Log file amnesia detection

• US 8,001,075 B2
• Filed: 06/01/2007
• Issued: 08/16/2011
• Est. Priority Date: 06/01/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Doty, John D, Critchley, Craig A
• Primary Examiner(s): Coby; Frantz
• Application Number:
  US11/756,974
• Publication Number:
  US 20080301200A1
• Time in Patent Office: 1,537 Days
• Field of Search: 707/609, 707/672, 707/674, 707/675, 707/685, 707/821, 707640-654, 714/4, 714/38
• US Class Current: 707/609
• CPC Class Codes: G06F 11/004 Error avoidance G06F11/07 and subgroups take precedence

Abstract

Log file amnesia detection is accomplished by associating a unique identifier with each record in a log file, where each record receives a unique log sequence number. Multiple time intervals are associated with the log file with different events triggering the beginning of a new time interval. The log file implementation marks the beginnings of these multiple time intervals with a unique identifier. Every time an event occurs that triggers a new time interval a new unique identifier is generated. This unique identifier will be associated with the records in the log file that are created thereafter until the next unique identifier gets generated, marking the beginning of a next time interval. Log file amnesia can be identified when a log client requests information about a record and then comparing the unique identifier and log sequence number of the record with all records in the log file.

Claims

1. A method for operation of a computer for detecting log file amnesia, the computer including a processor and a memory, a log file implementation and a log client running in the memory, the method comprising the steps of:

(a) creating by the log client implementation a log file and a first unique identifier indicating a first time interval for the log file, wherein the first unique identifier is appended to a first beginning interval record of the first time interval which marks the beginning of the first time interval;

(b) writing a first set of one or more records to the log file, wherein a first record of the one or more records is assigned a sequential log sequence, and wherein the first set of one or more records is associated with the first unique identifier;

(c) detecting by the log client implementation a first defined triggering event indicating a beginning of a next time interval for the log file, wherein the next time interval is used to record the writing of a next set of one or more records after writing the first set of one or more records;

(d) creating a next unique identifier indicating the next time interval for the log file, wherein the next unique identifier is appended to a second beginning interval record of the next time interval which marks the beginning of the next time interval;

(e) writing the next set of one or more records to the log file, wherein each of the one or more records is assigned the sequential log sequence number, and wherein the next set of one or more record is associated with a unique identifier;

(f) receiving a request from the log client for validation of a record, wherein the record received from the log client has a log sequence number and a unique identifier;

(g) comparing the log sequence number and the associated unique identifier for the record against the first unique identifier and the next unique identifier;

(h) when the match is found, returning an okay message; and

(i) when the match is not found, returning a log file amnesia message to the log client that indicates a missing set of one or more records written to the log file but no longer stored within the log file.

2. The method according to claim 1 wherein the creating step (a) and the creating step (d) each further comprise at least one of the steps of:

using an algorithm to generate a 16-byte (128-bit) globally unique identifier for the first unique identifier and the next unique identifier;

generating a 64-bit timestamp;

or

generating a 32-bit timestamp.

3. The method according to claim 1 wherein the detecting step (c) further comprises the step of:

detecting at least a one of a creation of the log file, a reset of the log file, a restoration of the log file from a backup, a writing of a record to the log file, computer reboot, or a second defined triggering event.

4. The method according to claim 1 further comprising the when the match is found, returning an okay message to the log client.

5. The method according to claim 1 further comprising the step of:

running the log file implementation from within an operating system of the computer.

6. The method according to claim 1 further comprising the step of:

running the log file implementation from within an application running in the memory of the computer.

7. The method according to claim 1 further comprising the step of:

running the log client from within an application running in the memory of the computer.

8. A computer system for detecting log file amnesia, the system comprising:

a processor;

a memory accessible by the processor;

a log file implementation running in the memory;

a log client running in the memory; and

a log file created by the log file implementation, wherein the log file has;

a first unique identifier indicating a first time interval for the log file, and a first set of one or more records, wherein a first beginning interval record of the one or more records is assigned a sequential log sequence number and is annotated with the first unique identifier;

a first defined triggering event;

when the first defined triggering event is detected by the log file implementation, a next unique identifier indicating a next time interval for the log file is appended to a second beginning interval record, and associated with a next set of one or more records, wherein the next time interval is used to record the writing of the next set of one or more records after writing the first set of one or more records, wherein each of the one or more records is assigned the sequential log sequence number and is associated with the next unique identifier, and wherein the next time interval is used to indicate that a next set of one or more records was created after the log file was restored from backup; and

a log file amnesia message, wherein the log client implementation receives requests from the log client for validation of one or more records, wherein each of the one or more records received from the log client has a log sequence number and a unique identifier, and the log client implementation compares the log sequence number and the unique identifier associated with each of the one or more records against the first set of one or more records and the next set of one or more records to determine if there is a match, and when the match is not found, the log client implementation returns the log file amnesia message to the log client that indicates a missing set of one or more records written to the log file but no longer stored within the log file.

