LOG ENTRY ANALYSIS IN MANAGED ENDPOINTS
A method may include monitoring a log file at an endpoint of a managed network, and an error log entry that indicates a technical error experienced at the endpoint may be identified. The method may include ignoring the log entries that are generated during a first time period following identification of the error log entry. A first set of log entries may be collected during a first time interval beginning at the end of the first time period and going back a second time period. A second set of log entries may be collected during a second time interval beginning at the end of the first time period and moving forward for a third time period. The first and second sets of log entries may be aggregated, and a mitigation action determined based on analysis of the aggregated log entries may be implemented as a solution to the technical error.
1 . A method, comprising:
monitoring a log file at an endpoint of a managed network, the log file including one or more log entries generated by the endpoint;
while monitoring the log file, identifying an error log entry that indicates a technical error is experienced at the endpoint;
ignoring the log entries that are generated during a first time period following identification of the error log entry, wherein the first time period is configured to reduce a duplicate error log associated with the technical error;
after the first time period:
collecting a first plurality of log entries during a first time interval from the endpoint, the first time interval beginning at the end of the first time period and going back a second time period; and
collecting a second plurality of log entries during a second time interval from the endpoint, the second time interval beginning at the end of the first time period and moving forward for a third time period;
aggregating the first and the second pluralities of log entries;
receiving a mitigation action from an administrative device, the mitigation action being based on an analysis of the aggregated log entries and determination of a solution to the technical error; and
implementing the mitigation action to implement the solution at the endpoint.
2 . The method of claim 1 , further comprising receiving a log monitor command configured to initiate the monitoring of the log file at the endpoint.
3 . The method of claim 2 , wherein the log monitor command is received from the administrative device in response to an error report that indicates an occurrence of the technical error at the endpoint.
4 . The method of claim 1 , wherein:
the second time period is substantially similar to the third time period; and
the first time period is shorter than the second time period.
5 . The method of claim 4 , wherein:
the second time period is about five minutes; and
the first time period is about ten seconds.
6 . The method of claim 1 , wherein the first time period, the second time period, and the third time period are set according to a characteristic of the endpoint.
7 . The method of claim 1 , further comprising communicating the aggregated log entries to a particular storage location at an administrative device.
8 . One or more non-transitory computer-readable storage media configured to store instructions that, in response to being executed, cause a system to perform operations, the operations comprising:
monitoring a log file at an endpoint of a managed network, the log file including one or more log entries generated by the endpoint;
while monitoring the log file, identifying an error log entry that indicates a technical error is experienced at the endpoint;
ignoring the log entries that are generated during a first time period following identification of the error log entry, wherein the first time period is configured to reduce a duplicate error log associated with the technical error;
after the first time period:
collecting a first plurality of log entries during a first time interval from the endpoint, the first time interval beginning at the end of the first time period and going back a second time period; and
collecting a second plurality of log entries during a second time interval from the endpoint, the second time interval beginning at the end of the first time period and moving forward for a third time period;
aggregating the first and the second pluralities of log entries;
receiving a mitigation action from an administrative device, the mitigation action being based on an analysis of the aggregated log entries and determination of a solution to the technical error; and
implementing the mitigation action to implement the solution at the endpoint.
9 . The one or more non-transitory computer-readable storage media of claim 8 , further comprising receiving a log monitor command configured to initiate the monitoring of the log file at the endpoint.
10 . The one or more non-transitory computer-readable storage media of claim 9 , wherein the log monitor command is received from the administrative device in response to an error report that indicates an occurrence of the technical error at the endpoint.
11 . The one or more non-transitory computer-readable storage media of claim 8 , wherein:
the second time period is substantially similar to the third time period; and
the first time period is shorter than the second time period.
12 . The one or more non-transitory computer-readable storage media of claim 11 , wherein:
the second time period is about five minutes; and
the first time period is about ten seconds.
13 . The one or more non-transitory computer-readable storage media of claim 8 , wherein the first time period, the second time period, and the third time period are set according to a characteristic of the endpoint.
14 . The one or more non-transitory computer-readable storage media of claim 8 , further comprising communicating the aggregated log entries to a particular storage location at an administrative device.
15 . A system comprising:
one or more processors; and
one or more non-transitory computer-readable storage media configured to store instructions that, in response to being executed, cause the system to perform operations, the operations comprising:
monitoring a log file at an endpoint of a managed network, the log file including one or more log entries generated by the endpoint;
while monitoring the log file, identifying an error log entry that indicates a technical error is experienced at the endpoint;
ignoring the log entries that are generated during a first time period following identification of the error log entry, wherein the first time period is configured to reduce a duplicate error log associated with the technical error;
after the first time period:
collecting a first plurality of log entries during a first time interval from the endpoint, the first time interval beginning at the end of the first time period and going back a second time period; and
collecting a second plurality of log entries during a second time interval from the endpoint, the second time interval beginning at the end of the first time period and moving forward for a third time period;
aggregating the first and the second pluralities of log entries;
receiving a mitigation action from an administrative device, the mitigation action being based on an analysis of the aggregated log entries and determination of a solution to the technical error; and
implementing the mitigation action to implement the solution at the endpoint.
16 . The system of claim 15 , further comprising receiving a log monitor command configured to initiate the monitoring of the log file at the endpoint.
17 . The system of claim 16 , wherein the log monitor command is received from the administrative device in response to an error report that indicates an occurrence of the technical error at the endpoint.
18 . The system of claim 15 , wherein:
the second time period is substantially similar to the third time period; and
the first time period is shorter than the second time period.
19 . The system of claim 15 , wherein:
the second time period is about five minutes; and
the first time period is about ten seconds.
20 . The system of claim 15 , wherein the first time period, the second time period, and the third time period are set according to a characteristic of the endpoint.