Cross-machine event log correlation
AssigneeMicrosoft Corporation
InventorsSeyedeh Pardis Miri, Pankaj Garg, Benjamin Schultz, Sandeep Kishan Singhal, Madhan Sivakumar
Life of this patent
Estimating the term…
Abstract
In computing environments having multiple computers, where such computers may comprise virtual machines, events are logged in association with corresponding activity identifiers. When a data packet associated with an activity is transferred to a destination machine, the activity identifier corresponding to the activity is transferred along with the data packet and used by the destination machine when logging its events. This allows events from the two machines to be correlated according to the activities to which they pertain.
Claims20
In a virtual computing environment, a method comprising:
- within a host machine of a virtual machine, communicating a data packet through a first protocol stack, the first protocol stack comprising a first series of processing components;
- within the virtual machine, communicating the data packet through a second protocol stack, the second protocol stack comprising a second series of processing components;
- associating one or more activity identifiers with the data packet as it is communicated through the first and second protocol stacks;
- reporting events from the processing components of the first and second protocol stacks, the reported events relating to processing of the data packet by the processing components of the first and second protocol stacks;
- specifying the one or more activity identifiers with the reported events;
- and
- communicating between the host machine and the virtual machine at least one of the one or more activity identifiers with the data packet.
A method comprising:
- communicating data packets between a first machine and second machine;
- within the first machine, communicating each data packet through a series of processing components;
- reporting log events relating to the data packets from individual ones of the series of processing components;
- correlating the reported log events with the data packets;
- when communicating an individual data packet of the data packets between the first and second machines, associating an activity identifier with the individual data packet;
- and
- reporting the activity identifier to link reported log events of the second machine with reported log events correlated to the individual data packet in the first machine.
A method comprising;
- examining event logs from multiple machines, wherein the event logs specify events and corresponding activity identifiers;
- identifying events from the multiple machines that relate to a particular activity by referencing the activity identifiers corresponding to the events, wherein the identifying comprises locating events from the multiple machines having a common activity identifier;
- and
- producing an activity trace based at least in part on the identified events that relate to the particular activity.
Dependencies are inferred from the claim text.