Method, system and program product for selectively centralizing log entries in a computing environment

• US 20040220945A1
• Filed: 05/01/2003
• Published: 11/04/2004
• Est. Priority Date: 05/01/2003
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Pioli, Anthony F., Potter, Bruce M.
• Application Number:
  US10/427,662
• Publication Number:
  US 20040220945A1
• Time in Patent Office: Days
• US Class Current: 707/100
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time

Abstract

Method, system and program product are provided for selectively centralizing log entries in a computing environment. The selectively centralizing technique includes specifying at least one event subscription to at least one node of a plurality of nodes of the computing environment using an event infrastructure. The at least one event subscription results in the at least one node monitoring for at least one log entry in a log file of the node. Upon detection, the at least one log entry is automatically forwarded from the at least one node to a central management node. Using this technique, hierarchical log entry consolidation is also possible.

Claims

1. A method for selectively centralizing log entries in a computing environment, said method comprising:

specifying at least one event subscription to at least one node of a plurality of nodes of the computing environment to monitor for at least one log entry in a log file of the at least one node; and

responsive to the at least one specified event subscription, automatically forwarding the at least one log entry from the at least one node to a central management node upon logging of the log entry to the log file of the at least one node.

2. The method of claim 1, further comprising specifying the at least one event subscription to multiple nodes of the plurality of nodes in the computing environment, wherein at least some nodes of the multiple nodes include multiple log files, and wherein the at least one event subscription specified results in monitoring for the at least one log entry in the multiple log files of the at least some nodes.

3. The method of claim 2, wherein the multiple log files comprise at least some of a syslog file, an error log file, a text based log file, and an audit log file.

4. The method of claim 2, further comprising specifying the at least one event subscription to each node of the plurality of nodes in the computing environment, wherein at least some nodes of the plurality of nodes include multiple log files, and wherein the at least one event subscription specified results in monitoring for the at least one log entry in the multiple log files of the plurality of nodes.

5. The method of claim 1, further comprising providing the at least one node of the plurality of nodes with a log file watcher resource class facility to monitor for the at least one log entry in a log file of the at least one node responsive to receipt of the at least one specified event subscription.

6. The method of claim 1, wherein the at least one node comprises at least one management node of the computing environment, and wherein the automatically forwarding comprises automatically forwarding the at least one log entry from the at least one management node to the central management node, wherein the log entry of interest is automatically forwarded from the at least one management node to the central management node responsive to the at least one specified event subscription, thereby providing hierarchical log entry consolidation.

7. The method of claim 1, wherein the at least one central management node comprises one central management node of a plurality of central management nodes in the computing environment, and wherein the method further comprises specifying at least one additional event subscription to at least one central management node of the plurality of central management nodes in the computing environment to monitor for at least one log entry in a log file at the at least one central management node, and automatically forwarding the at least one log entry from the at least one central management node to a higher level central management node, wherein only the log entry specified by the at least one additional event subscription is automatically forwarded from the at least one central management node to the high level central management node, thereby providing hierarchical log entry consolidation.

8. A system for selectively centralizing log entries in a computing environment, said system comprising:

means for specifying at least one event subscription to at least one node of a plurality of nodes of the computing environment to monitor for at least one log entry in a log file of the at least one node; and

means for automatically forwarding the at least one log entry from the at least one node to a central management node upon logging of the log entry to the log file of the at least one node, wherein said means for automatically forwarding is responsive to the at least one specified event subscription.

9. The system of claim 8, further comprising means for specifying the at least one event subscription to multiple nodes of the plurality of nodes in the computing environment, wherein at least some nodes of the multiple nodes include multiple log files, and wherein the at least one event subscription specified results in monitoring for the at least one log entry in the multiple log files of the at least some nodes.

10. The system of claim 9, wherein the multiple log files comprise at least some of a syslog file, an error log file, a text based log file, and an audit log file.

11. The system of claim 9, further comprising means for specifying the at least one event subscription to each node of the plurality of nodes in the computing environment, wherein at least some nodes of the plurality of nodes include multiple log files, and wherein the at least one event subscription specified results in monitoring for the at least one log entry in the multiple log files of the plurality of nodes.

12. The system of claim 8, further comprising means for providing the at least one node of the plurality of nodes with a log file watcher resource class facility to monitor for the at least one log entry in a log file of the at least one node responsive to receipt of the at least one specified event subscription.

13. The system of claim 8, wherein the at least one node comprises at least one management node of the computing environment, and wherein the means for automatically forwarding comprises means for automatically forwarding the at least one log entry from the at least one management node to the central management node, wherein the log entry of interest is automatically forwarded from the at least one management node to the central management node responsive to the at least one specified event subscription, thereby providing hierarchical log entry consolidation.

14. The system of claim 8, wherein the at least one central management node comprises one central management node of a plurality of central management nodes in the computing environment, and wherein the system further comprises means for specifying at least one additional event subscription to at least one central management node of the plurality of central management nodes in the computing environment to monitor for at least one log entry in a log file at the at least one central management node, and means for automatically forwarding the at least one log entry from the at least one central management node to a higher level central management node, wherein only the log entry specified by the at least one additional event subscription is automatically forwarded from the at least one central management node to the high level central management node, thereby providing hierarchical log entry consolidation.

15. At least one program storage device readable by a machine, tangibly embodying at least one program of instructions executable by the machine to perform a method for selectively centralizing log entries in a computing environment, said method comprising:

specifying at least one event subscription to at least one node of a plurality of nodes of the computing environment to monitor for at least one log entry in a log file of the at least one node; and

responsive to the at least one specified event subscription, automatically forwarding the at least one log entry from the at least one node to a central management node upon logging of the log entry to the log file of the at least one node.

16. The at least one program storage device of claim 15, further comprising specifying the at least one event subscription to multiple nodes of the plurality of nodes in the computing environment, wherein at least some nodes of the multiple nodes include multiple log files, and wherein the at least one event subscription specified results in monitoring for the at least one log entry in the multiple log files of the at least some nodes.

17. The at least one program storage device of claim 16, wherein the multiple log files comprise at least some of a syslog file, an error log file, a text based log file, and an audit log file.

18. The at least one program storage device of claim 16, further comprising specifying the at least one event subscription to each node of the plurality of nodes in the computing environment, wherein at least some nodes of the plurality of nodes include multiple log files, and wherein the at least one event subscription specified results in monitoring for the at least one log entry in the multiple log files of the plurality of nodes.

19. The at least one program storage device of claim 15, further comprising providing the at least one node of the plurality of nodes with a log file watcher resource class facility to monitor for the at least one log entry in a log file of the at least one node responsive to receipt of the at least one specified event subscription.

20. The at least one program storage device of claim 15, wherein the at least one central management node comprises one central management node of a plurality of central management nodes in the computing environment, and wherein the method further comprises specifying at least one additional event subscription to at least one central management node of the plurality of central management nodes in the computing environment to monitor for at least one log entry in a log file at the at least one central management node, and automatically forwarding the at least one log entry from the at least one central management node to a higher level central management node, wherein only the log entry specified by the at least one additional event subscription is automatically forwarded from the at least one central management node to the high level central management node, thereby providing hierarchical log entry consolidation.