# US 2025/0086040 A1 · Automatic collection of relevant logs associated with a service disruption > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0086040 A1 - Document ID: US20250086040A1 - Status: Published application - Kind: A1 - Application number: 18/465,721 - Filed: 2023-09-12 - Published: 2025-03-13 - Earliest claimed: 2023-09-12 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Navjot SINGH - Web page: https://patentgrep.com/patent/US20250086040A1 ## CPC - G06F 11/0766: {Error or fault reporting or storing} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The techniques disclosed herein implement a log collector module that monitors geographically dispersed components in a distributed network for an event that disrupts the normal operation of a service. The distributed network can include a 5G network. In response to determining that the event has occurred, the log collector module triggers the collection of logs related to metrics associated with the event. The logs that are collected include an increased level of verbosity compared to logs that are collected during the normal operation of the service. This enables a cloud service provider to ensure that the root-cause analysis required by service level agreements can be effectively performed. To address the technical challenge imposed by resource constraints, the log collector module only collects the more verbose logs for a predefined time period. Upon expiration of the predefined time period, the collection of the more verbose logs is halted to conserve resources. ## Claims ### Claim 1 A method for improving performance of root-cause analysis associated with an event 108 that disrupts normal operation of a cloud service provided via a distributed network that includes a radio access network and a 5G network, the method comprising: monitoring for the event that disrupts the normal operation of the cloud service provided via the distributed network; determining, based on the monitoring, that the event that disrupts the normal operation of the cloud service provided via the distributed network has occurred; in response to determining that the event that disrupts the normal operation of the cloud service provided via the distributed network has occurred, triggering collection of a plurality of first logs related to a plurality of metrics associated with the event that disrupts the normal operation of the cloud service provided via the distributed network, wherein: the plurality of first logs is collected for a predefined period of time; the plurality of first logs is collected from a plurality of components, in the distributed network, configured to provide the cloud service at different geographic locations; and the plurality of first logs includes an increased level of verbosity compared to a corresponding plurality of second logs related to the plurality of metrics that is collected during the normal operation of the cloud service provided via the distributed network; upon expiration of the predefined period of time, halting the collection of the plurality of first logs; parsing the plurality of first logs to produce a report that correlates abnormal data points based on timestamps; generating a log bundle that contains the plurality of first logs and the report; and providing the log bundle thereby enabling the improved performance of the root-cause analysis associated with the event that disrupts normal operation of the cloud service provided via the distributed network. ### Claim 2 (depends on 1) The method of claim 1, further comprising identifying the plurality of metrics based on a predefined mapping of a type of the event that disrupts the normal operation of the cloud service provided via the distributed network to the plurality of metrics. ### Claim 3 (depends on 2) The method of claim 2, wherein: the predefined mapping is learned via a machine learning model; and the plurality of metrics is updated via the machine learning model. ### Claim 4 (depends on 2) The method of claim 2, wherein the predefined mapping is user-defined. ### Claim 5 (depends on 1) The method of claim 1, further comprising identifying the predefined period of time based on a predefined mapping of a type of the event that disrupts the normal operation of the cloud service provided via the distributed network to the predefined period of time. ### Claim 6 (depends on 5) The method of claim 5, wherein: the predefined mapping is learned via a machine learning model; and the predefined period of time is updated via the machine learning model. ### Claim 7 (depends on 5) The method of claim 5, wherein the predefined mapping is user-defined. ### Claim 8 (depends on 1) The method of claim 1, wherein: the event is associated with an identifier of a specific error or a specific alert; and the event that disrupts the normal operation of the cloud service provided via the distributed network is determined to have occurred based on the identifier being detected at least a predefined number of times in another predefined period of time associated with the event. ### Claim 9 (depends on 1) The method of claim 1, further comprising: capturing data packets at the plurality of components to surface header data and payload data associated with the event; and providing the data packets as part of the bundle. ### Claim 10 (depends on 9) The method of claim 9, further comprising masking user information in the header data and the payload data for data privacy purposes. ### Claim 11 A system for improving performance of root-cause analysis associated with an event that disrupts normal operation of a cloud service provided via a distributed network that includes a radio access network and a core network, the system comprising: a processing system; and a computer readable medium having encoded thereon computer readable instructions