Methods and systems to identify and respond to low-priority event messages

• US 10,212,023 B2
• Filed: 10/05/2016
• Issued: 02/19/2019
• Est. Priority Date: 10/05/2016
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Brown, Darren
• Primary Examiner(s): Nguyen, Quang N
• Application Number:
  US15/286,337
• Publication Number:
  US 20180097687A1
• Time in Patent Office: 867 Days
• Field of Search: 709203, 709206, 709217, 709219, 709223, 709224, 709226, 709228, 709230, 709232, 709240, 707740, 707809, 719318, 719328, 726 13, 340540
• CPC Class Codes: H04L 41/0609 based on severity or priority
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

Methods and systems to identify and respond to low-priority event messages are described. Methods identify types of event messages recorded in event-log files as low-priority event messages. Methods enable an information technology (“IT”) administrator, or other user, to determine which low-priority event messages may be deleted, how the low-priority event messages may be sampled for storage, or how long the low-priority event messages may be stored in a data-storage device.

Claims

1. A method to identify and respond to low-priority event messages, the method comprising:

identifying each event message of an event-log file as belonging to an event type;

identifying certain event types as low-priority event types;

deleting the event messages of each low-priority event type in accordance with a storage requirement assigned to each low-priority event type;

identifying candidate low-priority event types of the event types that have not been previously identified as low-priority event types;

displaying storage space of the event messages of each low-priority event type occupy in one or more data-storage devices; and

displaying options for changing how each of the low-priority event type is stored in the one or more data-storage devices.

2. The method of claim 1, wherein identifying certain event types as low-priority event types comprises:

for each event type,

counting event messages of the event type over a time period to obtain a count of event messages of the event type;

counting user interactions with event messages of the event type over the time period to determine a number user interactions for the event type; and

identifying the event type as a low-priority event type and corresponding event messages as low priority when the count of event messages is less than or equal to a count threshold and the number of user interactions is greater than or equal to a number of interactions threshold.

3. The method of claim 1, wherein identifying certain event types as low-priority event types comprises identifying an event type as a low-priority event type and corresponding event messages as low priority, when a user identifies the event type as low priority.

4. The method of claim 1, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

identifying event messages of the low-priority event type for deletion, when the low-priority event type is selected for deletion; and

deleting the event message of the low-priority event type selected for deletion.

5. The method of claim 1, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

receiving a percentage of event messages to store in an event-log file;

for each event message,

generating a random number between zero and one;

storing the event message in an event-log file when the random number is less the percentage multiplied by one hundred; and

deleting the event message when the random number is greater than the percentage multiplied by one hundred.

6. The method of claim 1, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

receiving a retention time for storing the event message in an event-log file;

for each event message, deleting the event message form the event-log file when the difference between a current time stamp and a time stamp of the event message is greater than the retention time.

7. The method of claim 1, wherein identifying the candidate low-priority event types of the event types comprises:

calculating an amount of storage occupied by event messages of an event type;

determining total storage for an event-log file that stores event messages of the event type;

calculating storage of the event-log file without the event type as a different between the total storage of the event-log file and the amount of storage occupied by the event message;

displaying the event type as the candidate low-priority event type, the amount of storage occupied by event messages of the event type, the total storage for the event-log file that stores event messages of the event type, storage of the event-log file without the event type; and

changing status of the event type to a low-priority event type when a user selects an option to change the status of the event type.

9. The system of claim 1, wherein identifying certain event types as low-priority event types comprises:

for each event type,

counting event messages of the event type over a time period to obtain a count of event messages of the event type;

counting user interactions with event messages of the event type over the time period to determine a number user interactions for the event type; and

identifying the event type as a low-priority event type and corresponding event messages as low priority when the count of event messages is less than or equal to a count threshold and the number of user interactions is greater than or equal to a number of interactions threshold.

10. The system of claim 1, wherein identifying certain event types as low-priority event types comprises identifying an event type as a low-priority event type and corresponding event messages as low priority, when a user identifies the event type as low priority.

11. The system of claim 1, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

identifying event messages of the low-priority event type for deletion, when the low-priority event type is selected for deletion; and

deleting the event message of the low-priority event type selected for deletion.

