Customized reporting and mining of event data

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 8,380,752
App. No.: 13/084,288
Granted: Feb 19, 2013
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Event data (e.g., log messages) are represented as sets of attribute/value pairs. An index maps each attribute/value pair or attribute/value tuple to a pointer that points to event data which contains the attribute/value pair or attribute/value tuple. An attribute co-occurrence map or matrix can be generated that includes attribute names that co-occur together. Queries and custom reports can be generated by projecting event data into one or more attributes or attribute/value pairs, and then determining statistics on other attributes using a combination of the inverted index, the attribute co-occurrence map or matrix, operations on sets and/or math and statistical functions.

Claims (54)

1. A method executed by a computer, comprising:

receiving a report search query from one more event data collectors;

parsing the report search query to determine a specified attribute of an event being searched;

retrieving values or statistics associated with the specified attribute;

determining a co-occurring attribute of the specified attribute;

aggregating at least one of values or statistics associated with the co-occurring attribute; and

generating a report that includes at least one of the values or statistics associated with the co-occurring attribute, wherein generating the report comprises:

projecting event data in a log file into one or more attribute/value pairs, including generating the attribute/value pairs based on a message type of the event data, the message type being determined by a signature of the event data; and

determining the statistics on the co-occurring attribute using a combination of:

an attribute co-occurrence data structure identifying a relationship between the specified attribute and the co-occurring attribute; and

an index mapping each of the one or more attribute/value pairs to an inverted reference pointer referencing an instance of the event data, the instance of event data including a raw log message corresponding to the respective attribute/value pair.

2. The method of claim 1 , wherein determining the co-occurring attribute includes searching the attribute co-occurrence data structure for the co-occurring attribute.

3. The method of claim 1 , wherein the relationship between the specified attribute and the co-occurring attribute indicates that the report search query for finding a textual message including both the specified attribute and the co-occurring attribute is allowable.

4. The method of claim 3 , wherein:

the one or more attribute/value pairs are generated from event data in a log file; and

generating the report comprises providing access to the event data in the log file using the reference pointer.

5. The method of claim 4 , wherein

the instance of the event data includes a textual message based on which each of the one or more attribute/value pairs was generated.

6. A non-transitory computer-readable storage medium storing instructions, the instructions configured to cause a computer to perform operations comprising: