Object oriented processing log analysis tool framework mechanism

• US 6,144,967 A
• Filed: 01/25/1996
• Issued: 11/07/2000
• Est. Priority Date: 01/25/1996
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nock, Clifton Malcolm
• Primary Examiner(s): Von Buhr, Maria N.
• Application Number:
  US08/591,893
• Time in Patent Office: 1,748 Days
• Field of Search: 707/103, 395/680, 395/682, 395/701, 395/704, 395/500.38, 717/1-4, 709/300-302
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: Y10S 707/99944 Object-oriented database structure

Abstract

A framework for use with object oriented programming systems encapsulates the common attributes of log analysis tools and permits framework implementers to generate customized log analysis tools that share a common structure and organization but are extended only in attributes that are specific to a particular tool. The framework defines a Log object that represents the activity log that is to be analyzed and is responsible for dividing itself into multiple, smaller LogSection objects. Each of the LogSection objects represents a portion of the activity log from which some information can be gathered. The information in a LogSection object is further mapped onto LogEvent objects. Each LogSection object can be referenced by an Analyzer object that controls the analysis.

Claims

1. A computer system comprising:

a central processing unit;

a user interface; and

a main memory having an operating system that supports an object-oriented programming environment containing a framework that provides an extensible log analysis tool system that receives a processing log having log entries, maps the log entries onto an object inheritance structure, analyzes the log entries, and produces a summary report of the analysis.

2. A computer system as defined in claim 1, wherein the framework defines an object oriented programming log class comprising a class of log sections that each include a set of log event objects corresponding to the log entries, an analyzer class having analyzer objects, and a plurality of object methods including a set of operations that are used by the log class to map the log entries onto the object inheritance structure, and a set of operations that are used by the analyzer objects to analyze the log event objects and produce the summary report.

3. A computer system as defined in claim 2, wherein the framework further defines a message specification class of objects that match the log entries with corresponding log event objects.

4. A computer system as defined in claim 3, wherein each of the objects in the message specification class parse the log entries into log event objects according to a different log class type.

5. A computer system as defined in claim 4, wherein the log class object passes each log entry to one of the message specification objects for matching with corresponding log event objects.

6. A computer system as defined in claim 3, wherein a message specification object creates log event objects that correspond to a beginning log section log entry.

7. A computer system as defined in claim 3, wherein a message specification object creates log event objects that correspond to an ending log section log entry.

8. A computer system as defined in claim 3, wherein the object operations include message specification operations that create a log event object in response to matching a log entry to a log event object type according to a log class object in which the message specification operation is contained.

9. A computer system as defined in claim 3, wherein the object operations include message specification operations that create a log event object that indicates an error entry was encountered in the processing log.

10. A computer system as defined in claim 2, wherein the object methods include operations that automatically perform a system action to provide notification of a condition requiring response.

11. A computer system as defined in claim 2, wherein the object methods include operations that create a beginning of log section log event object.

12. A computer system as defined in claim 2, wherein the object methods include operations that create an ending of log section log event object.

13. A computer system as defined in claim 2, wherein the framework further defines a composite analyzer class of objects that chain together more than one analyzer object.

14. A computer system as defined in claim 13, wherein each analyzer object performs analysis operations on a different type of log object.

15. A computer system as defined in claim 13, wherein the object methods include analysis operations such that each type of analyzer object includes analysis operations that perform analysis on the log event objects.

16. A computer system as defined in claim 15, wherein the object methods further include analysis operations such that the analysis operations of each type of analyzer object perform analysis by matching a log event object to a predetermined one of log event object types.

17. A computer system as defined in claim 13, wherein each analyzer object produces a summary of the analysis operation results of the analysis operations it contains.

18. A computer system as defined in claim 2, wherein the object methods include analysis operations that perform analysis on log event objects.

19. A computer system as defined in claim 18, wherein the analysis operations perform analysis by matching a log event object to a predetermined one of log event object types.

20. A computer system as defined in claim 2, wherein the object methods include summary operations that produce a summary of the analysis operation results.

21. An apparatus comprising:

a central processing unit;

a memory coupled to the central processing unit; and

an object oriented framework residing in the memory, the object oriented framework defining an object oriented programming log class comprising a class of log sections that each include a set of log event objects corresponding to the log entries, an analyzer class having analyzer objects, and a plurality of object methods including a set of operations that are used by the log class to map the log entries onto the object inheritance structure, and a set of operations that are used by the analyzer objects to analyze the log event objects and produce the summary report.

22. An object oriented framework as defined in claim 21, wherein the framework further defines a message specification class of objects that match the log entries with corresponding log event objects.

23. An object oriented framework as defined in claim 22, wherein each of the objects in the message specification class parse the log entries into log event objects according to a different log class type.

24. An object oriented framework as defined in claim 23, wherein the log class object passes each log entry to one of the message specification objects for matching with corresponding log event objects.

25. An object oriented framework as defined in claim 22, wherein a message specification object creates log event objects that correspond to a beginning log section log entry.

26. An object oriented framework as defined in claim 22, wherein a message specification object creates log event objects that correspond to an ending log section log entry.

