LOG ANALYTICS FOR PROBLEM DIAGNOSIS

• US 20160124793A1
• Filed: 11/27/2015
• Published: 05/05/2016
• Est. Priority Date: 10/31/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ruan, Yaoping, Tao, Shu, Tak, Byungchul
• Granted Patent: US 9,727,407 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: G06N 5/045 Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence

Abstract

In a set of problem log entries from a computing system, a subset of the set of problem log entries are identified, which pertain to a failed request. The subset is compared to a reference model which defines log entries per request type under a healthy state of the computing system, to identify a portion of the subset of problem log entries which deviate from corresponding log entries in the reference model. In the portion of the subset, at least one high-value log entry is identified. The at least one high-value log entry is output.

Claims

1. A method comprising:

identifying, in a set of problem log entries from a computing system, a subset of said set of problem log entries which pertain to a failed request;

comparing said subset to a reference model which defines log entries per request type under a healthy state of said computing system, to identify a portion of said subset of problem log entries which deviate from corresponding log entries in said reference model;

identifying, in said portion of said subset, at least one high-value log entry; and

outputting said at least one high-value log entry.

2. The method of claim 1, wherein, in said subset-identifying step, said computing system comprises a plurality of components distributed in a cloud environment.

3. The method of claim 2, wherein:

said failed request has an associated identifier;

said identifying of said subset comprises;

identifying into a correlated set those entries of said set of problem log entries containing said associated identifier; and

adding to said correlated set additional entries of said set of problem log entries, based on a rule set, to obtain said subset.

4. The method of claim 3, wherein said comparing comprises aligning individual lines of said subset with individual lines of said corresponding log entries in said reference model, and, where any given line cannot be matched, inserting an opposing blank log entry.

5. The method of claim 4, wherein said identifying of said at least one high-value log entry is based on rareness of a corresponding log template.

6. The method of claim 5, further comprising building said reference model.

7. The method of claim 6, wherein said building of said reference model comprises:

generating said rule set based on identifier name value pairs; and

applying said rule set in a log correlation process to obtain said log entries per request type under said healthy state of said computing system.

8. The method of claim 1, wherein:

said identifying of said subset is carried out with a log correlation module, embodied in a non-transitory computer readable medium, executing on at least one hardware processor;

said comparing of said subset to said reference model is carried out with a log comparison module, embodied in said non-transitory computer readable medium, executing on said at least one hardware processor; and

said identifying of said at least one high-value log entry is carried out with a visualization model module, embodied in said non-transitory computer readable medium, executing on said at least one hardware processor.