (depends on 1) The method of claim 1, further comprising: grouping the determined associated events by attributes. ### Claim 3 (depends on 1) The method of claim 1, wherein the second query is selected from a group of query types consisting of a sequence of events query, a multiple restriction query, and a causation query. ### Claim 4 (depends on 3) The method of claim 3, wherein forming the sequence of events query comprises: building one or more queries for individual log messages; and merging the queries for individual log messages as a span query over multiple log messages. ### Claim 5 (depends on 4) The method of claim 4, wherein performing the sequence of events query comprises: performing the queries for individual log messages; and determining a time span between results of the queries for individual log messages; and verifying that the log messages occur within the determined time span. ### Claim 6 (depends on 3) The method of claim 3, wherein forming the multiple restriction query comprises: determining a first query for an intermediate event; and determining a second query for a final event. ### Claim 7 A method of searching for associated events in log data, comprising: processing a first query to identify constant and variable components; forming a second query by merging the constant and variable components; performing the second query to identify merged events to be explained; retrieving events preceding the identified merged events within a first time span; performing a third query based on the constant component to identify constant events to be explained; retrieving events preceding the identified constant events within a second time span; building a first set of intersections for identified merged events; building a second set of intersections for identified constant events; and determining differences between intersections in the first and second sets of intersections. ### Claim 8 (depends on 7) The method of claim 7, further comprising: outputting a list of differences as possible answers to the first query. ### Claim 9 (depends on 1) The method of claim 1, wherein the second query includes multiple query types and at least one query type includes at least one intermediate query. ### Claim 10 A system for identifying a sequence of events in event data, comprising: a storage device operable to index event data for retrieval; and a processor coupled to the storage device and operable to interpret an expression specified by a user to build a query for a sequence of events, and to identify a sequence of events satisfying conditions included in the query. ### Claim 11 (depends on 10) The system of claim 10, where the event data includes log messages. ### Claim 12 A system comprising: a storage device operable for storing one or more events as log messages; and a processor coupled to the storage device and operable for: creating an index of terms in the log messages in a form so that one or more events can be retrieved in response to a first query; parsing the first query; running the first query; obtaining results from running of first query; forming a second query for associated events based on the results; and performing the second query on the index to determine associated events. ### Claim 13 (depends on 12) The system of claim 12, further comprising: grouping the determined associated events by attributes. ### Claim 14 (depends on 12) The system of claim 12, wherein the second query is selected from a group of query types consisting of a sequence of events query, a multiple restriction query, and a causation query. ### Claim 15 (depends on 14) The system of claim 14, wherein forming the sequence of events query comprises: building one or more queries for individual log messages; and merging the queries for individual log messages as a span query over multiple log messages. ### Claim 16 (depends on 15) The system of claim 15, wherein performing the sequence of events query comprises: performing the queries for individual log messages; and determining a time span between results of the queries for individual log messages; and verifying that the log messages occur within the determined time span. ### Claim 17 (depends on 15) The system of claim 15, wherein performing the sequence of events query comprises: performing a single query which includes a time span as a constraint. ### Claim 18 (depends on 14) The system of claim 14, wherein forming the multiple restriction query comprises: determining a third query for an intermediate event; and determining a fourth query for a final event. ### Claim 19 A system comprising: a storage device operable for storing one or more events as log messages; and a processor coupled to the storage device and operable for: processing a first query to identify constant and variable components; forming a second query by merging the constant and variable components; performing the second query to identify merged events to be explained; retrieving events preceding the identified merged events within a first time span; performing a third query based on the constant component to identify constant events to be explained; retrieving events preceding the identified constant events within a second time span; building a first set of intersections for identified merged events; building a second set of intersections for identified constant events; and determining differences between intersections in the first and second sets of intersections. ### Claim 20 (depends on 19) The system of claim 19, further comprising: outputting a list of differences as possible answers to the first query. ### Claim 21 A computer-readable medium having instructions stored thereon, which, when executed by a processor, causes the processor to perform operations comprising: storing one or more events as log messages; creating an index of terms in the log messages in a form so that one or more events can be retrieved in response to a first query; parsing the first query; running the first query; obtaining results from running of first query; forming a second query for associated events based on the results; and performing the second query on the index to determine associated events. ### Claim 22 (depends on 21) The computer-readable medium of claim 21, further comprising: grouping the determined associated events by attributes. ### Claim 23 (depends on 21) The computer-readable medium of claim 21, wherein the second query is selected from a group of query types consisting of a sequence of events query, a multiple restriction query, and a causation query. ### Claim 24 A system comprising: means for storing one or more events as log messages; means for creating an index of terms in the log messages in a form so that one or more events can be retrieved in response to a first query; means for parsing the first query; means for running the first query; means for obtaining results from running of first query; means for forming a second query for associated events based on the results; and means for performing the second query on the index to determine associated events. ### Claim 25 (depends on 24) The system of claim 24, wherein the second query is selected from a group of query types consisting of a sequence of events query, a multiple restriction query, and a causation query.