Message Descriptions

• US 20110035390A1
• Filed: 08/05/2009
• Published: 02/10/2011
• Est. Priority Date: 08/05/2009
• Status: Active Grant

• Current Assignee: Cloud Software Group
• Original Assignee: Loglogic (Cloud Software Group)
• Inventors: Whitehouse, Sanford
• Granted Patent: US 8,386,498 B2
• Time in Patent Office: Days
• US Class Current: 707/755
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Messages (e.g., log messages or any form of record oriented data) are analyzed for identifiable value patterns. When a pattern is located the value is replaced by a name or “token” for the pattern, resulting in a “message description” for the message. When analysis is finished and token/value replacements are complete the message description can be stored as a reference to the message.

Claims

1. A computer-implemented method, comprising:

receiving a first message;

searching the first message for a value pattern;

if a value pattern is found in the first message, replacing a value in the first message with a token to create a first message description for the first message; and

storing the first message description as a reference to the first message.

2. The method of claim 1, where the searching is grammar independent.

3. The method of claim 1, where the first message description is created automatically.

4. The method of claim 1, where the first message is formatted as one or more lines of text, structured data or binary data.

5. The method of claim 1, where the first message description conceptually includes a relationship of the first message to its values.

6. The method of claim 1, where the first message description conceptually includes a relationship between the first message and a second message.

7. The method of claim 1, further comprising:

constructing a parsing or mapping rule that supports the first message description for the first message; and

applying the parsing rule to a second message.

8. The method of claim 1, further comprising:

correcting the first message description; and

refining the creating of a second message description using the corrected first message description.

9. The method of claim 1, further comprising:

generating a report using the first message description.

10. The method of claim 1, further comprising:

searching a log message database using the first message description.

11. A message management system, comprising:

an interface coupled to a message collector for receiving a first message; and

a message description system coupled to the interface, the message description system configured for;

searching the first message for a value pattern;

if a value pattern is found in the first message, replacing a value in the first message with a token to create a first message description; and

storing the first message description as a reference to the first message.

12. The system of claim 11, where the searching is grammar independent.

13. The system of claim 11, where the first message description is created automatically.

14. The system of claim 11, where the first message is formatted as one or more lines of text, structured data or binary data.

15. The system of claim 11, where the first message description conceptually includes a relationship of the first message to its values.

16. The system of claim 11, where the first message description conceptually includes a relationship between the first message and a second message.

17. The system of claim 11, where the first message description system is configured for:

constructing a parsing or mapping rule that support the first message description; and

applying the parsing rule to a second message.

18. The system of claim 11, where the first message description system is configured for:

correcting the first message description; and

refining the creating of a second message description using the corrected first message description.

19. The system of claim 11, further comprising:

a reporting engine configured for generating reports using the first message description.

20. The system of claim 11, further comprising:

a search engine configured for searching a log message database using the first message description.