Automated log entry identification and alert management
Disclosed herein are methods, systems, and processes for automated log entry identification and alert management. A log statement that includes a log format string and is part of program code associated with a computer program is accessed at a log management server. The execution of the log statement generates a log string that is associated with a trigger pattern of an alert configuration. A fixed part of the log format string that remains unchanged during execution of the log statement when the program code associated with the computer program is executed is extracted and a template is generated for the log statement to track changes to the fixed part of the log format string that causes a mismatch between the trigger pattern of the alert configuration and the log string. The template is then stored. A modification to the fixed part of the log format string is tracked using the template and the trigger pattern of the alert configuration that corresponds to the log string is updated based on the modification.
1. A computer-implemented method of detecting an anomaly in a fixed part of a log statement, comprising:
accessing a template, wherein
the template classifies a log entry respect to the log statement;
tracking one or more matches between the log entry and the log statement even if the log statement has not received a new match in a predetermined span of time;
determining that the new match of the log entry and the log statement represents an error message that should not have generated the log entry;
designating the log entry as anomalous; and
transmitting an alert that the log entry is anomalous.
2. The computer-implemented method of claim 1 , further comprising:
configuring the alert without defining a trigger pattern of an alert configuration based on the fixed part of the log statement.
3. The computer-implemented method of claim 2 , wherein
the log statement is part of program code associated with a computer program,
execution of the log statement generates the log entry, and
the log entry is associated with the trigger pattern of the alert configuration.
4. The computer-implemented method of claim 3 , further comprising:
extracting the fixed part of the log statement, wherein
the fixed part remains unchanged during execution of the log statement.
5. The computer-implemented method of claim 4 , further comprising:
generating the template for the log statement to track modifications to the fixed part that causes a mismatch between the trigger pattern of the alert configuration and the log entry.
6. A non-transitory computer readable storage medium comprising program instructions executable to:
access a template, wherein
the template classifies a log entry respect to a log statement;
track one or more matches between the log entry and the log statement even if the log statement has not received a new match in a predetermined span of time;
determine that the new match of the log entry and the log statement represents an error message that should not have generated the log entry;
designate the log entry as anomalous; and
transmit an alert that the log entry is anomalous.
7. The non-transitory computer readable medium of claim 6 , further comprising: configuring the alert without defining a trigger pattern of an alert configuration based on the fixed part of the log statement.
8. The non-transitory computer readable storage medium of claim 7 , wherein
the log statement is part of program code associated with a computer program,
execution of the log statement generates the log entry, and
the log entry is associated with the trigger pattern of the alert configuration.
9. The non-transitory computer readable storage medium of claim 8 , further comprising:
extracting the fixed part of the log statement, wherein
the fixed part remains unchanged during execution of the log statement; and
generating the template for the log statement to track modifications to the fixed part that causes a mismatch between the trigger pattern of the alert configuration and the log entry.
10. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
extract a fixed part of a log statement, wherein
the log statement is part of program code associated with a computer program,
the execution of the log statement generates a log entry,
the log entry is associated with a trigger pattern of an alert configuration, and
the fixed part remains unchanged during execution of the log statement;
generate a template for the log statement, wherein
the template tracks one or more modifications to the fixed part, and
the one or more modifications that cause a mismatch between the trigger pattern of the alert configuration and the log entry;
access the template, wherein
the template classifies the log entry respect to the log statement;
identify, based on the classification of the log entry, a match between the log entry and the log statement, if the log statement has not received a the match in a predetermined amount of time;
determine that the match between the log entry and the log statement should not have generated the log entry;
designate the log entry as anomalous; and
transmit an alert that the log entry is anomalous, wherein
the alert is configured without defining the trigger pattern of the alert configuration based on the fixed part of the log statement.