Distributed sorting of event log files
First Claim
Patent Images
1. A method, comprising:
- providing a plurality of composite keys for an event log, each of the composite keys composed of more than one column of a relational database and being a combination of a first time value and at least a portion of a plurality of attributes of a natural key;
wherein one of the attributes of each plurality of attributes includes a second time value, and wherein the second time values have a different accuracy than the first time values;
extracting, by a processing device, natural key values from the composite keys;
distributing, by the processing device, log lines of event log files to a plurality of reducer nodes, the distributing being based on the extracted natural key values,wherein a first log line having a first natural key value is distributed to a first one of the reducer nodes and a second log line having a second different natural key value is distributed to a second one of the reducer nodes, andwherein the first one of the reducer nodes includes a first processor and the second one of the reducer nodes includes a second processor that is different than the first processor, andwherein the processing device comprises a third processor that is different than the first and second processors; and
processing, by one of the first and second processors, a portion of the distributed log lines,the processing comprising i) sorting log lines of the portion based on corresponding ones of the first time values, and ii) grouping the sorted log lines of the portion based on the natural keys; and
producing, by the one of the first and second processors, an executable and linkable format (ELF) file responsive to the grouping.
2 Assignments
0 Petitions
Accused Products
Abstract
In an example, composite keys for an event log may be provided. A partitioner may be configured to extract a natural key from the composite keys and distribute log lines of event log files to a plurality of reducer nodes based on a value of the natural key. A comparator may use a log time of the composite key to sort a received portion of the distributed log lines.
187 Citations
20 Claims
-
1. A method, comprising:
-
providing a plurality of composite keys for an event log, each of the composite keys composed of more than one column of a relational database and being a combination of a first time value and at least a portion of a plurality of attributes of a natural key; wherein one of the attributes of each plurality of attributes includes a second time value, and wherein the second time values have a different accuracy than the first time values; extracting, by a processing device, natural key values from the composite keys; distributing, by the processing device, log lines of event log files to a plurality of reducer nodes, the distributing being based on the extracted natural key values, wherein a first log line having a first natural key value is distributed to a first one of the reducer nodes and a second log line having a second different natural key value is distributed to a second one of the reducer nodes, and wherein the first one of the reducer nodes includes a first processor and the second one of the reducer nodes includes a second processor that is different than the first processor, and wherein the processing device comprises a third processor that is different than the first and second processors; and processing, by one of the first and second processors, a portion of the distributed log lines, the processing comprising i) sorting log lines of the portion based on corresponding ones of the first time values, and ii) grouping the sorted log lines of the portion based on the natural keys; and producing, by the one of the first and second processors, an executable and linkable format (ELF) file responsive to the grouping. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A memory device having instructions stored thereon that, in response to execution by a processing device, cause the processing device to perform operations comprising:
-
identifying a plurality of composite keys for an event log, each of the composite keys composed of more than one column of a relational database and being a combination of a first time value and at least a portion of a plurality of attributes of a natural key; wherein one of the attributes of each plurality of attributes includes a second time value, and wherein the second time values have a different accuracy than the first time values; and extracting natural key values from the composite keys; and distributing log lines of event log files to a plurality of reducer nodes, the distributing being based on the extracted natural key values, wherein a first log line having a first natural key value is distributed to a first one of the reducer nodes and a second log line having a second different natural key value is distributed to a second one of the reducer nodes, wherein the first one of the reducer nodes includes a first processor and the second one of the reducer nodes includes a second processor that is different than the first processor, and wherein the processing device comprises a third processor that is different than the first and second processors, said distributing to control processing, by the first and second processors, of the distributed log lines, the processing comprising i) sorting log lines based on the first time values, and ii) grouping the sorted log lines based on the natural keys, wherein said processing produces an executable and linkable format (ELF) file. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18)
-
-
19. A memory device having instructions stored thereon that, in response to execution by a processing device, cause the processing device to perform operations comprising:
-
processing a received portion of distributed log lines distributed to a plurality of reducer nodes based on natural key that are associated with the log lines, wherein the processing device comprises a first processor of a first one of the reducer nodes and wherein a second different one of the reducer nodes includes a second processor that is different than the first processor, wherein the log lines are distributed by a third processor that is different than the first and second processors, each log line of the received portion corresponding to a common time value of a corresponding one of the natural keys, the processing comprising; sorting the log lines of the received portion based on different time values of composite keys associated with the log lines of the received portion, each of the composite keys composed of more than one column of a relational database; wherein each of the different time values of the composite keys has a different accuracy than the common time value of the natural keys; grouping the sorted log lines of the received portion based on the natural keys; and producing an executable and linkable format (ELF) file responsive to the grouping. - View Dependent Claims (20)
-
Specification