9. The system according to claim 8 further comprising at least a one of:

an algorithm for generating a 16-byte (128-bit) globally unique identifier for the first unique identifier and the next unique identifier;

a software module for generating a 32-bit timestamp;

or

a software module for generating a 64-bit timestamp.

10. The system according to claim 8 wherein the defined triggering event is at least a one of a creation of the log file, a reset of the log file, a restoration of the log file from a backup, a writing of a record to the log file, computer reboot, or a second defined triggering event.

11. The system according to claim 8 further comprising:

an okay message, wherein when the match is found, the log client implementation returns the okay message to the log client.

12. The system according to claim 8 further comprising:

an operating system of the computer, wherein the log file implementation runs from within the operating system.

13. The system according to claim 8 further comprising:

an application running in the memory of the computer, wherein the log file implementation and the log client run from within the application.

14. A tangible computer readable storage medium storing instructions that, when executed by a processor, cause the processor to perform a method for detecting log file amnesia, the method comprising the steps of:

(a) creating a log file and a first unique identifier indicating a first time interval for the log file, wherein the first unique identifier is appended to a first beginning interval record of the first time interval which marks the beginning of the first time interval;

(b) writing a first set of one or more records to the log file, wherein a first record of the one or more records is assigned a sequential log sequence, and wherein the first set of one or more records is associated with the first unique identifier;

(c) detecting a first defined triggering event indicating a beginning of a next time interval for the log file, wherein the next time interval is used to record the writing of a next set of one or more records after writing the first set of one or more records;

(d) creating a next unique identifier indicating the next time interval for the log file, wherein the next unique identifier is appended to a second beginning interval record of the next time interval which marks the beginning of the next time interval;

(e) writing the next set of one or more records to the log file, wherein each of the one or more records is assigned the sequential log sequence number, and wherein the next set of one or more record is associated with a unique identifier;

(f) receiving a request for validation of a record, wherein the record received has a log sequence number and a unique identifier;

(g) comparing the log sequence number and the associated unique identifier for the record against the first unique identifier and the next unique identifier;

(h) when the match is found, returning an okay message; and

(i) when the match is not found, returning a log file amnesia message to the log client that indicates a missing set of one or more records written to the log file but no longer stored within the log file.

15. The computer readable storage medium according to claim 14 wherein the creating step (a) and the creating step (d) each further comprise at least one of the steps of:

using an algorithm to generate a 16-byte (128-bit) globally unique identifier for the first unique identifier and the next unique identifier;

generating a 64-bit timestamp;

or

generating a 32-bit timestamp.

16. The computer readable storage medium according to claim 14 wherein the detecting step (c) further comprises the step of:

detecting at least a one of a creation of the log file, a reset of the log file, a restoration of the log file from a backup, a writing of a record to the log file, computer reboot, or a second defined triggering event.

17. The computer readable storage medium according to claim 14 further comprising the step of:

when the match is found, returning an okay message to the log client.

18. The computer readable storage medium according to claim 14 further comprising the step of:

running the log file implementation from within an operating system of the computer.

19. The computer readable storage medium according to claim 14 further comprising the step of:

running the log file implementation from within an application running in the memory of the computer.

20. The computer readable storage medium according to claim 14 further comprising the step of:

running the log client from within an application running in the memory of the computer.

21. A method for operation of a computer for detecting log file amnesia, the computer including a processor and a memory, and a log file implementation and a log client running in the memory, the method comprising the steps of:

(a) creating by the log client implementation a log file and a first unique identifier indicating a first time interval for the log file, wherein the first unique identifier is stored in the memory;

(b) writing a first set of one or more records to the log file, wherein a first record of the one or more records is assigned a sequential log sequence number and a first of the one or more records is annotated with the first unique identifier forming a first begin interval record;

(c) detecting by the log client implementation a first defined triggering event indicating a beginning of a next time interval for the log file, wherein the next time interval is used to record the writing of a next set of one or more records after writing the first set of one or more records;

(d) creating a next unique identifier indicating the next time interval for the log file, wherein the next unique identifier is stored in the memory in place of the first unique identifier;

(e) writing the next set of one or more records to the log file, wherein each of the one or more records is assigned the sequential log sequence number and a first of the one or more records is annotated with the next unique identifier forming a next begin interval record;

(f) receiving a request from the log client for validation of a record, wherein the record received from the log client has a log sequence number;

(g) scanning the log file backward, beginning from the log sequence number for the record, until the first begin interval record or the next begin interval record is found;

(h) reading the first or next unique identifier from the first begin interval record or the next begin interval record found, forming a log sequence number/unique identifier pair for the record;

(i) comparing the log sequence number/unique identifier pair determined for the record against the first set of one or more records and the next set of the one or more records to determine if there is a match; and

(j) when the match is not found, returning a log file amnesia message to the log client that indicates a missing set of one or more records written to the log file but no longer stored within the log file.

