Session-Based Processing Method and System

• US 20100306315A1
• Filed: 08/13/2010
• Published: 12/02/2010
• Est. Priority Date: 03/09/2004
• Status: Active Grant

• Current Assignee: Trilogy Development Group Incorporated (ESW Capital, LLC)
• Original Assignee: Trilogy Development Group Incorporated (ESW Capital, LLC)
• Inventors: Karipides, Daniel P., Smith, Shawn A.P.
• Granted Patent: US 8,589,428 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/11 File system administration, e.g. details of archiving or snapshots file system backup G06F11/14
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A log file processing system sorts records from large log files and groups them by session without making a complete copy of the log files by capturing a subset of the log files in a sliding memory window and identifying all records in the window that form a complete user session. Records belonging to a complete session are output for analyzing, and the remaining records are output as raw log data for additional processing. Using a ring buffer to implement the sliding memory window, data structures are used to group records by session, to identify completed sessions, and to index into the ring buffer to retrieve records for completed sessions that are to be directly analyzed. Any records remaining in the ring buffer at the end of slide window processing may be output as raw log file data and are processed as incomplete or malformed session records. An embodiment of the log file processing system provides a significant improvement on the speed of data extraction from log files into analyzable session data.

Claims

1. A method for grouping log file entries by session, comprising:

storing a log file of entries in a memory, each of said entries identifying a client request to a server;

retrieving a subset of log file entries from the memory;

identifying each entry in the memory to identify entries in the subset of log file entries that belong to a complete client session;

grouping entries in the subset that belong to a complete client session.

2-20. -20. (canceled)