that when executed by the processing system cause the system to perform operations comprising: monitoring for the event that disrupts the normal operation of the cloud service provided via the distributed network; determining, based on the monitoring, that the event that disrupts the normal operation of the cloud service provided via the distributed network has occurred; in response to determining that the event that disrupts the normal operation of the cloud service provided via the distributed network has occurred, triggering collection of a plurality of first logs related to a plurality of metrics associated with the event that disrupts the normal operation of the cloud service provided via the distributed network, wherein: the plurality of first logs is collected for a predefined period of time; the plurality of first logs is collected from a plurality of components, in the distributed network, configured to provide the cloud service at different geographic locations; and the plurality of first logs includes an increased level of verbosity compared to a corresponding plurality of second logs related to the plurality of metrics that is collected during the normal operation of the cloud service provided via the distributed network; upon expiration of the predefined period of time, halting the collection of the plurality of first logs; parsing the plurality of first logs to produce a report that correlates abnormal data points based on timestamps; generating a log bundle that contains the plurality of first logs and the report; and providing the log bundle thereby enabling the improved performance of the root-cause analysis associated with the event that disrupts normal operation of the cloud service provided via the distributed network. ### Claim 12 (depends on 11) The system of claim 11, wherein the operations further comprise identifying the plurality of metrics based on a predefined mapping of a type of the event that disrupts the normal operation of the cloud service provided via the distributed network to the plurality of metrics. ### Claim 13 (depends on 12) The system of claim 12, wherein: the predefined mapping is learned via a machine learning model; and the plurality of metrics is updated via the machine learning model. ### Claim 14 (depends on 11) The system of claim 11, wherein the operations further comprise identifying the predefined period of time based on a predefined mapping of a type of the event that disrupts the normal operation of the cloud service provided via the distributed network to the predefined period of time. ### Claim 15 (depends on 14) The system of claim 14, wherein: the predefined mapping is learned via a machine learning model; and the predefined period of time is updated via the machine learning model. ### Claim 16 (depends on 11) The system of claim 11, wherein: the event is associated with an identifier of a specific error or a specific alert; and the event that disrupts the normal operation of the cloud service provided via the distributed network is determined to have occurred based on the identifier being detected at least a predefined number of times in another predefined period of time associated with the event. ### Claim 17 (depends on 11) The system of claim 11, wherein the operations further comprise: capturing data packets at the plurality of components to surface header data and payload data associated with the event; and providing the data packets as part of the bundle. ### Claim 18 (depends on 17) The system of claim 17, wherein the operations further comprise masking user information in the header data and the payload data for data privacy purposes. ### Claim 19 A computer readable storage medium having encoded thereon computer readable instructions that, when executed by a system, cause the system to perform operations comprising: monitoring for the event that disrupts the normal operation of the cloud service provided via the distributed network; determining, based on the monitoring, that the event that disrupts the normal operation of the cloud service provided via the distributed network has occurred; in response to determining that the event that disrupts the normal operation of the cloud service provided via the distributed network has occurred, triggering collection of a plurality of first logs related to a plurality of metrics associated with the event that disrupts the normal operation of the cloud service provided via the distributed network, wherein: the plurality of first logs is collected for a predefined period of time; the plurality of first logs is collected from a plurality of components, in the distributed network, configured to provide the cloud service at different geographic locations; and the plurality of first logs includes an increased level of verbosity compared to a corresponding plurality of second logs related to the plurality of metrics that is collected during the normal operation of the cloud service provided via the distributed network; upon expiration of the predefined period of time, halting the collection of the plurality of first logs; parsing the plurality of first logs to produce a report that correlates abnormal data points based on timestamps; generating a log bundle that contains the plurality of first logs and the report; and providing the log bundle thereby enabling the improved performance of the root-cause analysis associated with the event that disrupts normal operation of the cloud service provided via the distributed network. ### Claim 20 (depends on 19) The computer readable storage medium of claim 19, wherein the operations further comprise identifying the plurality of metrics based on a predefined mapping of a type of the event that disrupts the normal operation of the cloud service provided via the distributed network to the plurality of metrics.