IDENTIFYING PROBLEMATIC MESSAGES

• US 20180091404A1
• Filed: 09/23/2016
• Published: 03/29/2018
• Est. Priority Date: 09/23/2016
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Galkin, Ola, Mendel, Sigal, Kedem, Gil
• Granted Patent: US 10,187,495 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Examples relate to identifying problematic messages. In one example, a computing device may: obtain, for each of a plurality of server requests, at least one log message; obtain, for each of the server requests, a measure of server request success; for each of the obtained log messages, cluster the obtained log message into one of a plurality of log clusters, the clustering being based on a measure of similarity between the obtained log message and other log messages included in the log cluster; and for each of the obtained log messages, increment a particular counter associated with the log cluster into which the obtained log message is clustered, the particular counter being selected for incrementing based on the measure of server request success.

Claims

1. A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing device for identifying problematic messages, the machine-readable storage medium comprising instructions to cause the hardware processor to:

obtain, for each of a plurality of server requests, at least one log message associated with the server request;

obtain, for each of the plurality of server requests, a measure of server request success;

for each of the obtained log messages, cluster the obtained log message into one of a plurality of log clusters, the clustering of the obtained log message being based on a measure of similarity between the obtained log message and other log messages included in the log cluster into which the obtained log message is clustered; and

for each of the obtained log messages, increment a particular counter of a plurality of counters associated with the log cluster into which the obtained log message is clustered, the particular counter being selected for incrementing based on the measure of server request success of the server request associated with the obtained log message.

2. The storage medium of claim 1, wherein the instructions further cause the hardware processor to:

receive a plurality of log messages that are associated with a new server request;

identify, for each of the plurality of log messages, one of the plurality of log clusters to which the log message belongs; and

identify one of the plurality of log messages as a target log message based on the log cluster to which the target log message belongs.

3. The storage medium of claim 2, wherein the instructions further cause the hardware processor to:

generate a notification associated with the target log message, the notification indicating that the target log message is potentially problematic.

4. The storage medium of claim 2, wherein the identification of one of the plurality of log messages as a target message based on the log cluster to which the target log message belongs is based on the plurality of counters associated with the log cluster to which the target log message belongs.

5. The storage medium of claim 1, wherein the plurality of counters associated with the log cluster includes:

a problematic counter indicating a number of log messages that are associated with a potentially problematic server request; and

a benign counter indicating a number of log messages that are not associated with a problematic server request.

6. The storage medium of claim 5, wherein the instructions further cause the hardware processor to:

identify each of the plurality of log clusters as one of potentially problematic or benign, the identification being based on the problematic counter and benign counter for each of the plurality of log clusters.

7. A computing device comprising:

a hardware processor; and

a data storage device storing instructions that, when executed by the hardware processor, cause the hardware processor to;

receive a plurality of log messages associated with a server request;

receive a measure of server request success for the server request, the measure of server request success indicating that the server request failed;

identify, for each of the plurality of log messages, one of a plurality of log clusters to which the log message belongs;

identify one of the identified log clusters as a problematic log cluster; and

identify the log message that belongs to the problematic log cluster as a problematic log message.

8. The computing device of claim 7, wherein the measure of server request success includes one of:

a request response time indicating a period of time between the server request and a response from a server to which the request was provided;

or

a Hypertext Transfer Protocol (HTTP) status code.

9. The computing device of claim 7, wherein each of the plurality of log messages are identified as belonging to one of the plurality of log clusters based on similarities between the plurality of log messages and the log clusters to which they belong.

10. The computing device of claim 7, wherein the problematic log cluster is identified based on a plurality of counters associated with the problematic log cluster.

11. The computing device of claim 10, wherein the plurality of counters associated with the problematic log cluster includes:

a problematic counter indicating a number of log messages that are associated with a potentially problematic server request; and

a benign counter indicating a number of log messages that are not associated with a problematic server request.

12. The computing device of claim 11, wherein the instructions further cause the hardware processor to:

increment the problematic counter associated with the problematic log cluster.

13. The computing device of claim 11, wherein the instructions further cause the hardware processor to:

identify a second of the identified log clusters as a benign log cluster;

identify the log message that belongs to the benign log cluster as a benign log message; and

increment a benign counter associated with the benign log cluster.

14. The computing device of claim 7, wherein the instructions further cause the hardware processor to:

provide data indicating the problematic log message and the server request to a problematic request analyzer.

15. A method, implemented by a hardware processor, the method comprising:

receiving a plurality of log messages associated with a server request;

receiving a measure of server request success for the server request;

identifying, for each of the plurality of log messages, one of a plurality of log clusters to which the log message belongs; and

determining that one of the plurality of log messages is a problematic log message based on the identified log cluster to which the problematic log message belongs, the determination being made based on a plurality of counters associated with the identified log cluster to which the problematic log message belongs.

16. The method of claim 15, wherein each of the plurality of log messages are identified as belonging to one of the plurality of log clusters based on similarities between the plurality of log messages and the log clusters to which they belong.

17. The method of claim 15, wherein the plurality of counters associated with the identified log cluster to which the problematic log message belongs includes:

a problematic counter indicating a number of log messages that are associated with a potentially problematic server request; and

a benign counter indicating a number of log messages that are not associated with a problematic server request.

18. The method of claim 17, wherein the measure of server request success indicates that the server request was successful, and wherein the method further comprises:

incrementing the benign counter.

19. The method of claim 17, wherein the measure of server request success indicates that the server request failed, and wherein the method further comprises:

incrementing the problematic counter.

20. The method of claim 15, wherein the measure of server request success includes one of:

a request response time indicating a period of time between the server request and a response from a server to which the request was provided;

or

a Hypertext Transfer Protocol (HTTP) status code.