System for log record and log expansion with inserted log records representing object request for specified object corresponding to cached object copies

• US 5,892,917 A
• Filed: 09/27/1995
• Issued: 04/06/1999
• Est. Priority Date: 09/27/1995
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Myerson, Terry J.
• Primary Examiner(s): Lee, Thomas C.
• Assistant Examiner(s): Chen, Anderson I.
• Application Number:
  US08/534,488
• Time in Patent Office: 1,287 Days
• Field of Search: 340/825.33, 379/34, 380/4, 395/184.01, 395/651, 395/200.54, 395/200.53, 395/838, 395/892
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3471 Address tracing
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A system and method for analyzing a Web site log file and generating an expanded log file that compensates for information caching and gateway based Web site access. More particularly, the log file expansion procedure of the present invention works with a log file stored in memory on the server computer. The log file contains a sequence of log records, each log record representing an object request by a client computer. Each log record includes data identifying the requested object as well as some data, such as an Internet address, associated with the client computer or a gateway through which the client computer requested the object. The log expansion procedure analyzes the sequence of log records so as to detect object request patterns indicating that object requests not represented by the log records were satisfied by cached object copies, and then supplements the sequence of log records with inserted log records representing object requests for the objects corresponding to the cached object copies. As a result, the supplemented sequence of log records more accurately represents object requests made by client computers than the initial sequence of log records in the log file. Usage metering and analysis procedures utilized the supplemented sequence of log records to generate analysis reports indicative of object request patterns by the client computers.

Claims

1. In a distributed computer system including client computers that request and receive object data structures (objects) from a server computer, said distributed computer system including at least one computer that includes a cache for temporary caching copies of objects stored on said server computer, a log file processing subsystem associated with the server computer, comprising:

a log file, stored in memory on said server computer, containing log records, each log record representing an object request by one of said client computers, said log record including data identifying the requested object and data associated with said client computer or a gateway within said distributed computer system through which said client computer requested said object;

log expansion means for analyzing said log records to detect object request patterns indicating that object requests not represented by said log records were satisfied by cached object copies, and for supplementing said log records with inserted log records representing object requests for specified objects corresponding to said cached object copies;

wherein said supplemented log records more accurately represent object requests made by said client computers for objects stored on said server computer than said log records prior to said supplementing with inserted log is records; and

usage metering and analysis means for generating analysis reports indicative of object request patterns by said client computers.

2. The log file processing subsystem of claim 1,

said log expansion means including means for assigning session identifiers to each said log record so as to group log records into a plurality of pseudo-client sessions, each pseudo-client session being represented by a subset of the log records in said log records, and session supplementing means for detecting when log records are missing from said pseudo-client sessions and for supplementing said log records with log records representing additional object requests so as to create pseudo-client sessions each having a logical sequence of object requests.

3. The log file processing subsystem of claim 1,

said log expansion means including means for assigning session identifiers to each said log record so as to group log records into a plurality of pseudo-client sessions, each pseudo-client session being represented by a subset of the log records in said log records, and session supplementing means for detecting when log records associated with requests for entry point objects normally requested at the beginning of most client sessions are missing from said pseudo-client sessions and for supplementing said log records with log records representing additional object requests for said entry point objects.

4. The log file processing subsystem of claim 1,

said log expansion means including:

session identifying means for assigning session identifiers to each said log record so as to group log records into a plurality of pseudo-client sessions, each pseudo-client session being represented by a subset of the log records in said log records;

a reference object request profile indicative of relative object request rates for at least a subset of the client accessible objects stored on said server computer;

means for generating current object request frequency data based on the objects referenced by said supplemented log records; and

session supplementing means, enabled when said current object request frequency data differs from said reference object request profile by more than a threshold amount, for detecting when log records associated with requests for entry point objects normally requested at the beginning of most client sessions are missing from said pseudo-client sessions and for supplementing said log records with log records representing additional object requests for said entry point objects.

