Method and system for detecting system outages using application event logs
Methods, systems, apparatus, and non-transitory computer readable media are described for detecting system outages using application event logs. Various aspects may include obtaining several prior application event logs where the status of the system is known at the time the application event logs were recorded. Additionally, various aspects may include determining characteristics of prior application event logs which were recorded during a system outage, and/or determining characteristics of prior application event logs which were recorded while the system was available. When current application event logs are obtained where the status of the system is unknown at the time the current application event logs are recorded, various aspects include comparing the current application event logs to the prior application event logs to determine that a system outage has occurred based upon the comparison.
1. A computer-implemented method for detecting system outages using application event logs, the method executed by one or more processors programmed to perform the method, the method comprising:
comparing, by the one or more processors, one or more characteristics of a plurality of application event logs to one or more characteristics of a prior application event log which corresponds to a prior system outage; and
determining, by the one or more processors, that a system outage has occurred based upon the comparison to decrease downtime in a computing system.
2. The computer-implemented method of claim 1 , wherein each of the prior application event logs includes an indication of a time in which the prior application event log is generated, and further comprising:
grouping, by the one or more processors, each of the prior application event logs into one of a plurality of time intervals based upon the time in which the prior application event log is generated, and
for each time interval, determining, by the one or more processors, whether the time interval corresponds to a system outage.
3. The computer-implemented method of claim 1 , wherein each of the application event logs includes at least one of: a warning message, an informational message, or an error message.
4. The computer-implemented method of claim 1 , wherein determining that a system outage has occurred comprises determining, by the one or more processors, a likelihood that the system outage has occurred based upon the comparison using one or more machine learning techniques.
5. The computer-implemented method of claim 4 , wherein the one or more machine learning techniques include at least one of: naïve Bayes classifiers, logistic regression, random decision forests, or boosting.
6. The computer-implemented method of claim 1 , further comprising causing, by the one or more processors, an indication that the system outage has occurred to be displayed on a user interface of a computing device.
7. The computer-implemented method of claim 1 , wherein the one or more characteristics corresponds to a frequency in which a word occurs in the plurality of application logs.
8. The computer-implemented method of claim 7 , wherein the one or more first characteristics corresponds to a frequency in which the word occurs in the prior application event log; and
wherein comparing one or more characteristics of a plurality of application event logs to one or more characteristics of a prior application event log includes comparing the frequency in which the word occurs in the plurality of application event logs to the frequency in which the word occurs in the prior application event log.
9. The computer-implemented method of claim 1 , wherein the application event logs are raw application events logs in a first data format and further comprising:
for each of the application event logs, transforming the raw application event log into a second data format including at least some information from the raw application event log.
10. The computer-implemented method of claim 9 , wherein the second data format includes an indication of whether the raw application event log corresponds to the system outage.
11. A system for detecting system outages using application event logs, the system comprising:
one or more processors; and
a non-transitory computer-readable memory coupled to the one or more processors and storing thereon instructions that, when executed by the one or more processors, cause the system to:
compare one or more characteristics of a plurality of application event logs to at one or more characteristics of a prior application event log which corresponds to a prior system outage, and
determine a likelihood that a system outage has occurred based upon the comparison to decrease downtime in a computing system.
12. The system of claim 11 , wherein each of the prior application event logs includes an indication of a time in which the prior application event log is generated, and the instructions further cause the system to:
group each of the prior application event logs into one of a plurality of time intervals based upon the time in which the prior application event log is generated, and
for each time interval, determine whether the time interval corresponds to a system outage.
13. The system of claim 11 , wherein each of the application event logs includes at least one of: a warning message, an informational message, or an error message.
14. The system of claim 11 , wherein to determine that a system outage has occurred, the instructions cause the system to determine a likelihood that the system outage has occurred based upon the comparison using one or more machine learning techniques.
15. The system of claim 14 , wherein the one or more machine learning techniques include at least one of: naïve Bayes classifiers, logistic regression, random decision forests, or boosting.
16. The system of claim 11 , further comprising a user interface, and wherein the instructions further cause the system to: cause an indication that the system outage has occurred to be displayed on the user interface.
17. The system of claim 11 , wherein the one or more characteristics corresponds to a frequency in which a word occurs in the plurality of application logs.
18. The system of claim 17 , wherein the one or more characteristics corresponds to a frequency in which the word occurs in the prior application event log; and
wherein to compare one or more characteristics of a plurality of application event logs to one or more characteristics of a prior application event log, the instructions cause the system to compare the frequency in which the word occurs in the plurality of application event logs to the frequency in which the word occurs in the prior application event log.
19. The system of claim 11 , wherein the event logs are raw application events logs in a first data format and further comprising:
for each of the application event logs, transforming the raw application event log into a second data format including at least some information from the raw application event log.
20. The system of claim 19 , wherein the second data format includes an indication of whether the raw application event log corresponds to the system outage.