27. An object oriented framework as defined in claim 22, wherein the object operations include message specification operations that create a log event object in response to matching a log entry to a log event object type according to a log class object in which the message specification operation is contained.

28. An object oriented framework as defined in claim 22, wherein the object operations include message specification operations that create a log event object that indicates an error entry was encountered in the processing log.

29. An object oriented framework as defined in claim 21, wherein the object methods include operations that automatically perform a system action to provide notification of a condition requiring response.

30. An object oriented framework as defined in claim 21, wherein the object methods include operations that create a beginning of log section log event object.

31. An object oriented framework as defined in claim 21, wherein the object methods include operations that create an ending of log section log event object.

32. An object oriented framework as defined in claim 21, wherein the framework further defines a composite analyzer class of objects that chain together more than one analyzer object.

33. An object oriented framework as defined in claim 32, wherein each analyzer object performs analysis operations on a different type of log object.

34. An object oriented framework as defined in claim 32, wherein the object methods include analysis operations such that each type of analyzer object includes analysis operations that perform analysis on the log event objects.

35. An object oriented framework as defined in claim 34, wherein the object methods further include analysis operations such that the analysis operations of each type of analyzer object perform analysis by matching a log event object to a predetermined one of log event object types.

36. An object oriented framework as defined in claim 32, wherein each analyzer object produces a summary of the analysis operation results of the analysis operations it contains.

37. An object oriented framework as defined in claim 21, wherein the object methods include analysis operations that perform analysis on log event objects.

38. An object oriented framework as defined in claim 37, wherein the analysis operations perform analysis by matching a log event object to a predetermined one of log event object types.

39. An object oriented framework as defined in claim 21, wherein the object methods include summary operations that produce a summary of the analysis operation results.

40. A program product for use in a computer system having an operating system that supports an object-oriented programming environment, the program product comprising:

a computer-recordable media; and

a framework recorded on the computer-recordable media, the framework providing an extensible log analysis tool system that receives a processing log having log entries, maps the log entries onto an object inheritance structure, analyzes the log entries, and produces a summary report of the analysis.

41. A program product as defined in claim 40, wherein the framework defines an object oriented programming log class comprising a class of log sections that each include a set of log event objects corresponding to the log entries, an analyzer class having analyzer objects, and a plurality of object methods including a set of operations that are used by the log class to map the log entries onto the object inheritance structure, and a set of operations that are used by the analyzer objects to analyze the log event objects and produce the summary report.

42. A program product as defined in claim 41, wherein the framework further defines a message specification class of objects that match the log entries with corresponding log event objects.

43. A program product as defined in claim 42, wherein each of the objects in the message specification class parse the log entries into log event objects according to a different log class type.

44. A program product as defined in claim 43, wherein the log class object passes each log entry to one of the message specification objects for matching with corresponding log event objects.

45. A program product as defined in claim 42, wherein a message specification object creates log event objects that correspond to a beginning log section log entry.

46. A program product as defined in claim 42, wherein a message specification object creates log event objects that correspond to an ending log section log entry.

47. A program product as defined in claim 42, wherein the object operations include message specification operations that create a log event object in response to matching a log entry to a log event object type according to a log class object in which the message specification operation is contained.

48. A program product as defined in claim 42, wherein the object operations include message specification operations that create a log event object that indicates an error entry was encountered in the processing log.

49. A program product as defined in claim 41, wherein the object methods include operations that automatically perform a system action to provide notification of a condition requiring response.

50. A program product as defined in claim 41, wherein the object methods include operations that create a beginning of log section log event object.

51. A program product as defined in claim 41, wherein the object methods include operations that create an ending of log section log event object.

52. A program product as defined in claim 41, wherein the framework further defines a composite analyzer class of objects that chain together more than one analyzer object.

53. A program product as defined in claim 52, wherein each analyzer object performs analysis operations on a different type of log object.

54. A program product as defined in claim 52, wherein the object methods include analysis operations such that each type of analyzer object includes analysis operations that perform analysis on the log event objects.

55. A program product as defined in claim 54, wherein the object methods further include analysis operations such that the analysis operations of each type of analyzer object perform analysis by matching a log event object to a predetermined one of log event object types.

56. A program product as defined in claim 52, wherein each analyzer object produces a summary of the analysis operation results of the analysis operations it contains.

57. A program product as defined in claim 41, wherein the object methods include analysis operations that perform analysis on log event objects.

58. A program product as defined in claim 57, wherein the analysis operations perform analysis by matching a log event object to a predetermined one of log event object types.

59. A program product as defined in claim 41, wherein the object methods include summary operations that produce a summary of the analysis operation results.

60. A program product comprising:

a computer-readable transmission media; and

a framework transmitted on the computer-readable transmission media, the framework providing an extensible log analysis tool system that receives a processing log having log entries, maps the log entries onto an object inheritance structure, analyzes the log entries, and produces a summary report of the analysis.

