Classification of log entry types

• US 10,726,069 B2
• Filed: 08/18/2017
• Issued: 07/28/2020
• Est. Priority Date: 08/18/2017
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Thomas, Susan Marie
• Primary Examiner(s): Cao, Phuong Thao
• Application Number:
  US15/681,252
• Publication Number:
  US 20190057163A1
• Time in Patent Office: 1,075 Days
• Field of Search: 707726
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/8373 Query execution
• CPC Class Codes: G06F 16/906 Clustering; Classification
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 17/40 Data acquisition and logging for input to computer G06F3/00

Abstract

Some embodiments provide a non-transitory machine-readable medium that stores a program. The program receives a log entry instance for creating a definition for a log entry type. The program further generates a markup associated with the log entry instance. The program also generates a document based on the markup associated with the log entry instance. The program further retrieves a set of reference documents. Each reference document is associated with a particular type of event. The program also generates a ranked list of types of events based on the document and the set of reference documents.

Claims

1. A non-transitory machine-readable medium storing a program executable by at least one processing unit of a computing device, the program comprising sets of instructions for:

receiving a log entry instance for creating a definition for a log entry type;

generating a markup associated with the log entry instance;

generating a document based on the markup associated with the log entry instance;

retrieving a set of reference documents, each reference document associated with a particular type of event;

generating a ranked list of types of events based on the document and the set of reference documents;

configuring for presentation the ranked list of types of events and receiving a selection of a type of event from the ranked list of types of events; and

creating the definition for the log entry type by associating the selected type of event with the log entry instance, wherein the definition of the log entry type includes one or more rules for associating additional log entry instances with the log entry type.

2. The non-transitory machine-readable medium of claim 1, wherein the log entry instance is a first log entry instance, wherein the program further comprises sets of instructions for:

receiving a second log entry instance from a monitored source; and

processing the second log entry instance based on the definition for the log entry type in order to determine whether the second log entry instance is a log entry instance having the log entry type.

3. The non-transitory machine-readable medium of claim 1, wherein the program further comprises sets of instructions for generating a subset of the set of reference documents based on a set of definitions of types of events.

4. The non-transitory machine-readable medium of claim 1, wherein the program further comprises sets of instructions for generating a subset of the set of reference documents based on a set of log entry instances.

5. The non-transitory machine-readable medium of claim 1, wherein the markup associated with the log entry instance comprises a set of markup elements, wherein the document comprises a set of semantic attribute names, wherein generating the document based on the markup associated with the log entry instance comprises identifying the set of semantic attribute names based on a mapping between a plurality of markup elements and a plurality of semantic attribute names.

6. The non-transitory machine-readable medium of claim 1, wherein generating a ranked list of types of events based on the document and the set of reference documents comprises determining similarities between the document and each of the reference documents in the set of reference documents.

7. A method comprising:

receiving, by a computing device, a log entry instance for creating a definition for a log entry type;

generating, by the computing device, a markup associated with the log entry instance;

generating, by the computing device, a document based on the markup associated with the log entry instance;

retrieving, by the computing device, a set of reference documents, each reference document associated with a particular type of event;

generating, by the computing device, a ranked list of types of events based on the document and the set of reference documents;

configuring for presentation, by the computing device, the ranked list of types of events and receiving a selection of a type of event from the ranked list of types of events; and

creating, by the computing device, the definition for the log entry type by associating the selected type of event with the log entry instance, wherein the definition of the log entry type includes one or more rules for associating additional log entry instances with the log entry type.

8. The method of claim 7, wherein the log entry instance is a first log entry instance, wherein the method further comprises:

receiving a second log entry instance from a monitored source; and

processing the second log entry instance based on the definition for the log entry type in order to determine whether the second log entry instance is a log entry instance having the log entry type.

9. The method of claim 7 further comprising generating a subset of the set of reference documents based on a set of definitions of types of events.

10. The method of claim 7 further comprising generating a subset of the set of reference documents based on a set of log entry instances.

11. The method of claim 7, wherein the markup associated with the log entry instance comprises a set of markup elements, wherein the document comprises a set of semantic attribute names, wherein generating the document based on the markup associated with the log entry instance comprises identifying the set of semantic attribute names based on a mapping between a plurality of markup elements and a plurality of semantic attribute names.

12. The method of claim 7, wherein generating a ranked list of types of events based on the document and the set of reference documents comprises determining similarities between the document and each of the reference documents in the set of reference documents.

13. A system comprising:

a set of processing units; and

a non-transitory computer-readable medium storing instructions that when executed by at least one processing unit in the set of processing units cause the at least one processing unit to;

receive a log entry instance for creating a definition for a log entry type;

generate a markup associated with the log entry instance;

generate a document based on the markup associated with the log entry instance;

retrieve a set of reference documents, each reference document associated with a particular type of event;

generate a ranked list of types of events based on the document and the set of reference documents;

present the ranked list of types of events and receive a selection of a type of event from the ranked list of types of events; and

create the definition for the log entry type by associating the selected type of event with the log entry instance, wherein the definition of the log entry type includes one or more rules for associating additional log entry instances with the log entry type.

14. The system of claim 13, wherein the log entry instance is a first log entry instance, wherein the instructions further cause the at least one processing unit to:

receive a second log entry instance from a monitored source; and

process the second log entry instance based on the definition for the log entry type in order to determine whether the second log entry instance is a log entry instance having the log entry type.

15. The system of claim 13, wherein the instructions further cause the at least one processing unit to generate a subset of the set of reference documents based on a set of definitions of types of events.

16. The system of claim 13, wherein the instructions further cause the at least one processing unit to generate a subset of the set of reference documents based on a set of log entry instances.

17. The system of claim 13, wherein the markup associated with the log entry instance comprises a set of markup elements, wherein the document comprises a set of semantic attribute names, wherein generating the document based on the markup associated with the log entry instance comprises identifying the set of semantic attribute names based on a mapping between a plurality of markup elements and a plurality of semantic attribute names.