Systems and methods for event log compensation
View Patent ↗Various of the disclosed embodiments provide systems and methods to compensate for certain event log errors. For example, when a system fails to record the occurrence of several events (a file closing, a file modification, a network socket opening, etc.) the disclosed embodiments may identify the discrepancy and provide a synthesized event sequence suitable to fulfill the purposes of the event log. In this manner, for example, a client may still be accurately billed for their use of a licensed software or system, even if their usage was punctuated with occasional failures to record their activity.
1. A computer-implemented method for analyzing an event long, comprising:
retrieving a first event from the event log;
determining that the first event matches a portion of a first grammar rule;
generating a parse tree associated with the first grammar rule;
retrieving a second event from the event log;
determining that the second event matches a portion of the parse tree; and
determining that at least one intervening event occurs in the parse tree between the first event and the second event; and
generating a synthesized event and inserting the synthesized event into the event log, the synthesized event associated with a time between a time associated with the first event and a time associated with the second event.
2. The computer-implemented method of claim 1 , wherein determining that the first event matches a portion of a first grammar rule comprises:
iteratively searching through each of the remaining events in the event log to generate a plurality of parse tree instances having temporary synthesized events, for each iteration:
creating temporary synthesized events for the next expected event in each of the parse tree instances;
creating temporary parse tree instance for all grammars; and
synthesize the first event of each parse tree instance;
determining that a match for the first event exists among the plurality of parse tree instances having temporary synthesized events, the match corresponding to the first grammar rule.
3. The computer-implemented method of claim 1 , wherein the first grammar rule is one of a plurality of grammar rules, the plurality of grammar rules comprising the same set or a superset of all possible user event patterns occurring in the event log.
4. The computer-implemented method of claim 1 , the method further comprising:
determining that the first event matches a portion of a second grammar rule; and
applying an external rule to determine that the first grammar rule shall be applied.
5. The computer-implemented method of claim 4 , wherein the external rule considers a pattern of events in the event log prior to the first event.
6. The computer-implemented method of claim 1 , wherein the event log is an atomized event log.
7. A non-transitory computer-readable medium comprising instructions configured to cause a computer system to perform a method comprising the steps:
retrieving a first event from an event log;
determining that the first event matches a portion of a first grammar rule;
generating a parse tree associated with the first grammar rule;
retrieving a second event from the event log;
determining that the second event matches a portion of the parse tree; and
determining that at least one intervening event occurs in the parse tree between the first event and the second event; and
generating synthesized event and inserting the synthesized event in the event log, the synthesized event associated with a time between a time associated with the first event and a time associated with the second event.
8. The non-transitory computer-readable medium of claim 7 , wherein determining that the first event matches a portion of a first grammar rule comprises:
iteratively searching through each of the remaining events in the event log to generate a plurality of parse tree instances having temporary synthesized events, for each iteration:
creating temporary synthesized events for the next expected event in each of the parse tree instances;
creating temporary parse tree instance for all grammars; and
synthesize the first event of each parse tree instance;
determining that a match for the first event exists among the plurality of parse tree instances having temporary synthesized events, the match corresponding to the first grammar rule.
9. The non-transitory computer-readable medium of claim 7 , wherein the first grammar rule is one of a plurality of grammar rules, the plurality of grammar rules comprising the same set or a superset of all possible user event patterns occurring in the event log.
10. The non-transitory computer-readable medium of claim 7 , the method further comprising:
determining that the first event matches a portion of a second grammar rule; and
applying an external rule to determine that the first grammar rule shall be applied.
11. The non-transitory computer-readable medium of claim 10 , wherein the external rule considers a pattern of events in the event log prior to the first event.
12. The non-transitory computer-readable medium of claim 7 , wherein the event log is an atomized event log.
13. A computer system comprising:
at least one processor;
at least one memory comprising instructions configured to cause the at least one processor to cause the computer system to perform a method comprising the steps:
retrieving a first event from an event log;
determining that the first event matches a portion of a first grammar rule;
generating a parse tree associated with the first grammar rule;
retrieving a second event from the event log;
determining that the second event matches a portion of the parse tree; and
determining that at least one intervening event occurs in the parse tree between the first event and the second event; and
generating synthesized event and inserting the synthesized event in the event log, the synthesized event associated with a time between a time associated with the first event and a time associated with the second event.
14. The computer system of claim 13 , wherein determining that the first event matches a portion of a first grammar rule comprises:
iteratively searching through each of the remaining events in the event log to generate a plurality of parse tree instances having temporary synthesized events, for each iteration:
creating temporary synthesized events for the next expected event in each of the parse tree instances;
creating temporary parse tree instance for all grammars; and
synthesize the first event of each parse tree instance;
determining that a match for the first event exists among the plurality of parse tree instances having temporary synthesized events, the match corresponding to the first grammar rule.
15. The computer system of claim 13 , wherein the first grammar rule is one of a plurality of grammar rules, the plurality of grammar rules comprising the same set or a superset of all possible user event patterns occurring in the event log.
16. The computer system of claim 13 , the method further comprising:
determining that the first event matches a portion of a second grammar rule; and
applying an external rule to determine that the first grammar rule shall be applied.
17. The computer system of claim 16 , wherein the external rule considers a pattern of events in the event log prior to the first event.
18. The computer system of claim 13 , wherein the event log is an atomized event log.