MANAGING LOG ENTRIES

• US 20120124047A1
• Filed: 11/17/2010
• Published: 05/17/2012
• Est. Priority Date: 11/17/2010
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Hubbard, Eric
• Granted Patent: US 8,533,193 B2
• Time in Patent Office: Days
• US Class Current: 707/737
• CPC Class Codes: G06F 16/332 Query formulation

Abstract

Example methods, apparatus, and articles of manufacture to manage log entries are disclosed. A disclosed example method involves grouping first log entries into a first group based on a matching portion among the first log entries. The example method also involves identifying a non-matching portion of the first log entries and associating an identifier with the non-matching portion. A processor is operated to generate a text string template comprising the identifier and the at least one matching portion in a human-readable format. The identifier replaces the non-matching portion in the template.

Claims

1. A method to manage log entries, the method comprising:

grouping first log entries into a first group based on a matching portion among the first log entries;

identifying a non-matching portion of the first log entries;

associating an identifier with the non-matching portion; and

operating a processor to generate a text string template comprising the identifier and the at least one matching portion in a human-readable format, the identifier replacing the non-matching portion in the template.

2. A method as defined in claim 1, further comprising:

detecting a second log entry having a first portion matching the matching portion of the template; and

updating the template to reference the second log entry and the first log entries.

3. A method as defined in claim 2, wherein updating the template to reference the second log entry and the first log entries comprises associating a non-matching portion of the second log entry with the text string template.

4. A method as defined in claim 1, further comprising:

receiving a user input specifying an expression for the identifier associated with the non-matching portion;

generating a search string based on the text string template and the expression, the search string comprising the expression and the matching portion, the expression replacing the identifier in the text string template; and

selecting ones of the first log entries matching the search string.

5. A method as defined in claim 1, further comprising:

detecting a second non-matching portion among the first log entries; and

structuring the text string template to include a second identifier to replace the second non-matching portion in the template.

6. A method as defined in claim 1, wherein the non-matching portion is indicative of different network entities.

7. An apparatus to manage log entries, the apparatus comprising:

a user interface to;

receive a first user input indicative of a text string template comprising a matching portion and an identifier corresponding to a non-matching portion, the at least one matching portion present in at least two log entries, the non-matching portion corresponding to non-matching portions between the at least two log entries;

receive a second user input indicative of a definition for the identifier, the definition corresponding to one of the at least two log entries; and

receive a third user input indicative of metadata to be associated with the one of the at least two log entries; and

an associator to associate the metadata with the one of the two log entries.

8. An apparatus as defined in claim 7, wherein the user interface is to receive the text string template and the definition for the identifier via a search user interface, and the apparatus further comprising a log searcher to search a log source for an instance of a log entry that matches the text string template and the definition.

9. An apparatus as defined in claim 8, wherein the user interface is to present an instance of a matching log entry and the metadata for the matching log entry in response to finding the instance of the matching log entry.

10. An apparatus as defined in claim 7, wherein the non-matching portion corresponds to different network entities.

11. A tangible machine accessible medium having instructions stored thereon that, when executed, cause a machine to:

group first log entries based on at least one matching portion and at least one variable portion among the first log entries;

associate an identifier with the at least one variable portion; and

generate a text string template comprising the identifier and the at least one matching portion in a human-readable format, the identifier replacing the at least one variable portion in the template, and the template being in reference to the first log entries.

12. A machine accessible medium as defined in claim 11, wherein the variable portion among the first log entries are indicative of different network entities.

13. A machine accessible medium as defined in claim 11 having instructions stored thereon that, when executed, cause the machine to:

detect a match between the template and a second log entry based on the second log entry having a first portion matching the at least one matching portion of the first log entries; and

based on the detected match, update the text string template to further be in reference to the second log entry and the first log entries.

14. A machine accessible medium as defined in claim 13 having instructions stored thereon that, when executed, cause the machine to update the text string template to further be in reference to the second log entry and the first log entries by associating the text string template with a variable portion of the second log entry.

15. A machine accessible medium as defined in claim 11 having instructions stored thereon that, when executed, cause the machine to:

receive a user input specifying an expression for the identifier associated with the at least one variable portion;

generate a search string based on the text string template and the expression, the search string comprising the expression and the at least one matching portion, and the expression replacing the identifier in the text string template; and

select ones of the first log entries matching the search string.