ASSESSING AND IMPROVING QUALITY OF EVENT LOGS

• US 20160371132A1
• Filed: 06/18/2015
• Published: 12/22/2016
• Est. Priority Date: 06/18/2015
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Inventors: Prabhakara, Jagadeesh Chandra Bose Rantham
• Granted Patent: US 9,766,969 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0745 in an input/output transactions management context input/output processing in general G06F13/00
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40

Abstract

Systems and methods receive manually created event logs that include manually entered data of executed processes, and such systems and methods automatically identify errors in the event logs (based on whether the data violates expected log content). The systems and methods classify the errors, prioritize the event logs into a priority order (based on a previously established error priority ranking), and output the event logs classified into different classifications (and in priority order). The systems and methods receive feedback in order to alter the priority order and the different classifications of the event logs. Further, these systems and methods automatically generate recommendations to correct the errors, using different recommendation processes based on the classifications of the errors. The event logs are output in the different classifications and in the priority order, and the locations of the errors within the event logs are identified by the systems and methods herein.

Claims

1. A method comprising:

receiving created event logs comprising manually entered data of executed processes, said event logs containing errors introduced by manual entry of said data of executed processes;

automatically identifying said errors in said event logs based on said data of executed processes violating expected log content;

classifying said errors into different classifications including error-perspective classifications and error-type classifications,

prioritizing said event logs into a priority order based on a previously established error priority ranking;

outputting said event logs in said different classifications and in said priority order;

receiving feedback in response to said outputting said event logs to alter said priority order and said different classifications of said event logs;

automatically generating recommendations to correct said errors using different recommendation processes based on said classifications of said errors; and

outputting said recommendations.

2. The method according to claim 1, said outputting said event logs in said different classifications and in said priority order further comprising identifying a location of said errors within said event logs.

3. The method according to claim 1, said identifying said errors comprising applying, to said event logs, at least one of the following:

workflow and process models;

business and domain-specific rules;

generic rules; and

organizational rules.

4. The method according to claim 1, said recommendations comprising removal of a log entry, insertion of a log entry, and repositioning of a log entry.

5. The method according to claim 1, further comprising:

receiving feedback in response to said outputting said recommendations; and

altering said recommendation processes based on said feedback to said recommendations.

6. The method according to claim 1,

said error-perspective classifications comprising:

a control-flow error class;

a data error class;

a resource error class; and

a time error class, and

said error-type classifications comprising;

an incorrect error class;

a missing error class;

an imprecise error class; and

an irrelevant error class.

7. The method according to claim 1, each of said executed processes comprising a sequence of events, each of said events comprising attributes including an activity name, a timestamp, a resource, activity data, and

each event being associated to only one process instance.

8. A method comprising:

receiving manually created event logs comprising manually entered data of executed processes, said event logs containing errors introduced by manual entry of said data of executed processes;

automatically identifying said errors in said event logs based on said data of executed processes violating expected log content;

classifying said errors into different classifications including error-perspective classifications and error-type classifications,

prioritizing said event logs into a priority order based on a previously established error priority ranking;

outputting said event logs in said different classifications and in said priority order;

receiving feedback in response to said outputting said event logs to alter said priority order and said different classifications of said event logs;

automatically generating recommendations to correct said errors using different recommendation processes based on said classifications of said errors, said different recommendation processes comprising a replay process and a trace alignment process; and

outputting said recommendations.

9. The method according to claim 8, said outputting said event logs in said different classifications and in said priority order further comprising identifying a location of said errors within said event logs.

10. The method according to claim 8, said identifying said errors comprising applying, to said event logs, at least one of the following:

workflow and process models;

business and domain-specific rules;

generic rules; and

organizational rules.

11. The method according to claim 8, said recommendations comprising removal of a log entry, insertion of a log entry, and repositioning of a log entry.

12. The method according to claim 8, further comprising:

receiving feedback in response to said outputting said recommendations; and

altering said recommendation processes based on said feedback to said recommendations.

13. The method according to claim 8,

said error-perspective classifications comprising:

a control-flow error class;

a data error class;

a resource error class; and

a time error class, and

said error-type classifications comprising;

an incorrect error class;

a missing error class;

an imprecise error class; and

an irrelevant error class.

14. The method according to claim 8, each of said executed processes comprising a sequence of events, each of said events comprising attributes including an activity name, a timestamp, a resource, activity data, and

each event being associated to only one process instance.

15. A system comprising:

a first computerized device receiving manually created event logs comprising manually entered data of executed processes, said event logs containing errors introduced by manual entry of said data of executed processes;

a second computerized device automatically identifying said errors in said event logs based on said data of executed processes violating expected log content; and

a computerized network operatively connecting said first computerized device to said second computerized device,

said second computerized device classifying said errors into different classifications including error-perspective classifications and error-type classifications,

said second computerized device prioritizing said event logs into a priority order based on a previously established error priority ranking,

said second computerized device transmitting said event logs in said different classifications and in said priority order to said first computerized device over said network,

said first computerized device outputting said event logs on a graphic user interface of said first computerized device,

said first computerized device receiving feedback into said graphic user interface in response to said outputting said event logs to alter said priority order and said different classifications of said event logs,

said first computerized device transmitting said feedback to said second computerized device,

said second computerized device altering said priority order and said different classifications of said event logs based on said feedback,

said second computerized device automatically generating recommendations to correct said errors using different recommendation processes based on said classifications of said errors, said different recommendation processes comprising a replay process and a trace alignment process,

said second computerized device transmitting said recommendations to correct said errors to said first computerized device, and

said first computerized device outputting said recommendations through said graphic user interface.

16. The system according to claim 15, said outputting said event logs in said different classifications and in said priority order further comprising identifying a location of said errors within said event logs.

17. The system according to claim 15, said identifying said errors comprising applying, to said event logs, at least one of the following:

workflow and process models;

business and domain-specific rules;

generic rules; and

organizational rules.

18. The system according to claim 15, said recommendations comprising removal of a log entry, insertion of a log entry, and repositioning of a log entry.

19. The system according to claim 15, further comprising:

receiving feedback in response to said outputting said recommendations; and

altering said recommendation processes based on said feedback to said recommendations.

20. The system according to claim 15,

said error-perspective classifications comprising:

a control-flow error class;

a data error class;

a resource error class; and

a time error class, and

said error-type classifications comprising;

an incorrect error class;

a missing error class;

an imprecise error class; and

an irrelevant error class.