Two stage log normalization

A computer program product for two stage log normalization, the computer program product comprising:

• one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
• program instructions to retrieve a message format and a plurality of parameters from one or more log files;
• program instructions to determine a classification for one or more first sequence files, wherein the one or more first sequence files includes the message format from the one or more log files;
• program instructions to determine a classification of error for the one or more first sequence files;
• program instructions to determine whether there is a high confidence in the classification of error for the one or more first sequence files;
• and
• responsive to a determination that there is not a high confidence in the classification of error for the one or more first sequence files, program instructions to determine whether there is an improvement in confidence in the classification of error from one or more second sequence files, wherein the one or more second sequence files includes the message format and the plurality of parameters from the one or more log files,
• wherein determining whether there is an improvement in confidence in the classification of error from the one or more second sequence files includes:
• creating the one or more second sequence files, wherein creating includes retrieving a corresponding unique parameter identifier (ID) for each of the one or more log files and sequencing a corresponding unique message ID for each of the one or more log files with the respective unique parameter ID;
• re-classifying the one or more second sequence files, wherein re-classifying includes determining a classification of error for the one or more second sequence files;
• and determining a level of similarity between the classification of error for the one or more second sequence files and a plurality of existing trained data.

A computer system for two stage log normalization, the computer system comprising:

• one or more computer processors;
• one or more computer readable storage media;
• program instructions stored on at least one of the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
• program instructions to retrieve a message format and a plurality of parameters from one or more log files;
• program instructions to determine a classification for one or more first sequence files, wherein the one or more first sequence files includes the message format from the one or more log files;
• program instructions to determine a classification of error for the one or more first sequence files;
• program instructions to determine whether there is a high confidence in the classification of error for the one or more first sequence files;
• and
• responsive to a determination that there is not a high confidence in the classification of error for the one or more first sequence files, program instructions to determine whether there is an improvement in confidence in the classification of error from one or more second sequence files, wherein the one or more second sequence files includes the message format and the plurality of parameters from the one or more log files,
• wherein determining whether there is an improvement in confidence in the classification of error from the one or more second sequence files includes:
• creating the one or more second sequence files, wherein creating includes retrieving a corresponding unique parameter identifier (ID) for each of the one or more log files and sequencing a corresponding unique message ID for each of the one or more log files with the respective unique parameter ID;
• re-classifying the one or more second sequence files, wherein re-classifying includes determining a classification of error for the one or more second sequence files;
• and determining a level of similarity between the classification of error for the one or more second sequence files and a plurality of existing trained data.