5. The log file processing subsystem of claim 1,

said log expansion means including

a first object request profile indicative of relative object request rates for at least a subset of the client accessible objects stored on said server computer;

and

means for generating current object request frequency data based on the objects referenced by said supplemented log records, for comparing said current object request frequency data with said first object request profile, and for inserting additional log records representing entirely synthesized pseudo-client sessions which request objects under represented by said current object request frequency data when said current object request frequency data differs from said first object request profile by more than a threshold amount.

6. The log file processing subsystem of claim 5,

said log expansion means Including means for generating an expanded log file that stores said supplemented log records;

said usage metering and analysis means generating analysis reports based on said supplemented log records stored in said expanded log file.

7. In a distributed computer system including client computers that request and receive object data structures (objects) from a server computer, said distributed computer system including at least one computer that includes a cache for temporarily caching copies of objects stored on said server computer, a method for processing and supplementing a log file, comprising the steps of:

storing said log file in memory on said server computer, said log file containing log records, each log record representing an object request by one of said client computers, said log record including data identifying the requested object and data associated with said client computer or a gateway within said distributed computer system through which said client computer requested said object;

analyzing said log records to detect object request patterns indicating that object requests not represented by said log records were satisfied by cached object copies, and supplementing said log records with inserted log records representing object requests for specified objects corresponding to said cached object copies;

wherein said supplemented log records more accurately represent object requests made by said client computers for objects stored on said server computer than said log records prior to said supplementing with inserted log records; and

gathering analysis reports, based on said supplemented log records, indicative of object request patterns by said client computers.

8. The method of claim 7, including:

assigning session identifiers to each said log record so as to group log records into a plurality of pseudo-client sessions, each pseudo-client session being represented by a subset of the log records in said log records, detecting when log records are missing from said pseudo-client sessions, and supplementing said log records with log records representing additional object requests so as to create pseudo-client sessions each having a logical sequence of object requests.

9. The method of claim 7, including:

assigning session identifiers to each said log record so as to group log records into a plurality of pseudo-client sessions, each pseudo-client session being represented by a subset of the log records in said log records, detecting when log records associated with requests for entry point objects normally requested at the beginning of most client sessions are missing from said pseudo-client sessions, and supplementing said log records with log records representing additional object requests for said entry point objects.

10. The method of claim 7, including:

assigning session identifiers to each said log record so as to group log records into a plurality of pseudo-client sessions, each pseudo-client session being represented by a subset of the log records in said log records;

storing a reference object request profile indicative of relative object request rates for at least a subset of the client accessible objects stored on said server computer;

generating current object request frequency data based on the objects referenced by said supplemented log records; and

when said current object request frequency data differs from said reference object request profile by more than a threshold amount, detecting whether log records associated with requests for entry point objects normally requested at the beginning of most client sessions are missing from said pseudo-client sessions and supplementing said log records with log records representing additional object requests for said entry point objects.

11. The method of claim 7, including:

storing a reference object request profile indicative of relative object request rates for at least a subset of the client accessible objects stored on said server computer;

generating current object request frequency data based on the objects referenced by said supplemented log records;

comparing said current object request frequency data with said first object request profile, and inserting additional log records representing entirely synthesized pseudo-client sessions which request objects under represented by said current object request frequency data when said current object request frequency data differs from said first object request profile by more than a threshold amount.

12. The method of claim 7, including:

generating an expanded log file that stores said supplemented log records; and

said step of generating analysis reports utilizing said supplemented log records stored in said expanded log file when generating said analysis reports.

13. A computer readable medium having computer-readable instructions for performing the steps in the method of claim 7.

14. In a distributed computer system including client computers that request and receive object data structures (objects) from a server computer, a log file processing subsystem comprising:

a log file, stored in memory accessible by the server computer, containing log records, each log record representing an object request from one of the client computers; and

a log file expansion module executable on the server computer to analyze the log records for possible object request patterns which indicate that certain object requests are not represented by the log records, the log file expansion module supplementing the log records with inserted log records representing the certain object requests to create an expanded log file.

15. The log file processing subsystem of claim 14, further comprising a usage metering module executable on the server computer to generate analysis reports using the expanded log file.

16. The log file processing subsystem of claim 14, wherein the distributed computer system includes at least one computer with a cache for temporarily caching copies of objects stored on said server computer, the log file expansion module detecting object request patterns indicating that object requests not represented by said log records were satisfied by cached object copies stored on the one computer.