61. The program product of claim 60, wherein the framework defines an object oriented programming log class comprising a class of log sections that each include a set of log event objects corresponding to the log entries, an analyzer class having analyzer objects, a set of operations that are used by the log class to map the log entries onto the object inheritance structure, and a set of operations that are used by the analyzer objects to analyze the log event objects and produce the summary report.

62. The program product of claim 61, wherein the framework further defines a message specification class of objects that match the log entries with corresponding log event objects.

63. The program product of claim 62, wherein each of the objects in the message specification class parse the log entries into log event objects according to a different log class type.

64. The program product of claim 63, wherein the log class object passes each log entry to one of the message specification objects for matching with corresponding log event objects.

65. The program product of claim 62, wherein a message specification object creates log event objects that correspond to a beginning log section log entry.

66. The program product of claim 62, wherein a message specification object creates log event objects that correspond to an ending log section log entry.

67. The program product of claim 62, wherein the object operations include message specification operations that create a log event object in response to matching a log entry to a log event object type according to a log class object in which the message specification operation is contained.

68. The program product of claim 62, wherein the object operations include message specification operations that create a log event object that indicates an error entry was encountered in the processing log.

69. The program product of claim 61, wherein the object methods include operations that automatically perform a system action to provide notification of a condition requiring response.

70. The program product of claim 61, wherein the object methods include operations that create a beginning of log section log event object.

71. The program product of claim 61, wherein the object methods include operations that create an ending of log section log event object.

72. The program product of claim 61, wherein the framework further defines a composite analyzer class of objects that chain together more than one analyzer object.

73. The program product of claim 72, wherein each analyzer object performs analysis operations on a different type of log object.

74. The program product of claim 72, wherein the object methods include analysis operations such that each type of analyzer object includes analysis operations that perform analysis on log event objects for the corresponding log class type.

75. The program product of claim 74, wherein the object methods further include analysis operations such that the analysis operations of each type of analyzer object perform analysis by matching a log event object to a predetermined one of log event object types for the corresponding log class type.

76. The program product of claim 72, wherein each analyzer object produces a summary of the analysis operation results of the analysis operations it contains.

77. The program product of claim 61, wherein the object methods include analysis operations that perform analysis on log event objects.

78. The program product of claim 77, wherein the analysis operations perform analysis by matching a log event object to a predetermined one of log event object types.

79. The program product of claim 61, wherein the object methods include summary operations that produce a summary of the analysis operation results.

80. A method of providing a log analysis tool, the method comprising the steps of:

providing an object oriented framework that provides an extensible log analysis tool system that receives a processing log having log entries, maps the log entries onto an object inheritance structure, analyzes the log entries, and produces a summary report of the analysis; and

executing the object oriented framework on an apparatus.

81. A method as defined in claim 80, wherein the provided framework defines an object oriented programming log class comprising a class of log sections that each include a set of log event objects corresponding to the log entries, an analyzer class having analyzer objects, and a plurality of object methods including a set of operations that are used by the log class to map the log entries onto the object inheritance structure, and a set of operations that are used by the analyzer objects to analyze the log event objects and produce the summary report.

82. A method as defined in claim 81, wherein the framework further defines a message specification class of objects that match the log entries with corresponding log event objects.

83. A method as defined in claim 82, wherein each of the objects in the message specification class parse the log entries into log event objects according to a different log class type.

84. A method as defined in claim 83, wherein the log class object passes each log entry to one of the message specification objects for matching with corresponding log event objects.

85. A method as defined in claim 82, wherein a message specification object creates log event objects that correspond to a beginning log section log entry.

86. A method as defined in claim 82, wherein a message specification object creates log event objects that correspond to an ending log section log entry.

87. A method as defined in claim 82, wherein the object operations include message specification operations that create a log event object in response to matching a log entry to a log event object type according to a log class object in which the message specification operation is contained.

88. A method as defined in claim 82, wherein the object operations include message specification operations that create a log event object that indicates an error entry was encountered in the processing log.

89. A method as defined in claim 81, wherein the object methods include operations that automatically perform a system action to provide notification of a condition requiring response.

90. A method as defined in claim 81, wherein the object methods include operations that create a beginning of log section log event object.

91. A method as defined in claim 81, wherein the object methods include operations that create an ending of log section log event object.

92. A method as defined in claim 81, wherein the framework further defines a composite analyzer class of objects that chain together more than one analyzer object.

93. A method as defined in claim 92, wherein each analyzer object performs analysis operations on a different type of log object.

94. A method as defined in claim 92, wherein the object methods include analysis operations such that each type of analyzer object includes analysis operations that perform analysis on the log event objects.

95. A method as defined in claim 94, wherein the object methods further include analysis operations such that the analysis operations of each type of analyzer object perform analysis by matching a log event object to a predetermined one of log event object types.

96. A method as defined in claim 92, wherein each analyzer object produces a summary of the analysis operation results of the analysis operations it contains.

97. A method as defined in claim 81, wherein the object methods include analysis operations that perform analysis on log event objects.

98. A method as defined in claim 97, wherein the analysis operations perform analysis by matching a log event object to a predetermined one of log event object types.

99. A method as defined in claim 81, wherein the object methods include summary operations that produce a summary of the analysis operation results.