Log analytics for problem diagnosis

1. An apparatus comprising:

a memory; and

at least one processor, coupled to said memory, and operative to:

identify, in a set of problem log entries from a computing system, a subset of said set of problem log entries which pertain to a failed request;

compare said subset to a reference model which defines log entries per request type under a healthy state of said computing system, to identify a portion of said subset of problem log entries which deviate from corresponding log entries in said reference model;

identify, in said portion of said subset, at least one high-value log entry; and

output said at least one high-value log entry.

2. The apparatus of claim 1 , wherein said computing system comprises a plurality of components distributed in a cloud environment.

3. The apparatus of claim 2 , wherein:

said failed request has an associated identifier;

said at least one processor is operative to identify said subset by:

identifying into a correlated set those entries of said set of problem log entries containing said associated identifier; and

adding to said correlated set additional entries of said set of problem log entries, based on a rule set, to obtain said subset.

4. The apparatus of claim 3 , wherein said at least one processor is operative to compare by aligning individual lines of said subset with individual lines of said corresponding log entries in said reference model, and, where any given line cannot be matched, inserting an opposing blank log entry.

5. The apparatus of claim 4 , wherein said at least one processor is operative to identify said at least one high-value log entry based on rareness of a corresponding log template.

6. The apparatus of claim 5 , wherein said at least one processor is further operative to build said reference model.

7. The apparatus of claim 6 , wherein said at least one processor is operative to build said reference model by:

generating said rule set based on identifier name value pairs; and

applying said rule set in a log correlation process to obtain said log entries per request type under said healthy state of said computing system.

8. The apparatus of claim 1 , wherein:

said at least one processor is operative to identify said subset by executing a log correlation module, embodied in a non-transitory computer readable medium;

said at least one processor is operative to compare said subset to said reference model by executing a log comparison module, embodied in said non-transitory computer readable medium; and

said at least one processor is operative to identify said at least one high-value log entry by executing a visualization module, embodied in said non-transitory computer readable medium.

9. A non-transitory computer readable medium comprising computer executable instructions which when executed by a computer cause the computer to perform the method of:

identifying, in a set of problem log entries from a computing system, a subset of said set of problem log entries which pertain to a failed request;

comparing said subset to a reference model which defines log entries per request type under a healthy state of said computing system, to identify a portion of said subset of problem log entries which deviate from corresponding log entries in said reference model;

identifying, in said portion of said subset, at least one high-value log entry; and

outputting said at least one high-value log entry.

10. The non-transitory computer readable medium of claim 9 , wherein, in said subset-identifying step of said method, said computing system comprises a plurality of components distributed in a cloud environment.

11. The non-transitory computer readable medium of claim 10 , wherein:

said failed request has an associated identifier;

said identifying of said subset comprises:

identifying into a correlated set those entries of said set of problem log entries containing said associated identifier; and

adding to said correlated set additional entries of said set of problem log entries, based on a rule set, to obtain said subset.

12. The non-transitory computer readable medium of claim 11 , wherein said comparing comprises aligning individual lines of said subset with individual lines of said corresponding log entries in said reference model, and, where any given line cannot be matched, inserting an opposing blank log entry.