17. The log file processing subsystem of claim 14, wherein the log file expansion module groups log records from the log file into pseudo-client sessions and supplements individual pseudo-client sessions with additional log records so that the pseudo-client session has a logical sequence of object requests.

18. The log file processing subsystem of claim 14, wherein the log file expansion module groups log records from the log file into pseudo-client sessions and detects, for individual pseudo-client sessions, whether certain log records representing entry point objects normally requested at the beginning of client sessions are missing from the individual pseudo-client session and if so, supplementing the individual pseudo-client session with additional log records that represent the entry point objects.

19. The log file processing subsystem of claim 14, wherein the log file expansion module only supplements the log records if the current frequency of object requests at the server computer differs from a reference object request profile, which is indicative of relative object request rates for at least a subset of the client accessible objects stored on said server computer, by greater than a threshold amount.

20. For use in a server computer that serves object data structures (objects) to one or more client computers, wherein the server computer maintains a log file with log records and each log record represents an object request from one of the client computers, a log file processing program embodiment a computer-readable medium, comprising:

a code segment to analyze the log records to detect object request patterns which indicate that certain object requests are not represented by the log records; and

a code segment to supplement the log records with inserted log records representing the certain object requests.

21. The log file processing program of claim 20, further comprising a code segment to generate analysis reports using the supplemented log records.

22. The log file processing program of claim 20, wherein the distributed computer system includes at least one computer with a cache for temporarily caching copies of objects stored on said server computer, the log file processing program further comprising:

a code segment to detect object request patterns indicating that object requests not represented by said log records were satisfied by cached object copies stored on the one computer.

23. The log file processing program of claim 20, further comprising a code segment to group log records from the log file into pseudo-client sessions.

24. The log file processing program of claim 23, farther comprising a code segment to supplement a pseudo-client session with additional log records so that the pseudo-client session has a logical sequence of object requests.

25. The log file processing program of claim 23, further comprising:

a code segment to detect, for a pseudo-client session, whether certain log records representing entry point objects normally requested at the beginning of most client sessions are missing from the pseudo-client session; and

a code segment to supplement the pseudo-client session with the certain log records that represent the entry point objects in the event that the certain log records are missing.

26. The log file processing program of claim 20, farther comprising a code segment to determine if a current frequency of object requests at the server computer differs from a reference object request profile, which is indicative of relative object request rates for at least a subset of the client accessible objects stored on said server computer, by greater than a threshold amount.

27. In a distributed computer system including client computers that request and receive object data structures (objects) from a server computer, and wherein the server computer maintains a log file with log records that represent object requests from the client computers, a method for processing and supplementing a log file comprising the following steps:

analyzing the log records in the log file to detect object request patterns which indicate that certain object requests are not represented by the log records; and

expanding the log file with inserted log records representing the certain object requests.

28. The method of claim 27, further comprising the step of generating analysis reports using the expanded log file.

29. The method of claim 27, wherein the distributed computer system includes at least one computer with a cache for temporarily caching copies of objects stored on said server computer, the method further comprising the step of detecting object request patterns indicating that object requests not represented by said log records were satisfied by cached object copies stored on the one computer.

30. The method of claim 27, further comprising the step of grouping log records from the log file into pseudo-client sessions.

31. The method of claim 27, further comprising the step of supplementing a pseudo-client session with additional log records so that the pseudo-client session has a logical sequence of object requests.

32. The method of claim 27, further comprising the following steps:

detecting, for a pseudo-client session, whether certain log records representing entry point objects normally requested at the beginning of most client sessions are missing from the pseudo-client session; and

supplementing the pseudo-client session with the certain log records that represent the entry point objects in the event that the certain log records are missing.

33. The method of claim 27, further comprising the step of determining if a current frequency of object requests at the server computer differs from a reference object request profile, which is indicative of relative object request rates for at least a subset of the client accessible objects stored on said server computer, by greater than a threshold amount.

34. A computer readable medium having computer-readable instructions for performing the steps in the method of claim 27.