Method and system for logging events of computing devices

• US 10,116,533 B1
• Filed: 02/26/2016
• Issued: 10/30/2018
• Est. Priority Date: 02/26/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Skyport Systems, Inc. (Cisco Systems, Inc.)
• Inventors: Rodgers, Robert Stephen, Giuli, Thomas John
• Primary Examiner(s): Chan, Wing F
• Assistant Examiner(s): Woo, Andrew
• Application Number:
  US15/054,749
• Time in Patent Office: 977 Days
• Field of Search: 709223, 709224
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A method for logging events of computing devices. The method includes receiving, by a management service, a log event message from a computing device. The log event message includes a log event associated fingerprint. The method further includes reconstructing, by the management service, an object corresponding to the log event associated fingerprint and reconstructing, by the management service, at least one parent object of the object corresponding to the log event associated fingerprint. The method also includes gathering, by the management service, configuration information from the object corresponding to the log event associated fingerprint, and from the at least one parent object.

Claims

1. A method for logging events of computing devices, comprising:

receiving, by a management service, a log event message from a computing device, wherein the log event message comprises a log event associated fingerprint;

reconstructing, by the management service, an object corresponding to the log event associated fingerprint;

reconstructing, by the management service, at least one parent object of the object corresponding to the log event associated fingerprint by;

obtaining, from the object corresponding to the log event associated fingerprint, a first parent fingerprint that is stored in the object corresponding to the log event associated fingerprint,

identifying a first archived fingerprint from a plurality of archived fingerprints to obtain an identified first archived fingerprint, wherein the identified first archived fingerprint is identical to the first parent fingerprint, and

identifying a first archived object that is associated with the identified first archived fingerprint, wherein the identified first archived object is a first parent object of the at least one parent object;

gathering, by the management service, configuration information from the object corresponding to the log event associated fingerprint, and from the at least one parent object;

obtaining a second parent fingerprint from the first parent object;

identifying a second archived fingerprint, identical to the second parent fingerprint obtained from the first parent object, from the plurality of archived fingerprints; and

identifying a second archived object, associated with the identified second archived fingerprint, wherein the identified second archived object is a second parent object of the at least one parent object.

2. The method of claim 1, wherein the log event message further comprises log event content.

3. The method of claim 1, wherein the log event message is generated on the computing device, and wherein the generation of the log event message on the computing device comprises:

obtaining log event content;

obtaining the log event associated fingerprint;

generating the log event message comprising the log event content and the log event associated fingerprint; and

sending the log event message to the management service.

4. The method of claim 1, wherein reconstructing the object corresponding to the log event associated fingerprint comprises:

identifying a third archived fingerprint, identical to the log event associated fingerprint, from the plurality of archived fingerprints; and

identifying a third archived object, associated with the identified third archived fingerprint, wherein the identified third archived object is the object corresponding to the log event associated fingerprint.

5. The method of claim 1, further comprising making a determination that one of the at least one parent object is a top level object, and based on the determination:

obtaining a cache list object that comprises the fingerprint of the one of the at least one parent object;

obtaining from the cache list object, at least one additional fingerprint, wherein the at least one additional fingerprint, obtained from the cache list object, is different from the fingerprint of the one of the at least one parent object, and different from the log event associated fingerprint; and

obtaining for the at least one additional fingerprint, obtained from the cache list object, at least one corresponding additional object.

6. A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to:

receive a log event message from a computing device, wherein the log event message comprises a log event associated fingerprint;

reconstruct an object corresponding to the log event associated fingerprint;

reconstruct at least one parent object of the object corresponding to the log event associated fingerprint by;

obtaining, from the object corresponding to the log event associated fingerprint, a first parent fingerprint that is stored in the object corresponding to the log event associated fingerprint,

identifying a first archived fingerprint from a plurality of archived fingerprints to obtain an identified first archived fingerprint, wherein the identified first archived fingerprint is identical to the first parent fingerprint, and

identifying a first archived object that is associated with the identified first archived fingerprint, wherein the identified first archived object is a first parent object of the at least one parent object;

gather configuration information from the object corresponding to the log event associated fingerprint, and from the at least one parent object;

obtain a parent fingerprint from the first parent object;

identify a second archived fingerprint, identical to the parent fingerprint obtained from the first parent object, from the plurality of archived fingerprints; and

identify a second archived object, associated with the identified archived fingerprint, wherein the identified second archived object is a second parent object of the at least one parent object.

