Distributed logging apparatus system and method

• US 7,734,961 B2
• Filed: 05/01/2007
• Issued: 06/08/2010
• Est. Priority Date: 05/01/2007
• Status: Active Grant

• Current Assignee: X Corp. (f/k/a Twitter, Inc.) (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Tran, An T., Taylor, Michael L., Almoustafa, Ahmed M., Palazzolo, Aaron S.
• Primary Examiner(s): Duncan; Marc
• Application Number:
  US11/743,015
• Publication Number:
  US 20080276130A1
• Time in Patent Office: 1,134 Days
• Field of Search: 714/47, 714/48
• US Class Current: 714/47.1
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

An apparatus, system, and method are disclosed for distributed logging. Operating entities and associations between operating entities are registered in a registry by a logging entity registrar. An event notification monitor recognizes operating errors in operating entities. An aggregation module aggregates operating logs from sets of associated entities, which are then stored by a log set recorder.

Claims

1. A computer program product comprising a computer readable medium having computer usable program code executable to perform operations for distributed log collection, the operations comprising:

registering a plurality of logging entities with a log aggregator, the log aggregator configured to store operating log data from the plurality of logging entities in a log data store;

defining logging entity associations for the plurality of logging entities;

receiving an error notification from a logging entity;

determining associated entities for the logging entity that caused the error notification; and

collecting an activity log set comprising activity data for only the logging entity that caused the error notification and for each logging entity associated with the logging entity that caused the error notification.

2. The computer program product of claim 1, wherein defining logging entity associations comprises determining hierarchical relationships between logging entities.

3. The computer program product of claim 1, wherein determining associated entities comprises accessing a list of associated entities.

4. The computer program product of claim 1, wherein collecting an activity log set comprises collecting log entries from entities in an entity group.

5. The computer program product of claim 1, wherein the operations further comprise an operation to store the activity log set.

6. A system for distributed log collection, the system comprising:

a processor;

a plurality of logging entities configured to log operating data;

a log aggregator;

a logging entity registrar that uses the processor to register the plurality of logging entities with the log aggregator, the log aggregator configured to store operating log data from the plurality of logging entities, the logging entity registrar defining logging entity associations for the plurality of logging entities;

a logging data store configured to store the operating log data;

a log collector configured to collect operating log data from the plurality logging entities;

a logging entity monitor configured to monitor the operating status of logging entities the logging entity monitor configured to receive an error notification from a logging entity; and

;

an aggregation module that determines entities associated with a logging entity that caused an error notification, the aggregation module receiving an activity log set comprising activity data for only the logging entity that caused the error notification and for each logging entity associated with the logging entity that caused the error notification.

7. The system of claim 6, wherein the logging data store is local to the log collector.

8. The system of claim 6, wherein the logging data store is external to the log collector.

9. The system of claim 6, wherein the logging collector is local to the logging entry monitor.

10. The system of claim 6, wherein the logging collector is external to the logging entry monitor.

11. An apparatus for distributed log collection, the apparatus comprising:

a logging entity registrar that uses a processor to register a plurality of logging entities with a log aggregator, the log aggregator configured to store operating log data from the plurality of logging entities in a log data store;

a logging entity registry configured to define logging entity associations for each of the plurality of logging entities;

a logging entity monitor configured to recognize operating error events in a logging entity, and

an aggregation module that determines entities associated with a logging entity that caused an error notification, the aggregation module receiving an activity log set comprising activity data for only the logging entity that caused the error notification and for each logging entity associated with the logging entity that caused the error notification.

12. The apparatus of claim 11, wherein the logging entity registry comprises at least one logging entity record, the logging entity record comprising a logging entity location, a log location, and an access protocol.

13. The apparatus of claim 12, wherein the logging entity monitor is configured to receive notification of operating error events.

14. The apparatus of claim 13, wherein the logging entity monitor is configured to identify operating error events in logging entities.