Granted Patent B2

US 7,778,979 · App. 10/507,907 · Granted Aug 17, 2010

Assignee: Nokia Siemens Networks Oy

Abstract

Claims (61)

1. A method, comprising:

finding, by a processor, redundant frequent patterns having a value or a record combination that is a subset of a value or record combination of a larger one of a plurality of detected frequent patterns in log record information;

removing, by the processor, said redundant frequent patterns having the value or the record combination that is the subset of the value or the record combination of said larger one of said detected frequent patterns from the found redundant frequent patterns while maintaining said larger one of said detected frequent patterns; and

compressing said log record information after removing said redundant frequent patterns having the value or the record combination that is the subset of the value or the record combination of said larger one of said detected frequent patterns using the remaining found redundant frequent patterns.

2. The method according to claim 1 , wherein said frequent patterns correspond to one or more of frequently occurring values and frequently occurring records of said log record information.

3. The method according to claim 2 , wherein said values comprise constant field, set or sequence values of a set of said log record information.

4. The method according to claim 2 , wherein said records comprise frequent line sequences of said log record information.

5. The method according to claim 1 , wherein said detecting comprises counting occurrences of patterns, and comparing the counting result with a predetermined threshold.

6. The method according to claim 1 , wherein said removing of redundant frequent patterns comprises creating a condensed representation of said log record information.

7. The method according to claim 6 , wherein said creating comprises:

ordering said detected frequent patterns into a linear order, wherein a superset precedes its subsets until no more detected frequent patterns are left; and

removing all frequent patterns that are subsets of the first pattern and that occur in said log record information when said first pattern occurs.

8. The method according to claim 7 , wherein said removing of all frequent patterns comprises decreasing support information allocated to a subset of said first pattern when said subset also occurs in said log record information when said first pattern does not occur by support information allocated to said first pattern, and by removing said subset when the support information becomes zero.

9. The method according to claim 6 , further comprising:

creating adequate information of said log record information by removing or marking lines or line combinations that support said detected frequent patterns, and by adding said condensed representation.

10. The method according to claim 6 , further comprising:

creating an adequate information log by linking said detected and compressed frequent patterns to said log record information.

11. The method according to claim 6 , further comprising:

creating adequate information by constructing an inclusion hierarchy of said detected and compressed frequent patterns, and by ordering said detected and compressed frequent patterns using an estimation function.

12. The method according to claim 6 , further comprising:

creating adequate information by extracting association or episode rules and linking an inclusion hierarchy of said detected and compressed frequent patterns to said extracted rules.

13. The method according to claim 1 , further comprising:

restricting said detection by setting constraints on predetermined field or field combinations of said log record information.

14. The method according to claim 1 , wherein said removing of redundant frequent patterns comprises creating a condensed directory structure to separate and code said log record information in order to be stored in a log file.

15. The method according to claim 14 , further comprising:

applying a query, first to said detected and compressed frequent patterns, and then to unmatched portions of said log file.

16. The method according to claim 15 , further comprising:

returning all lines of a pattern when said pattern matches with said query.

17. The method according to claim 14 , further comprising:

grouping reduced lines of said log file by said detected and said compressed frequent patterns.

18. The method according to claim 14 , further comprising:

adding a pattern identification to lines of said log file, from which fields already included in said detected and said compressed frequent patterns have been removed.

19. The method according to claim 14 , further comprising:

attaching a regular expression or a query to each of said detected and said compressed frequent patterns, wherein said regular expression matches only to the lines of said log file where the values included in the corresponding pattern are present.

20. The method according to claim 19 , wherein said removing of redundant frequent patterns comprises:

reading a file header of said log file;

removing constant values from each line of said log file;

when said regular expression of a detected and compressed frequent pattern matches to a line, removing all values included in said pattern from said line and adding said line to a list of lines matched by said pattern; and

adding remaining lines of said log file to a list of unmatched lines.

21. The method according to claim 19 , further comprising:

appending said lists of matched lines and unmatched lines to individual printouts of the lines.

22. The method according to claim 14 , further comprising:

adding markup language tags to said log file.

23. The method according to claim 1 , further comprising:

providing said log record information to a monitoring system.

24. An apparatus, comprising:

a processor configured to

find redundant frequent patterns having a value or a record combination that is a subset of a value or a record combination of a larger one of a plurality of detected frequent patterns in log record information;

remove the redundant frequent patterns having the value or the record combination that is the subset of the value or the record combination of said larger one of said detected frequent patterns from the found redundant frequent patterns while maintaining said larger one of said detected frequent patterns; and

compress said log record information after removing said redundant frequent patterns having the value or the record combination that is the subset of the value or the record combination of said larger one of said detected frequent patterns using the remaining found redundant frequent patterns.

25. The apparatus according to claim 24 , wherein said processor is configured to create a condensed representation of said log record information.

26. The apparatus according to claim 24 , wherein said processor is configured to create a condensed directory structure to separate and code said log record information in order to be stored in a log file.

27. The apparatus according to claim 24 , wherein said processor is configured to provide said log record information to a monitoring system.

28. A computer program embodied on a computer readable storage medium, the computer program configured to control a processor to perform a process, the process comprising:

finding redundant frequent patterns having a value or a record combination that is a subset of a value or record combination of a larger one of a plurality of detected frequent patterns in log record information;

removing the redundant frequent patterns having the value or the record combination that is the subset of the value or the record combination of said larger one of said detected frequent patterns from the found redundant frequents patterns while maintaining said lager one of said detected frequent patterns; and

compressing said log record information after removing said redundant frequent patterns having the value or the record combination that is the subset of the value or the record combination of said larger one of said detected frequent patterns using the remaining found redundant frequent patterns.

29. An apparatus, comprising:

finding means for finding redundant frequent patterns having a value or a record combination that is a subset of a value or record combination of a larger one of a plurality of detected frequent patterns in log record information;

removing means for removing the redundant frequent patterns having the value or the record combination that is the subset of the value or the record combination of said larger one of said detected frequent patterns from the found redundant frequent patterns while maintaining said larger one of said detected frequent patterns; and

compressing means for compressing said log record information after removing said redundant frequent patterns having the value or the record combination that is the subset of the value or the record combination of said larger one of said detected frequent patterns using the remaining found redundant frequent patterns.

Assignments (10)

Continuity (1)