Managing and archiving system and application log files

• US 10,318,477 B2
• Filed: 05/26/2010
• Issued: 06/11/2019
• Est. Priority Date: 05/26/2010
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Pickard, Jonathan J., Foster, Jr., William W.
• Primary Examiner(s): Trujillo, James
• Assistant Examiner(s): Cheung, Hubert
• Application Number:
  US12/787,664
• Publication Number:
  US 20110295813A1
• Time in Patent Office: 3,303 Days
• CPC Class Codes: G06F 16/113 Details of archiving lifecycle management in storage systems G06F3/0649; backup systems G06F11/1446

Abstract

A mechanism for managing and archiving system and application log files is disclosed. A method of the invention includes accessing log files on shared storage that satisfy grouping requirements, combining the accessed log files that satisfy the grouping requirements into a single combined log file, compressing the single combined log file, and storing the single combined log file to an archival storage location.

Claims

1. A method, comprising:

receiving, by a processing device of a log master server machine, log files from disparate remote system machines separate from the log master server machine;

executing, by the processing device, error checking code to identify missing log files of the received log files from the disparate remote system machines and determine whether to ignore the missing log files;

in response to determining to ignore the missing log files, storing, by the processing device, the received log files on shared storage of the log master server machine, wherein the received log files on the shared storage are accessible to the log master server machine and the disparate remote system machines;

identifying, by the processing device of the log master server machine, log files of the received log files, wherein the identified log files satisfy grouping requirements that comprise at least a source of the log files or a time of creation of the log files;

combining, by the processing device of the log master server machine, the identified log files that satisfy the grouping requirements into a single combined log file;

deleting the identified log files from the shared storage after combining the identified log files into the single combined log file;

compressing, by the processing device of the log master server machine, the single combined log file; and

storing, by the processing device of the log master server machine, the single combined log file to an archival storage location, wherein the combined log file is compressed after storing to an archival storage location.

2. The method of claim 1, wherein the log files are pushed to the shared storage by one or more of the disparate remote system machines that created the log files, the pushing caused by a copy script placed on each of the one or more disparate remote system machines by the log master server machine.

3. The method of claim 1, wherein the log files are pulled to the shared storage from one or more of the disparate remote system machines that created the log files, the pulling caused by a pull script run by the log master server machine.

4. The method of claim 1, wherein the grouping requirements are provided as arguments into a combine log files script executed by the processing device of the log master server machine.

5. The method of claim 1, wherein executing the error checking code on the log master server machine further comprises performing at least one of a check that all accessed log files originate from one or more of the disparate remote system machines authorized by the log master server machine or a confirmation that there is available space in the archival storage location.

6. The method of claim 5, further comprising running error checking code on each of the one or more of the disparate remote system machines to perform at least one of a check that an environment of the one or more of the disparate remote system machines is properly set up, a check that log files directories exist on the one or more of the disparate remote system machines, a check that the log files are actually there, or a check that a shared storage source has enough space available in advance before it starts copying data over to the shared storage source.

7. The method of claim 6, wherein the error checking code provides explanations to an administrator of the log master server machine about any errors it encounters.

8. The method of claim 1 further comprising:

determining, by the processing device of the log master server machine, that the single combined log file is stored in the archival storage location; and

deleting the identified log files that satisfy the grouping requirements from the shared storage.

9. The method of claim 1 further comprising:

enabling access, by the processing device of the log master server machine, to shared storage by a first of the disparate remote system machines separate from the log master server machine.

10. A system, comprising:

a shared storage device;

an archival storage device; and

a log master server machine, executed by a processing device, communicably coupled to the shared storage device and the archival storage device, the processing device of the log master server machine to;

receive log files from disparate remote system machines separate from the log master server machine;

execute error checking code to identify missing log files of the received log files from the disparate remote system machines and determine whether to ignore the missing log files;

in response to determining to ignore the missing log files, store the received log files on the shared storage device, wherein the received log files on the shared storage device are accessible to the log master server machine and the disparate remote system machines;

identify a first set of log files of the received log files, wherein the log files of the first set of log files satisfy grouping requirements of a first profile;

combine the identified first set of log files that satisfy the grouping requirements of the first profile into a first combined log file;

delete the identified first set of log files from the shared storage in response to combining the identified first set of log files;

store the first combined log file to the archival storage device;

identify a second set of log files of the received log files, wherein the log files of the second set of log files satisfy grouping requirements of a second profile;

combine the identified second set of log files that satisfy the grouping requirements of the second profile into a second combined log file; and

store the second combined log file to the archival storage device, wherein the combined log file is compressed after storing to an archival storage location.

11. The system of claim 10, wherein the log files are pushed to the shared storage device by one or more of the disparate remote system machines that create the log files, the pushing caused by a copy script placed on each of the disparate remote system machines by the log master server machine.

12. The system of claim 10, wherein the log files are pulled to the shared storage from one or more of the disparate remote system machines that create the log files, the pulling caused by a pull script run by the log master server machine.

13. The system of claim 10, wherein the grouping requirements of the first profile comprise a name of a disparate remote system machine that created the log files and a time interval that the log files were created.

14. The system of claim 13, wherein the grouping requirements of the first profile are provided as arguments into a combine log files script executed by the processing device of the log master server machine.

15. The system of claim 10, wherein the processing device of the log master server machine is further to perform at least one of a check that all accessed log files originate from one or more of the disparate remote system machines authorized by the log master server machine, or a confirm that there is available space in the archival storage location.

16. The system of claim 15, wherein the disparate remote system machines perform at least one of a check that an environment of the disparate remote system machine is properly set up, a check that log files directories exist on the disparate remote system machine, a check that the log files are actually there, or a check that the shared storage source has enough space available in advance before it starts copying data over to the shared storage source the checking by the disparate remote system machines caused by an error checking script placed on each of the one or more disparate remote system machines by the log master server machine.

17. A non-transitory machine-readable storage medium including instructions that, when accessed by a processing device, cause the processing device to:

receive, by the processing device, log files from disparate remote system machines separate from a log master server machine;

execute, by the processing device, error checking code to identify missing log files of the received log files from the disparate remote system machines and determine whether to ignore the missing log files;

in response to determining to ignore the missing log files, store, by the processing device, the received log files on shared storage of the log master server machine, wherein the received log files on the shared storage are accessible to the log master server machine and the disparate remote system machines;

identify, by the processing device of the log master server machine, log files of the received log files, wherein the identified log files satisfy grouping requirements that comprise at least a source of the log files or a time of creation of the log files;

delete the identified log files from the shared storage in response to combining the identified log files;

combine, by the processing device of the log master server machine, the identified log files that satisfy the grouping requirements into a single combined log file;

compress, by the processing device of the log master server machine, the single combined log file; and

store, by the processing device of the log master server machine, the compressed single combined log file to an archival storage location, wherein the combined log file is compressed after storing to an archival storage location.

18. The non-transitory machine-readable storage medium of claim 17, wherein the log files are pushed to the shared storage by one or more of the disparate remote system machines that created the log files, the pushing caused by a copy script placed on each of the one or more disparate remote system machines by the log master server machine.

19. The non-transitory machine-readable storage medium of claim 17, wherein the log files are pulled to the shared storage from one or more of the disparate remote system machines that created the log files, the pulling caused by a pull script run by the log master server machine.

20. The non-transitory machine-readable storage medium of claim 17, wherein the grouping requirements are provided as arguments into a combine log files script run by the log master server machine.