# US 8,386,498 B2 · Message descriptions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,386,498 B2
- Document ID: US8386498B2
- Status: Granted
- Kind: B2
- Application number: 12/536,444
- Filed: 2009-08-05
- Published: 2011-02-10
- Granted: 2013-02-26
- Earliest claimed: 2009-08-05
- Assignees: LogLogic, Inc.
- Applicants: Sanford Whitehouse
- Inventors: Sanford Whitehouse
- Web page: https://patentgrep.com/patent/US8386498B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Messages (e.g., log messages or any form of record oriented data) are analyzed for identifiable value patterns. When a pattern is located the value is replaced by a name or “token” for the pattern, resulting in a “message description” for the message. When analysis is finished and token/value replacements are complete the message description can be stored as a reference to the message.

## Claims

### Claim 1

A computer-implemented method, comprising:
receiving a first message, the first message comprising a structure that includes a value and a context of the value;
searching the first message using a value pattern, the value pattern including a string pattern of the value and being different from the structure;
generating a first message description for the first message, wherein generating the first message description comprises:
identify the value from the first message that matches the value pattern;
generating a token, the token including a named string for the value; and
generating the first message description using the structure in the first message in which the token replaces the value, the first message description comprising the structure of the first message, wherein in the first message description, the token is placed in the context of the value according to the structure in the first message; and
storing the first message description as a reference to the first message.

### Claim 2 (depends on 1)

The method of claim 1, where the searching is grammar independent such that the first message description is operable to describe messages from different vendors or products.

### Claim 3 (depends on 1)

The method of claim 1, where the first message description is operable to describe all messages in a message set.

### Claim 4 (depends on 1)

The method of claim 1, where the first message is formatted as one or more lines of text, structured data or binary data.

### Claim 5 (depends on 1)

The method of claim 1, where the first message description includes a relationship of the first message to its values.

### Claim 6 (depends on 1)

The method of claim 1, where the first message description includes a relationship between the first message and a second message.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
constructing a parsing or mapping rule that supports the first message description for the first message; and
applying the parsing rule to a second message.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
correcting the first message description; and
creating a second message description using the corrected first message description.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
generating a report using the first message description.

### Claim 10 (depends on 1)

The method of claim 1, further comprising:
searching a log message database using the first message description.

### Claim 11

A message management system, comprising:
at least one computing device, wherein the computer device has a processor and a memory;
an interface coupled to a message collector for receiving a first message, the first message comprising a structure that includes a value and a context of the value; and
a message description system coupled to the interface, the message description system configured for:
searching the first message using a value pattern, the value pattern including a string pattern of the value and being different from the structure;
generating a first message description for the first message, wherein generating the first message description comprises:
identify the value from the first message that matches the value pattern; generating a token, the token including a named string for the value; and generating the first message description using the structure in the first message in which the token replaces the value, the first message description comprising the structure of the first message, wherein in the first message description, the token is placed in the context of the value according to the structure in the first message; and
storing the first message description as a reference to the first message.

### Claim 12 (depends on 11)

The system of claim 11, where the searching is grammar independent such that the first message description is operable to describe messages from different vendors or products.

### Claim 13 (depends on 11)

The system of claim 11, where the first message description is operable to describe all messages in a message set.

### Claim 14 (depends on 11)

The system of claim 11, where the first message is formatted as one or more lines of text, structured data or binary data.

### Claim 15 (depends on 11)

The system of claim 11, where the first message description includes a relationship of the first message to its values.

### Claim 16 (depends on 11)

The system of claim 11, where the first message description includes a relationship between the first message and a second message.

### Claim 17 (depends on 11)

The system of claim 11, where the message description system is configured for:
constructing a parsing or mapping rule that support the first message description; and
applying the parsing or mapping rule to a second message.

### Claim 18 (depends on 11)

The system of claim 11, where the message description system is configured for:
correcting the first message description; and
creating a second message description using the corrected first message description.

### Claim 19 (depends on 11)

The system of claim 11, further comprising:
a reporting engine configured for generating reports using the first message description.

### Claim 20 (depends on 11)

The system of claim 11, further comprising:
a search engine configured for searching a log message database using the first message description.

### Claim 21

A non-transitory computer storage device storing instructions operable to cause one or more computer processors to perform operations comprising:
receiving a first message, the first message comprising a structure that includes a value and a context of the value;
searching the first message using a value pattern, the value pattern including a string pattern of the value and being different from the structure;
generating a first message description for the first message, wherein generating the first message description comprises:
identify the value from the first message that matches the value pattern; generating a token, the token including a named string for the value; and generating the first message description using the structure in the first message in which the token replaces the value, the first message description comprising the structure of the first message, wherein in the first message description, the token is placed in the context of the value according to the structure in the first message; and
storing the first message description as a reference to the first message.