Method for Characterizing System State Using Message Logs

• US 20100290601A1
• Filed: 08/17/2009
• Published: 11/18/2010
• Est. Priority Date: 10/17/2007
• Status: Active Grant

• Current Assignee: Arlington Technologies, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Avaya Incorporated
• Inventors: Chen, Chuanwen, Yajnik, Shalini, Singh, Navjot
• Granted Patent: US 8,949,177 B2
• Time in Patent Office: Days
• US Class Current: 379/88.22
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04M 3/2218 Call detail recording

Abstract

A method that enables the run-time behavior of a system to be analyzed is disclosed. By analyzing the totality of the messages in the log or logs system behavior can be better understood. The illustrative embodiment of the present invention detects patterns in message logs, clusters similar messages, and determines system behavior based on the clustering of messages.

Claims

1. A method comprising compiling a first message log based, at least in part, on:

(i) a second message log that comprises a first message A and a second message B, and

(ii) a dis-similarity distance A between the morphology of the first message A and the morphology of the second message B.

2. The method of claim 1 wherein the dis-similarity distance is based on a first sub-string of the first message S(A) and a first sub-string of the second message S(B).

3. The method of claim 1 wherein the dis-similarity distance is based, at least in part, on:

(i) a first dis-similarity distance Δ

₁ between a first sub-string of the first message S₁(A) and a first sub-string of the second message S₁(B),

(ii) a second dis-similarity distance Δ

₂ between a second sub-string of the first message S₂(A) and a second sub-string of the second message S₂(B),

(iii) a first weighting W₁ of the first dis-similarity distance Δ

₁, and

(iv) a second weighting W₂ of the dis-similarity distance Δ

₂,

wherein Δ

=f(Δ

₁, W₁, Δ

₂, W₂).

4. The method of claim 1 wherein the dis-similarity distance is increased when the first message and the second message have opposite meanings.

5. The method of claim 1 wherein the dis-similarity distance between the first message and the second message is based on the length of the first message and the length of the second message.

6. The method of claim 1 further comprising characterizing system state based on the first message log.

7. The method of claim 1 further comprising characterizing system state based on the occurrence of messages in the first message log with dis-similarity distance Δ

below a threshold.

8. A method comprising compiling a first message log based on a clustering of messages in a second message log;

wherein the clustering of messages is based, at least in part, on the dis-similarity distance of a plurality of messages.

9. The method of claim 8 wherein the clustering is based on a dis-similarity distance between a first message and a second message in the second message log.

10. The method of claim 9 wherein the dis-similarity distance is based on components in the first message and the second message.

11. The method of claim 9 wherein the weighting is based on the ordering of the components.

12. The method of claim 9 wherein the dis-similarity distance is increased when the first message and the second message have opposite meanings.

13. The method of claim 9 wherein the dis-similarity distance between the first message and the second message is based on the length of the first message and the length of the second message.

14. The method of claim 8 further comprising characterizing system state based on the occurrence of a first cluster in the first message log.

15. The method of claim 8 further comprising determining outliers in the clustering of messages.

16. The method of claim 15 further comprising cross-correlating outliers based on a second clustering of messages.

17. The method of claim 16 further comprising determining anomalies based on the cross-correlating.

18. The method of claim 17 further comprising characterizing system state based on the occurrence of anomalies.

19. A method comprising generating a first cluster of messages based on a dis-similarity distance between a first message and a second message in a first message log.

20. The method of claim 19 further comprising compiling a second message log based on the clustering of messages and the first message log.

21. The method of claim 19 wherein the dis-similarity distance is based on components in the first message and the second message.

22. The method of claim 21 wherein the dis-similarity distance is weighted based on the ordering of the components.

23. The method of claim 19 wherein the dis-similarity distance is increased when the first message and the second message have opposite meanings.

24. The method of claim 19 further comprising characterizing system state based on the incidence of the first cluster of messages at a first time interval and the incidence of the cluster of messages a second time interval.

25. The method of claim 24 further comprising wherein characterizing system state is further based on a time series of the first cluster of messages and a time series of a second cluster of messages.

26. The method of claim 25 wherein characterizing system state is further based on a cross-correlation of outliers of the time series of the first cluster of messages and the time series of the second cluster of messages.

27. The method of claim 26 wherein the characterizing system state is further based on anomalies determined by the cross-correlation.

28. A method comprising characterizing the state of a system based on the incidence of clusters in a message log.

29. The method of claim 28 wherein the characterization of the state of the system is based on the incidence of clusters at a first time interval and on the incidence of clusters at a second time interval.

30. The method of claim 28 wherein the characterization of the state of the system is based on the anomalies determined by the cross-correlation of outliers in the incidence of clusters.