12. The system of claim 1, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

receiving a percentage of event messages to store in an event-log file;

for each event message,

generating a random number between zero and one;

storing the event message in an event-log file when the random number is less the percentage multiplied by one hundred; and

deleting the event message when the random number is greater than the percentage multiplied by one hundred.

13. The system of claim 1, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

receiving a retention time for storing the event message in an event-log file;

for each event message, deleting the event message form the event-log file when the difference between a current time stamp and a time stamp of the event message is greater than the retention time.

14. The system of claim 1, wherein identifying the candidate low-priority event types of the event types comprises:

calculating an amount of storage occupied by event messages of an event type;

determining total storage for an event-log file that stores event messages of the event type;

calculating storage of the event-log file without the event type as a different between the total storage of the event-log file and the amount of storage occupied by the event message;

displaying the event type as the candidate low-priority event type, the amount of storage occupied by event messages of the event type, the total storage for the event-log file that stores event messages of the event type, storage of the event-log file without the event type; and

changing status of the event type to a low-priority event type when a user selects an option to change the status of the event type.

8. A system to identify and respond to low-priority event messages, the system comprising:

one or more processors;

one or more data-storage devices; and

machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors controls the system to carry out identifying each event message of an event-log file as belonging to an event type;

identifying certain event types as low-priority event types;

deleting the event messages of each low-priority event type in accordance with a storage requirement assigned to each low-priority event type;

identifying candidate low-priority event types of the event types that have not been previously identified as low-priority event types;

displaying storage space of the event messages of each low-priority event type occupy in one or more data-storage devices; and

displaying options for changing how each of the low-priority event type is stored in the one or more data-storage devices.

15. A non-transitory computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system to perform the operations of

identifying each event message of an event-log file as belonging to an event type;

identifying certain event types as low-priority event types;

deleting the event messages of each low-priority event type in accordance with a storage requirement assigned to each low-priority event type;

identifying candidate low-priority event types of the event types that have not been previously identified as low-priority event types;

displaying storage space of the event messages of each low-priority event type occupy in one or more data-storage devices; and

displaying options for changing how each of the low-priority event type is stored in the one or more data-storage devices.

16. The medium of claim 15, wherein identifying certain event types as low-priority event types comprises:

for each event type,

counting event messages of the event type over a time period to obtain a count of event messages of the event type;

counting user interactions with event messages of the event type over the time period to determine a number user interactions for the event type; and

identifying the event type as a low-priority event type and corresponding event messages as low priority when the count of event messages is less than or equal to a count threshold and the number of user interactions is greater than or equal to a number of interactions threshold.

17. The medium of claim 15, wherein identifying certain event types as low-priority event types comprises identifying an event type as a low-priority event type and corresponding event messages as low priority, when a user identifies the event type as low priority.

18. The medium of claim 15, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

identifying event messages of the low-priority event type for deletion, when the low-priority event type is selected for deletion; and

deleting the event message of the low-priority event type selected for deletion.

19. The medium of claim 15, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

receiving a percentage of event messages to store in an event-log file;

for each event message,

generating a random number between zero and one;

storing the event message in an event-log file when the random number is less the percentage multiplied by one hundred; and

deleting the event message when the random number is greater than the percentage multiplied by one hundred.

20. The medium of claim 15, wherein deleting the event messages of each low-priority event type in accordance with the storage requirement comprises:

receiving a retention time for storing the event message in an event-log file;

for each event message, deleting the event message form the event-log file when the difference between a current time stamp and a time stamp of the event message is greater than the retention time.

21. The medium of claim 15, wherein identifying the candidate low-priority event types of the event types comprises:

calculating an amount of storage occupied by event messages of an event type;

determining total storage for an event-log file that stores event messages of the event type;

calculating storage of the event-log file without the event type as a different between the total storage of the event-log file and the amount of storage occupied by the event message;

displaying the event type as the candidate low-priority event type, the amount of storage occupied by event messages of the event type, the total storage for the event-log file that stores event messages of the event type, storage of the event-log file without the event type; and

changing status of the event type to a low-priority event type when a user selects an option to change the status of the event type.