22. The method according to claim 21 wherein the creating step (a) and the creating step (d) each further comprise at least one of the steps of:

using an algorithm to generate a 16-byte (118-bit) globally unique identifier for the first unique identifier and the next unique identifier;

generating a 64-bit timestamp;

or

generating a 32-bit timestamp.

23. The method according to claim 21 wherein the detecting step (c) further comprises the step of:

detecting at least a one of a creation of the log file, a reset of the log file, a restoration of the log file from a backup, a writing of a record to the log file, computer reboot, or a second defined triggering event.

24. The method according to claim 21 further comprising the step of:

when the match is found, returning an okay message to the log client.

25. A computer system for detecting log file amnesia, the system comprising:

a processor;

a memory accessible by the processor;

a log file implementation running in the memory;

a log client running in the memory; and

a log file created by the log file implementation, wherein the log file has;

a first unique identifier indicating a first time interval for the log file, wherein the first unique identifier is appended to a first beginning interval record of the first time interval which marks the beginning of the first time interval, and

a first set of one or more records, wherein each of the one or more records is assigned a sequential log sequence number and a first of the one or more records is annotated with said first unique identifier forming a first begin interval record, and said first unique identifier is stored in the memory;

a first defined triggering event;

when the first defined triggering event is detected by said log file implementation, a next unique identifier indicating a next time interval for said log file, and a next set of one or more records, wherein the next time interval is used to record the writing of the next set of one or more records after writing the first set of one or more records wherein each of the one or more records is assigned the sequential log sequence number and a first of the one or more records is annotated with the next unique identifier forming a next begin interval record, wherein the next unique identifier is stored in the memory in place of the first unique identifier; and

a log file amnesia message, wherein the log client implementation receives requests from the log client for validation of the one or more records, wherein each of the one or more records received from the log client has a log sequence number and a unique identifier obtained by scanning the log file backward, beginning from the log sequence number for the record, until the first begin interval record or the next begin interval record is found, forming a log sequence number/unique identifier pair for the one or more records, and the log client implementation compares the log sequence number/unique identifier pair for each of the one or more records against the first set of one or more records and the next set of one or more records to determine if there is a match, and when the match is not found, the log client implementation returns the log file amnesia message to the log client that indicates a missing set of one or more records written to the log file but no longer stored within the log file.

26. The system according to claim 25 further comprising at least a one of:

an algorithm for generating a 16-byte (128-bit) globally unique identifier for the first unique identifier and the next unique identifier;

a software module for generating a 32-bit timestamp;

or

a software module for generating a 64-bit timestamp.

27. The system according to claim 25 wherein the defined triggering event is at least a one of a creation of the log file, a reset of the log file, a restoration of the log file from a backup, a writing of a record to the log file, computer reboot, or a second defined triggering event.

28. The system according to claim 25 further comprising:

an okay message, wherein when the match is found, the log client implementation returns the okay message to the log client.

29. A tangible computer readable storage medium storing instructions that, when executed by a processor, cause the processor to perform a method for detecting log file amnesia, the method comprising the steps of:

(a) creating a log file and a first unique identifier indicating a first time interval for the log file, wherein the first unique identifier is stored in the memory;

(b) writing a first set of one or more records to the log file, wherein a first record of the one or more records is assigned a sequential log sequence number and a first of the one or more records is annotated with the first unique identifier forming a first begin interval record;

(c) detecting a defined triggering event indicating a beginning of a next time interval for the log file, wherein the next time interval is used to record the writing of a next set of one or more records after writing the first set of one or more records;

(d) creating a next unique identifier indicating the next time interval for the log file, wherein the next unique identifier is stored in the memory in place of the first unique identifier;

(e) writing the next set of one or more records to the log file, wherein each of the one or more records is assigned the sequential log sequence number and a first of the one or more records is annotated with the next unique identifier forming a next begin interval record;

(f) receiving a request for validation of a record, wherein the record received has a log sequence number;

(g) scanning the log file backward, beginning from the log sequence number for the record, until the first begin interval record or the next begin interval record is found;

(h) reading the first or next unique identifier from the first begin interval record or the next begin interval record found, forming a log sequence number/unique identifier pair for the record;

(i) comparing the log sequence number/unique identifier pair determined for the record against the first set of one or more records and the next set of one or more records to determine if there is a match; and

(j) when the match is not found, returning a log file amnesia message to the log client that indicates a missing set of one or more records written to the log file but no longer stored within the log file.

30. The computer readable storage medium according to claim 29 wherein the creating step (a) and the creating step (d) each further comprise at least one of the steps of:

using an algorithm to generate a 16-byte (128-bit) globally unique identifier for the first unique identifier and the next unique identifier;

generating a 64-bit timestamp;

or

generating a 32-bit timestamp.

31. The computer readable storage medium according to claim 29 wherein the detecting step (c) further comprises the step of:

detecting at least a one of a creation of the log file, a reset of the log file, a restoration of the log file from a backup, a writing of a record to the log file, computer reboot, or a second defined triggering event.

32. The computer readable storage medium according to claim 29 further comprising the step of:

when the match is found, returning an okay message to the log client.