LOG PROCESSING AND ANALYSIS

• US 20180113783A1
• Filed: 10/23/2017
• Published: 04/26/2018
• Est. Priority Date: 10/24/2016
• Status: Active Grant

• Current Assignee: Yscope Inc.
• Original Assignee: Ding Yuan, Michael Stumm, Xu Zhao, Yu Luo
• Inventors: LUO, Yu, RODRIGUES, Kirk, STUMM, Michael, YUAN, Ding, ZHAO, Xu
• Granted Patent: US 10,642,712 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3419 by assessing time
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

A log of execution of an executable program is obtained. Log messages contained in the log are parsed to generate object identifiers representative of instances of programmatic elements in the executable program. Relationships among the object identifiers are identified. A representation of identified relationships is constructed and outputted as, for example, a visual representation.

Claims

1. A process comprising:

obtaining a log of execution of an executable program;

parsing log messages contained in the log to generate object identifiers representative of instances of programmatic elements in the executable program;

identifying relationships among the object identifiers to obtain identified relationships;

constructing a representation of the identified relationships; and

outputting the representation.

2. The process of claim 1, further comprising interring types of objects represented by the object identifiers, and identifying relationships among types to obtain the identified relationships.

3. The process of claim 2, wherein the types are empirical types that are not constrained to correspond to types defined by a programming language of the executable program.

4. The process of claim 1, further comprising determining events from log messages and including the events in the representation.

5. The process of claim 4, further comprising associating the object identifiers to the events and including an indication of object identifiers associated with events in the representation.

6. The process of claim 4, wherein the representation comprises an event timeline.

7. The process of claim 1, wherein the representation comprises a graph having nodes defined by the object identifiers.

8. The process of claim 1, wherein the log messages are generated by log statements provided to the executable program by a human programmer.

9. A non-transitory machine-readable storage medium comprising instructions that, when executed by a processor, discover a log of execution of an executable program, parse log messages contained in the log to generate object identifiers representative of instances of programmatic elements in the executable program, and identify relationships among the object identifiers to obtain identified relationships for output in a representation.

10. The storage medium of claim 9, wherein the instructions are further to locate the executable program in a file system of a host.

11. The storage medium of claim 9, wherein the instructions are further to extract a string constant from the executable program and to use the string constant to parse the log messages to generate the object identifiers.

12. The storage medium of claim 9, wherein the instructions are further to infer types of objects represented by the object identifiers, and to identify relationships among the types to obtain the identified relationships.

13. The storage medium of claim 12, wherein the types are empirical types that are not constrained to correspond to types defined by a programming language of the executable program.

14. The storage medium of claim 9, wherein the instructions are further to transmit an indication of the identified relationships to a server via a network.

15. The storage medium of claim 9, wherein the log messages are generated by log statements provided to the executable program by a human programmer.

16. A non-transitory machine-readable storage medium comprising instructions that, when executed by a processor, obtain log data that includes identified relationships among object identifiers representative of instances of programmatic elements in an executable program, construct a representation of the identified relationships, and output the representation, wherein the log data is based on log messages generated by log statements provided to the executable program.

17. The storage medium of claim 16, wherein the instructions are further to include in the representation an indication of events associated with the object identifiers.

18. The storage medium of claim 17, wherein the representation comprises an event timeline.

19. The storage medium of claim 16, wherein the representation comprises a graph having nodes defined by the object identifiers.