Methods and apparatus for creation of parsing rules
First Claim
1. A method of constructing one or more message parsing rules in accordance with a user and a machine, comprising the steps of:
- obtaining message data representing past messages, wherein the past messages contain management information for a network, an application, and a system being analyzed;
establishing an appropriate rule template for a message structure by scanning the message data, building a message skeleton, comparing previously generated rule templates to the message skeleton, providing potential rule template matches to the user for validation and choice of a selected rule template, determining whether the selected rule template contains enough information to identify individual messages, building a rule template through an iterative process between the user and the machine based on user selection of at least a portion of the message and designating the built rule template as a template to be used in the construction of one or more message parsing rules, when the selected rule template does not contain enough information, and designating the selected rule template as a template to be used in the construction of one or more message parsing rules; and
generating one or more message parsing rules by a process based on the obtained message data and the template to be used in the construction of one or more message parsing rules, and defining positive and negative examples in an unparseable message by the user, learning and creating possible rules covering positive examples at the machine, and adding a newly created rule to the one or more message parsing rules, wherein the one or more parsing rules are storable for access by a rule-based parsing system.
3 Assignments
0 Petitions
Accused Products
Abstract
Techniques for parsing rule creation are provided. A technique for constructing one or more message parsing rules may comprise the following steps. First, message data representing past messages, for example, associated with a network, an application and/or a system being analyzed, is obtained. For example, this may involve reading the past or historical message data from messages logs or having a system point to the message data in existing data storage. Parsing rules are then generated by a process from one or more existing rule templates and/or based on user selection and classification of at least a portion of a message. For example, the user may choose a message part and demonstratively classify the part, for example, as a positive or negative example. The generated rules may then be stored for access by a rule-based parsing system such as a message adaptation system. Prior to generation of the one or more parsing rules, a message structure may be established upon which generation of the rules may be based.
-
Citations
18 Claims
-
1. A method of constructing one or more message parsing rules in accordance with a user and a machine, comprising the steps of:
-
obtaining message data representing past messages, wherein the past messages contain management information for a network, an application, and a system being analyzed; establishing an appropriate rule template for a message structure by scanning the message data, building a message skeleton, comparing previously generated rule templates to the message skeleton, providing potential rule template matches to the user for validation and choice of a selected rule template, determining whether the selected rule template contains enough information to identify individual messages, building a rule template through an iterative process between the user and the machine based on user selection of at least a portion of the message and designating the built rule template as a template to be used in the construction of one or more message parsing rules, when the selected rule template does not contain enough information, and designating the selected rule template as a template to be used in the construction of one or more message parsing rules; and generating one or more message parsing rules by a process based on the obtained message data and the template to be used in the construction of one or more message parsing rules, and defining positive and negative examples in an unparseable message by the user, learning and creating possible rules covering positive examples at the machine, and adding a newly created rule to the one or more message parsing rules, wherein the one or more parsing rules are storable for access by a rule-based parsing system. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
-
-
14. Apparatus for constructing one or more message parsing rules, comprising:
-
a memory; and at least one machine-based processor coupled to the memory and operative to;
(i) obtain message data representing past messages, wherein the past messages contain management information for a network, an application, and a system being analyzed;
(ii) establish an appropriate rule template for a message structure by scanning the message data, building a message skeleton, comparing previously generated rule templates to the message skeleton, providing potential rule template matches to the user for validation and choice of a selected rule template, determining whether the selected rule template contains enough information to identify individual messages, building a rule template through an iterative process between the user and the machine based on user selection of at least a portion of the message and designating the built rule template as a template to be used in the construction of one or more message parsing rules, when the selected rule template does not contain enough information, and designating the selected rule template as a template to be used in the construction of one or more message parsing rules; and
(iii) generate one or more message parsing rules by a process based on the obtained message data and the template to be used in the construction of one or more message parsing rules, and defining positive and negative examples in an unparseable message by the user, learning and creating possible rules covering positive examples at the machine, and adding a newly created rule to the one or more message parsing rules, wherein the one or more parsing rules are storable for access by a rule-based parsing system. - View Dependent Claims (15, 16, 17)
-
-
18. An article of manufacture for constructing one or more message parsing rules in accordance with a user and a machine, comprising a machine readable storage medium containing one or more programs which when executed implement the steps of:
-
obtaining message data representing past messages, wherein the past messages contain management information for a network, an application, and a system being analyzed; establishing an appropriate rule template for a message structure by scanning the message data, building a message skeleton, comparing previously generated rule templates to the message skeleton, providing potential rule template matches to the user for validation and choice of a selected rule template, determining whether the selected rule template contains enough information to identify individual messages, building a rule template through an iterative process between the user and the machine based on user selection of at least a portion of the message and designating the built rule template as a template to be used in the construction of one or more message parsing rules, when the selected rule template does not contain enough information, and designating the selected rule template as a template to be used in the construction of one or more message parsing rules; and generating one or more message parsing rules by a process based on the obtained message data and the template to be used in the construction of one or more message parsing rules, and defining positive and negative examples in an unparseable message by the user, learning and creating possible rules covering positive examples at the machine, and adding a newly created rule to the one or more message parsing rules, wherein the one or more parsing rules are storable for access by a rule-based parsing system.
-
Specification