Analyzing log files

• US 7,822,850 B1
• Filed: 01/11/2008
• Issued: 10/26/2010
• Est. Priority Date: 01/11/2008
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Shah, Manish, Brikman, Yevgeniy, Gadatia, Harun, Palawat, Vipin, Antinori, Paul
• Primary Examiner(s): Tran; Philip B
• Application Number:
  US12/013,146
• Time in Patent Office: 1,019 Days
• Field of Search: 709/224, 709/223, 707/3, 707/100, 707/102, 707/999.03, 707/999.1, 707/999.102
• US Class Current: 709/224
• CPC Class Codes: G06F 16/84 Mapping; Conversion
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

Described in an example embodiment herein is a method for extracting values from a plurality of data fields from a log file using a grammar file. The plurality of data fields and a procedure for extracting values from the plurality of data fields are defined in the grammar file. Extracted values are analyzed and graphically represented.

Claims

1. A method comprising:

acquiring a grammar file, the grammar file comprising data for extracting values from a log file;

extracting values from a plurality of data fields from the log file using the grammar file;

analyzing the extracted values with a state machine; and

graphically representing the extracted values;

wherein the log file contains information corresponding to a communication between a first component and a second component;

wherein the communication comprises a plurality of message exchanges between the first component and the second component; and

wherein the values of the plurality of data fields of the log file correspond to the plurality of message exchanges.

2. The method of claim 1, wherein the grammar file is an Extensible Markup Language (XML) template.

3. The method of claim 2, wherein the plurality of data fields and a procedure for extracting the values from the plurality of the data fields are defined in a Log Description Language (LDL).

4. The method of claim 1 wherein:

the grammar file identifies a data field as capable of being searched;

the grammar file defines a procedure for extracting a value from a data field identified as capable of being searched; and

the values extracted from the plurality of data fields are based on a specified search parameter.

5. The method of claim 4 comprising filtering the values extracted from the plurality of data fields based on a user specified filter parameter.

6. The method of claim 1, wherein the extracted values are analyzed using the state machine defined in State Chart Extensible Markup Language (SCXML), the finite state machine comprising:

a plurality of states;

a transition to indicate a change from one of the plurality of states to a second of the plurality of states;

an event to trigger the transition; and

a condition to determine occurrence of the event.

7. The method of claim 6, wherein analyzing the extracted data using the finite state machine comprises:

inputting the extracted values to the finite state machine;

obtaining a result from the finite state machine wherein the result comprises;

an initial state;

a final state; and

an event triggering a transition between the initial state and the final state; and

outputting the result.

8. The method of claim 1, wherein the graphical representation is a ladder diagram comprising:

a first vertical ladder member corresponding to the first component;

a second vertical ladder member corresponding to the second component; and

a plurality of ladder rungs extending between the first vertical ladder member to the second vertical ladder member, wherein the plurality of ladder rungs correspond to the plurality of message exchanges between the first component and the second component.

9. The method of claim 8, wherein:

the plurality of ladder rungs are represented in a plurality of colors corresponding to a plurality of message groups; and

the plurality of ladder rungs are represented in a plurality of styles corresponding to a plurality of message types.

10. The method of claim 1 further comprising:

extracting the values of a plurality of data fields from a second log file using a second grammar file; and

combining the values extracted from the second log file with the values extracted from the log file.

11. An apparatus comprising:

an extraction module to extract values from a plurality of data fields from a log file using a grammar file, wherein the plurality of data fields and a procedure for extracting the values of the plurality of data fields are defined in the grammar file;

an analyzing module to generate an analysis of the extracted values with a state machine; and

a graphing module to generate a graphical representation of the extracted values;

wherein the log file contains information corresponding to a communication between a first component and a second component;

wherein the communication comprises a plurality of message exchanges between the first component and the second component; and

wherein the values of the plurality of data fields of the log file correspond to the plurality of message exchanges.

12. The apparatus of claim 11, wherein the analyzing module uses a finite state machine, the finite state machine comprising:

a plurality of states defined in State Chart Extensible Markup Language (SCXML);

a transition defined in SCXML to indicate a change of states;

an event defined in Event Definition Language (EDL) to trigger the transition; and

a condition defined in Java Expression Language (JEXL) to determine the occurrence of the event.

13. The apparatus of claim 11, further comprising:

an extraction module to extract values of a plurality of data fields from a second log file using a second grammar file, wherein the plurality of data fields and a procedure for extracting the values of the plurality of data fields are defined in the second grammar file; and

a combining module to combine the extracted data from the log file with extracted data from a second log file.

14. The apparatus of claim 11, further comprising a search module to search the log file based on a user specified search parameter.

15. The apparatus of claim 11, further comprising a filter module to filter the extracted values based on a user specified filter parameter.

16. The apparatus of claim 11, wherein the message exchanges between the first component and the second component are Session Initiation Protocol (SIP) messages.

17. The apparatus of claim 11, wherein the graphical representation is a ladder diagram comprising:

a first vertical ladder member corresponding to a first component;

a second vertical ladder member corresponding to a second component; and

a plurality of ladder rungs extending between the first vertical ladder member to the second vertical ladder member, wherein the plurality of ladder rungs correspond to a plurality of message exchanges between the first component and the second component.

18. Logic encoded in one or more tangible, non-transitory computer readable media for execution and when executed operable to:

extract the values of a plurality of data fields from a log file using a grammar file, wherein the plurality of data fields and a procedure for extracting the values of the plurality of data fields are defined in the grammar file;

analyze the extracted values using a state machine; and

generate a graphical representation of the extracted values

wherein the log file contains information corresponding to a communication between a first component and a second component;

wherein the communication comprises a plurality of message exchanges between the first component and the second component; and

wherein the values of the plurality of data fields of the log file correspond to the plurality of message exchanges.