System and method for analyzing web-server log files

• US 6,317,787 B1
• Filed: 08/11/1998
• Issued: 11/13/2001
• Est. Priority Date: 08/11/1998
• Status: Expired due to Term

• Current Assignee: WebTrends Incorporated (WebTrends Holding, Inc.)
• Original Assignee: WebTrends Incorporated (WebTrends Holding, Inc.)
• Inventors: Shapira, Elijahu, Boyd, William Glen
• Primary Examiner(s): Meky, Moustafa M.
• Application Number:
  US09/132,287
• Time in Patent Office: 1,190 Days
• Field of Search: 709/224, 709/219, 709/225, 709/200, 709/203, 709/217, 709/218
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers

Abstract

A method for analyzing traffic data generated by a plurality of web servers, which host a single web site. The site is mirrored on each server. A traffic data hit is generated responsive to each access of one of the servers. The hit includes data representing the time of the access. Each data hit is stored in a log file on the server accessed. The first-stored data hit is read from each server. Each of the read data hits are compared, and the oldest data hit is passed to a log file analyzer. The next-stored data hit is read from the server from which the passed data hit was read, and a second comparison is performed on the read data hits, with the oldest data hit being passed to the log file analyzer. This process continues until all of the data hits are read, compared, and passed to the log file analyzer. This results in passing all of the data hits to the log file analyzer in the chronological order in which the hits were generated.

Claims

1. A method for analyzing traffic data generated by a plurality of web servers connected via a network to a plurality of computing devices comprising:

(a) generating a plurality of traffic data hits, each of said hits corresponding to a data packet exchanged between one of the servers and one of the computing devices;

(b) associating the data hits with their respective servers;

(c) reading a first data hit from each server;

(d) comparing the read data hits;

(e) passing the oldest data hit;

(f) reading the next data hit from the server from which the passed data hit was read;

(g) repeating (d) through (e) until all of the data hits are read; and

(h) analyzing the passed data hits.

2. The method of claim 1 wherein (b) and (c) are performed substantially simultaneously.

3. The method of claim 2 wherein associating the data hits with their respective servers comprises storing each data hit in a log file on its associated server, said traffic data hits being generated in chronological sequence, and wherein different ones of said log files contain data hits corresponding to traffic data hits generated in the same time period.

4. The method of claim 2 wherein said web servers mirror one another.

5. The method of claim 1 wherein (b) is entirely performed prior to (c).

6. The method of claim 5 wherein associating the data hits with their respective servers comprises storing each data hit in a log file on its associated server, said traffic data hits being generated in chronological sequence, and wherein different ones of said log files contain data hits corresponding to traffic data hits generated in the same time period.

7. The method of claim 5 wherein said web servers mirror one another.

8. The method of claim 1 wherein said web servers mirror one another.

9. The method of claim 1 wherein associating the data hits with their respective servers comprises storing each data hit in a log file on its associated server.

10. The method of claim 9 wherein said traffic data hits are generated in chronological sequence and wherein different ones of said log files contain data hits corresponding to traffic data hits generated in the same time period.

11. A method for analyzing log files containing a plurality of data hits in sequence, each of which corresponds to a traffic data hit generated by a web server, said method comprising:

(a) selecting the first data hit in each log file;

(b) comparing the selected data hits;

(c) passing the oldest of the selected data hits to a log file analyzer;

(d) selecting the next data hit in the log file in which the passed data hit was selected; and

(e) repeating steps (b) through (d) until all of the data hits in the log files are passed.

12. The method of claim 11 wherein said data hits are each associated with a unique time and wherein the last record in one file is associated with a time later than the first record in another file.

13. The method of claim 12 wherein one of said log files is generated by a first web server and wherein another of said log files is generated by a second web server.

14. The method of claim 11 wherein said log files are each associated with a unique time period and wherein the time for each data hit is within the period for its log file.

15. The method of claim 11 wherein one of said log files is generated by a first web server and wherein another of said log files is generated by a second web server.

16. A method for analyzing web-server log files comprising:

generating traffic data hits representing actions on the web server;

generating a data hit associated with each traffic data hit, each data hit being associated with a unique time;

storing the data hits in a plurality of log files;

sorting data hits from a plurality of the log files into chronological order; and

analyzing the sorted data hits.

17. The method of claim 16 wherein storing the data hits in sequence in a plurality of log files comprises alternating storing the data hits into different log files.

18. The method of claim 17 wherein the data hits within each log file are stored in sequence.

19. The method of claim 18 wherein sorting data hits from a plurality of the log files into chronological order comprises:

(a) selecting the first data hit in each log file;

(b) comparing the selected data hits;

(c) passing the oldest of the selected data hits to a log file analyzer;

(d) selecting the next data hit in the log file in which the passed data hit was selected; and

(e) repeating (b) through (d) until all of the data hits in the log files are passed.

20. The method of claim 19 wherein storing the data hits in a plurality of log files and sorting data hits from a plurality of log files into chronological order are performed substantially simultaneously.

21. The method of claim 19 wherein storing the data hits in a plurality of log files is performed prior to sorting data hits from a plurality of log files into chronological order.

22. A system for analyzing web-server log files comprising:

a source of traffic data hits generated by a web server;

each of said data hits being associated with a unique time;

a log file containing the data hits in sequence;

a sorter for sorting the data hits from a plurality of the log files into chronological order; and

an analyzer for analyzing the sorted data hits.

23. The system of claim 22 wherein said sorter comprises:

means for selecting a data hit in each log file;

means for comparing the selected data hits; and

means for passing the oldest of the selected data hits to the analyzer.