Table-based error log analysis

• US 6,598,179 B1
• Filed: 03/31/2000
• Issued: 07/22/2003
• Est. Priority Date: 03/31/2000
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Gewirtesman, Raanan, Erblich, Doron, Chirashnya, Igor
• Primary Examiner(s): Beausoliel, Robert
• Assistant Examiner(s): MCCARTHY, CHRISTOPHER S
• Application Number:
  US09/540,477
• Time in Patent Office: 1,208 Days
• Field of Search: 714/33, 714/37, 714/49, 714/26, 714/57, 714/45, 714/38
• US Class Current: 714/37
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

A method for diagnosing faults in a computer-based system. A log of errors of different kinds that have been recorded in the system is read, and errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system are selected from the log. The selected errors are filtered so as to compose one or more events, each event comprising one or more occurrences of one or more of the relevant kinds of the errors. The composed events are analyzed to reach an assessment that at least one of the predetermined types of faults has occurred.

Claims

1. A method for diagnosing faults in a computer-based system, comprising:

reading a log of errors of different kinds that have been recorded in the system;

selecting from the log errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system;

filtering the selected errors so as to compose one or more events, each event comprising one or more occurrences within a predetermined time frame of one or more of the relevant kinds of the errors; and

analyzing the composed events to reach an assessment that at least one of the predetermined types of faults has occurred.

2. A method according to claim 1, wherein selecting the errors comprises providing a respective callback function for each relevant kind of error, wherein the callback function analyzes data in the error log associated with the error in order to determine whether the error should be selected.

3. A method according to claim 1, wherein filtering the selected errors comprises filtering the errors according to filtering conditions specified in a filtering table, each filtering condition specifying a set of errors required in order to compose one of the events.

4. A method according to claim 3, wherein selecting the errors comprises selecting from the log those errors that are known to belong to the set of errors associated with one or more of the filtering conditions.

5. A method according to claim 3, wherein the set of errors required in order to compose one of the events comprises multiple occurrences of one of the kinds of errors.

6. A method according to claim 3, wherein the set of errors required in order to compose one of the events comprises one or more occurrences of each of a plurality of the kinds of errors.

7. A method according to claim 3, wherein the filtering table further specifies a level of severity for at least some of filtering conditions, and wherein filtering the selected errors comprises applying the filtering conditions to the errors in the error list in order of the level of severity of the conditions.

8. A method according to claim 1, wherein analyzing the composed events comprises assigning the events to event sets specified in an event sets table, wherein each event set is associated with at least one of the predetermined types of faults.

9. A method according to claim 1, wherein analyzing the composed events comprises outputting a message to a user with the assessment that one of the predetermined types of faults has occurred with a specified probability that the assessment is correct.

10. A method according to claim 9, wherein outputting the message comprises indicating a component of the system that should be replaced.

11. A method for diagnosing faults in a computer-based system, comprising:

reading a log of errors of different kinds that have been recorded in the system;

selecting from the log errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system;

filtering the selected errors so as to compose one or more events, each event comprising one or more occurrences of one or more of the relevant kinds of the errors; and

analyzing the composed events to reach an assessment that at least one of the predetermined types of faults has occurred,

wherein filtering the selected errors comprises filtering the errors according to filtering conditions specified in a filtering table, each filtering condition specifying a set of errors required in order to compose one of the events, and

wherein the set of errors comprises a plurality of the errors, and wherein the filtering condition specifies a maximum time lapse during which all of the plurality of the errors must occur in order for the condition to be satisfied.

12. A method for diagnosing faults in a computer-based system, comprising:

reading a log of errors of different kinds that have been recorded in the system;

selecting from the log errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system;

filtering the selected errors so as to compose one or more events, each event comprising one or more occurrences of one or more of the relevant kinds of the errors; and

analyzing the composed events to reach an assessment that at least one of the predetermined types of faults has occurred,

wherein filtering the selected errors comprises removing errors that have been used in composing one of the events from the error list, whereby any given error is not used to compose more than a single event.

13. A method according to claim 12, wherein removing the errors from the error list comprises removing both errors specified as being required to compose a given one of the events and errors specified as being associated with the given one of the events but not required to compose it.

