Systems and methods for managing syslog messages

• US 20080104094A1
• Filed: 10/31/2006
• Published: 05/01/2008
• Est. Priority Date: 10/31/2006
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Desai, Neeshant D., Cowham, Adrian, Dawson, Devon L.
• Application Number:
  US11/590,142
• Publication Number:
  US 20080104094A1
• Time in Patent Office: Days
• US Class Current: 707/101
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation

Abstract

In one embodiment, a method for managing syslog messages includes identifying a syslog message format that is not currently accepted, composing a syslog message template that corresponds to the syslog message format, the syslog message template comprising a regular expression having a general arrangement the corresponds to the syslog message format such that validity of future syslog messages can be determined through comparison of the future syslog messages to the regular expression, and storing the syslog message template in a location at which the syslog message template will be considered by a syslog daemon in making a message validity determination.

Claims

1. A method for managing syslog messages, the method comprising:

receiving a syslog message;

determining whether the syslog message is valid by comparing the syslog message to one of a plurality of separate syslog message templates to identify whether a format of the syslog message matches a format of the syslog message template; and

if the syslog message format does not match the format of the syslog message template, individually comparing the syslog message format with formats of the other syslog message templates until a match is found or it is determined that the syslog message format matches none of the formats of the syslog message templates.

2. The method of claim 1, wherein comparing the syslog message to one of a plurality of discrete syslog message templates comprises comparing the syslog message to one of a plurality of regular expressions each comprising the general arrangement of an acceptable syslog message.

3. The method of claim 1, further comprising, if a match is found, storing the received syslog message in a syslog message repository.

4. The method of claim 1, further comprising, if no match is found, discarding the received syslog message.

5. A computer-readable medium that stores a system for managing syslog messages, the system comprising:

logic configured to determine whether the syslog message is valid by comparing the syslog message to one of a plurality of separate syslog message templates to identify whether a format of the syslog message matches a format of the syslog message template; and

logic configured to, if the syslog message format does not match the format of the syslog message template, individually compare the syslog message format with formats of the other syslog message templates until a match is found or it is determined that the syslog message format matches none of the formats of the syslog message templates.

6. The computer-readable medium of claim 5, wherein the logic configured to determine comprises logic configured to compare the syslog message to one of a plurality of regular expressions each comprising the general arrangement of an acceptable syslog message.

7. The computer-readable medium of claim 5, further comprising logic configured to, if a match is found, store the received syslog message in a syslog message repository.

8. The computer-readable medium of claim 5, further comprising logic configured to, if no match is found, discard the received syslog message.

9. A method for managing syslog messages, the method comprising:

identifying a syslog message format that is not currently accepted;

composing a syslog message template that corresponds to the syslog message format, the syslog message template comprising a regular expression having a general arrangement the corresponds to the syslog message format such that validity of future syslog messages can be determined through comparison of the future syslog messages to the regular expression; and

storing the syslog message template in a location at which the syslog message template will be considered by a syslog daemon in making a message validity determination.

10. The method of claim 9, wherein identifying a syslog message format comprises identifying the syslog message format from a syslog message that was previously determined to be invalid.

11. The method of claim 9, wherein identifying a syslog message format comprises identifying the syslog message format from a syslog message that was previously discarded.

12. The method of claim 9, wherein composing a syslog message template comprises composing a regular expression consisting of a string of characters arranged in a format that is indicative of the syslog message format.

13. The method of claim 9, wherein composing a syslog message template comprises composing a regular expression comprising a string of characters that form various entries or fields that a valid syslog message would contain.

14. The method of claim 9, wherein storing the syslog message template comprises storing the syslog message template in a syslog message template repository.

15. The method of claim 14, wherein storing the syslog message template in a syslog message template repository comprises storing an independent file containing the regular expression in a directory.

16. The method of claim 14, wherein storing the syslog message template in a syslog message template repository comprises storing the regular expression in a single file comprising separate entries for multiple regular expressions.

17. The method of claim 14, wherein storing the syslog message template in a syslog message template repository comprises storing the regular expression in a table comprising separate entries for multiple regular expressions.

18. A system for managing syslog messages, the system comprising:

means for identifying a syslog message format that is not currently accepted;

means for composing a syslog message template that corresponds to the syslog message format, the syslog message template comprising a regular expression having a general arrangement the corresponds to the syslog message format such that validity of future syslog messages can be determined through comparison of the future syslog messages to the regular expression; and

means for storing the syslog message template in a location at which the syslog message template will be considered by a syslog daemon in making a message validity determination.

19. The system of claim 18, wherein the means for composing a syslog message template comprise means for composing a regular expression consisting of a string of characters arranged in a format that is indicating of the syslog message format.

20. The system of claim 18, wherein the means for composing a syslog message template comprise the means for composing a regular expression comprising a string of characters that form various entries or fields that a valid syslog message would contain.

21. The system of claim 18, wherein the means for storing the syslog message template comprise a template repository.

22. The system of claim 21, wherein the repository comprises a directory in which independent files containing separate regular expressions are stored.

23. The system of claim 21, wherein the repository comprises a file that contains separate entries for multiple regular expressions.

24. The system of claim 21, wherein the repository comprises a table containing separate entries for multiple regular expressions.

25. A computer comprising:

a processing device; and

memory including a syslog daemon, a syslog message repository, and a syslog message template repository, the syslog daemon being configured to receive syslog messages, determine whether the syslog messages are valid, store valid syslog messages within the syslog message repository, and discard invalid syslog messages, wherein the syslog daemon determines whether the syslog messages are valid by comparing the syslog message to one or more of a plurality of separate syslog message templates stored in the syslog message template repository to identify whether formats of the syslog messages match formats of the syslog message templates.

26. The computer of claim 25, wherein the syslog message templates comprise regular expressions each consisting of a string of characters arranged in a format that is indicative of the syslog message format.

27. The computer of claim 25, wherein the syslog message templates comprise regular expressions each comprising a string of characters that form various entries or fields that a valid syslog message would contain.