7. The non-transitory computer readable medium of claim 6, wherein the log event message further comprises log event content.

8. The non-transitory computer readable medium of claim 6, wherein the log event message is generated on the computing device, and wherein the computer readable code for generating the log event message on the computing device comprises instructions which when executed by the computer processor enable the computer processor to:

obtain log event content;

obtain the log event associated fingerprint;

generate the log event message comprising the log event content and the log event associated fingerprint; and

send the log event message to a management service.

9. The non-transitory computer readable medium of claim 6, wherein the computer readable code for reconstructing the object corresponding to the log event associated fingerprint comprises instructions which when executed by the computer processor enable the computer processor to:

identify a third archived fingerprint, identical to the log event associated fingerprint, from the plurality of archived fingerprints; and

identify a third archived object, associated with the identified third archived fingerprint, wherein the identified the archived object is the object corresponding to the log event associated fingerprint.

10. The non-transitory computer readable medium of claim 6, wherein the computer readable program code, when executed by the computer processor, further enables the computer processor to make a determination that one of the at least one parent object is a top level object, and based on the determination:

obtain a cache list object that comprises the fingerprint of the one of the at least one parent object;

obtain from the cache list object, at least one additional fingerprint, wherein the at least one additional fingerprint, obtained from the cache list object, is different from the fingerprint of the one of the at least one parent object, and different from the log event associated fingerprint; and

obtain for the at least one additional fingerprint, obtained from the cache list object, at least one corresponding additional object.

11. A computing device, comprising:

a server comprising a processor and a non-transitory computer readable medium comprising computer readable program code implementing a management service, which when executed by the processor enables the server to;

receive, by the management service, a log event message from a second computing device, wherein the log event message comprises a log event associated fingerprint;

reconstruct, by the management service, an object corresponding to the log event associated fingerprint;

reconstruct, by the management service, at least one parent object of the object corresponding to the log event associated fingerprint by;

obtaining, from the object corresponding to the log event associated fingerprint, a first parent fingerprint that is stored in the object corresponding to the log event associated fingerprint,

identifying a first archived fingerprint from a plurality of archived fingerprints to obtain an identified first archived fingerprint, wherein the identified first archived fingerprint is identical to the first parent fingerprint, and

identifying a first archived object that is associated with the identified first archived fingerprint, wherein the identified first archived object is a first parent object of the at least one parent object;

gather, by the management service, configuration information from the object corresponding to the log event associated fingerprint, and from the at least one parent object,

obtain a parent fingerprint from the first parent object,

identify a second archived fingerprint, identical to the parent fingerprint obtained from the first parent object, from a plurality of archived fingerprints, and

identify a second archived object, associated with the identified archived fingerprint, wherein the identified second archived object is a second parent object of the at least one parent object.

12. The computing device of claim 11, wherein the log event message is generated on the second computing device, and wherein the generation of the log event message on the second computing device comprises:

obtaining log event content;

obtaining the log event associated fingerprint;

generating the log event message comprising the log event content and the log event associated fingerprint; and

sending the log event message to the management service.

13. The computing device of claim 11, wherein the computer readable program code for reconstructing the object corresponding to the log event associated fingerprint comprises instructions which when executed by the processor enable the processor to:

identify a third archived fingerprint, identical to the log event associated fingerprint, from the plurality of archived fingerprints; and

identify a third archived object, associated with the identified third archived fingerprint, wherein the identified third archived object is the object corresponding to the log event associated fingerprint.

14. The computing device of claim 11, further comprising computer readable program code, which when executed by the processor enables the processor to make a determination that one of the at least one parent object is a top level object, and based on the determination:

obtain a cache list object that comprises the fingerprint of the one of the at least one parent object;

obtain from the cache list object, at least one additional fingerprint, wherein the at least one additional fingerprint, obtained from the cache list object, is different from the fingerprint of the one of the at least one parent object, and different from the log event associated fingerprint; and

obtain for the at least one additional fingerprint, obtained from the cache list object, at least one corresponding additional object.