System and Method for Detecting Anomalies by Discovering Sequences in Log Entries
AssigneeDell Products L.P.
InventorPiotr Przestrzelski
Life of this patent
Estimating the term…
Abstract
A method for detecting an anomaly includes retrieving a log file that includes log entries, grouping the log entries into clusters of log entry types based on number of occurrences and average time interval, and discovering a sequence of the log entry types within each of the clusters. The sequence of the log entry types is based on a shortest path from a first one of the log entry types to a last one of the log entry types.
Claims20
A method detecting an anomaly, the method comprising:
- retrieving, by a processor, a log file that includes a plurality of log entries;
- grouping the log entries into clusters of log entry types based on number of occurrences and average time interval;
- discovering a sequence of the log entry types within each of the clusters, wherein the sequence of the log entry types is based on a shortest path from a first one of the log entry types to a last one of the log entry types;
- and
- determining a deviation to detect the anomaly.
A computing system for detecting an anomaly, the computing system comprising:
- a memory to store a log file that includes a plurality of log entries;
- and
- a processing device to communicate with the memory, the processing device to group the log entries into clusters of log entry types based on a first similarity metric and a second similarity metric, wherein the first similarity metric includes number of occurrences, and wherein the second similarity metric includes average time interval, to discover a sequence of the log entry types in each one of the clusters and to determine a deviation in the cluster.
A non-transitory computer-readable medium including code for performing a method, the method comprising:
- retrieving a log file that includes a plurality of log entries;
- grouping the log entries into clusters of log entry types based on a first similarity metric and a second similarity metric, wherein the first similarity metric includes number of occurrences and the second similarity metric includes a time interval between the occurrences;
- discovering a sequence of log entry types in each one of the clusters, wherein the sequence is based on a shortest path from a first log entry type to a last log entry type;
- and
- detecting an anomaly in the cluster, wherein the anomaly indicates an error in an information handling system.
Dependencies are inferred from the claim text.