14. A method for diagnosing faults in a computer-based system, comprising:

reading a log of errors of different kinds that have been recorded in the system;

selecting from the log errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system;

filtering the selected errors so as to compose one or more events, each event comprising one or more occurrences of one or more of the relevant kinds of the errors; and

analyzing the composed events to reach an assessment that at least one of the predetermined types of faults has occurred,

wherein analyzing the composed events comprises assigning the events to event sets specified in an event sets table, wherein each event set is associated with at least one of the predetermined types of faults, and

wherein the event sets table specifies a number of instances of one or more of the events that must occur within a given time frame in order for the event set to be complete, and wherein analyzing the composed events comprises reaching an assessment that the type of fault associated with a given one of the event sets has occurred if the event set is complete.

15. A method for diagnosing faults in a computer-based system, comprising:

reading a log of errors of different kinds that have been recorded in the system;

selecting from the log errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system;

filtering the selected errors so as to compose one or more events, each event comprising one or more occurrences of one or more of the relevant kinds of the errors; and

analyzing the composed events to reach an assessment that at least one of the predetermined types of faults has occurred,

wherein analyzing the composed events comprises outputting a message to a user with the assessment that one of the predetermined types of faults has occurred with a specified probability that the assessment is correct, and

wherein outputting the message comprises indicating two or more of the predetermined types of faults that may have occurred, each indicated type with a respective, specified probability.

16. A method for diagnosing faults in a computer-based system, comprising:

reading a log of errors of different kinds that have been recorded in the system;

selecting from the log errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system;

filtering the selected errors so as to compose one or more events, each event comprising one or more occurrences of one or more of the relevant kinds of the errors; and

analyzing the composed events to reach an assessment that at least one of the predetermined types of faults has occurred,

wherein analyzing the composed events comprises outputting a message to a user with the assessment that one of the predetermined types of faults has occurred with a specified probability that the assessment is correct, and

wherein reading the log of errors comprises reading the error log automatically at predetermined time intervals, and wherein outputting the message comprises reporting the assessment to the user automatically, responsive to reaching the assessment that the fault has occurred.

17. Apparatus for diagnosing faults in a computer-based system, comprising an error log processor, adapted to read a log of errors of different kinds that have been recorded in the system, to select from the log errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system, to filter the selected errors so as to compose one or more events, each event comprising one or more occurrences within a predetermined time frame of one or more of the relevant kinds of the errors, and to analyze the composed events to reach an assessment that at least one of the predetermined types of faults has occurred.

18. Apparatus according to claim 17, and comprising a storage device, in which the log of errors is recorded, wherein the error log processor is coupled to read the log from the storage device substantially automatically.

19. Apparatus according to claim 17, and comprising a memory, in which the processor stores one or more tables containing conditions according to which the error log is processed.

20. Apparatus according to claim 17, and comprising a display, wherein the processor is coupled to output a message to the display with the assessment that one of the predetermined types of faults has occurred along with a specified probability that the assessment is correct.

21. A computer program product for diagnosing faults in a computer-based system, the product comprising a computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to read a log of errors of different kinds that have been recorded in the system, to select from the log errors of those kinds that are relevant to one or more predetermined types of faults that can occur in the system, to filter the selected errors so as to compose one or more events, each event comprising one or more occurrences within a predetermined time frame of one or more of the relevant kinds of the errors, and to analyze the composed events to reach an assessment that at least one of the predetermined types of faults has occurred.

22. A product according to claim 21, the instructions further cause the computer to select the errors by calling a respective callback function for each relevant kind of error, wherein the callback function analyzes data in the error log associated with the error.

23. A product according to claim 21, wherein the instructions cause the computer to filter the errors according to filtering conditions specified in a filtering table, each filtering condition specifying a set of errors required in order to compose one of the events, and to analyze the events by assigning the events to event sets specified in an event sets table, wherein each event set is associated with at least one of the predetermined types of faults.

24. A product according to claim 21, wherein the instructions further cause the computer to output a message to a user with the assessment that one of the predetermined types of faults has occurred with a specified probability that the assessment is correct.