Message descriptions

• US 8,386,498 B2
• Filed: 08/05/2009
• Issued: 02/26/2013
• Est. Priority Date: 08/05/2009
• Status: Active Grant

• Current Assignee: Cloud Software Group
• Original Assignee: Loglogic (Cloud Software Group)
• Inventors: Whitehouse, Sanford
• Primary Examiner(s): Perveen, Rehana
• Assistant Examiner(s): BUI, THUY T
• Application Number:
  US12/536,444
• Publication Number:
  US 20110035390A1
• Time in Patent Office: 1,301 Days
• Field of Search: 707/741, 707/755, 707/756
• US Class Current: 707/755
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Messages (e.g., log messages or any form of record oriented data) are analyzed for identifiable value patterns. When a pattern is located the value is replaced by a name or “token” for the pattern, resulting in a “message description” for the message. When analysis is finished and token/value replacements are complete the message description can be stored as a reference to the message.

Claims

1. A computer-implemented method, comprising:

receiving a first message, the first message comprising a structure that includes a value and a context of the value;

searching the first message using a value pattern, the value pattern including a string pattern of the value and being different from the structure;

generating a first message description for the first message, wherein generating the first message description comprises;

identify the value from the first message that matches the value pattern;

generating a token, the token including a named string for the value; and

generating the first message description using the structure in the first message in which the token replaces the value, the first message description comprising the structure of the first message, wherein in the first message description, the token is placed in the context of the value according to the structure in the first message; and

storing the first message description as a reference to the first message.

2. The method of claim 1, where the searching is grammar independent such that the first message description is operable to describe messages from different vendors or products.

3. The method of claim 1, where the first message description is operable to describe all messages in a message set.

4. The method of claim 1, where the first message is formatted as one or more lines of text, structured data or binary data.

5. The method of claim 1, where the first message description includes a relationship of the first message to its values.

6. The method of claim 1, where the first message description includes a relationship between the first message and a second message.

7. The method of claim 1, further comprising:

constructing a parsing or mapping rule that supports the first message description for the first message; and

applying the parsing rule to a second message.

8. The method of claim 1, further comprising:

correcting the first message description; and

creating a second message description using the corrected first message description.

9. The method of claim 1, further comprising:

generating a report using the first message description.

10. The method of claim 1, further comprising:

searching a log message database using the first message description.

11. A message management system, comprising:

at least one computing device, wherein the computer device has a processor and a memory;

an interface coupled to a message collector for receiving a first message, the first message comprising a structure that includes a value and a context of the value; and

a message description system coupled to the interface, the message description system configured for;

searching the first message using a value pattern, the value pattern including a string pattern of the value and being different from the structure;

generating a first message description for the first message, wherein generating the first message description comprises;

identify the value from the first message that matches the value pattern;

generating a token, the token including a named string for the value; and

generating the first message description using the structure in the first message in which the token replaces the value, the first message description comprising the structure of the first message, wherein in the first message description, the token is placed in the context of the value according to the structure in the first message; and

storing the first message description as a reference to the first message.

12. The system of claim 11, where the searching is grammar independent such that the first message description is operable to describe messages from different vendors or products.

13. The system of claim 11, where the first message description is operable to describe all messages in a message set.

14. The system of claim 11, where the first message is formatted as one or more lines of text, structured data or binary data.

15. The system of claim 11, where the first message description includes a relationship of the first message to its values.

16. The system of claim 11, where the first message description includes a relationship between the first message and a second message.

17. The system of claim 11, where the message description system is configured for:

constructing a parsing or mapping rule that support the first message description; and

applying the parsing or mapping rule to a second message.

18. The system of claim 11, where the message description system is configured for:

correcting the first message description; and

creating a second message description using the corrected first message description.

19. The system of claim 11, further comprising:

a reporting engine configured for generating reports using the first message description.

20. The system of claim 11, further comprising:

a search engine configured for searching a log message database using the first message description.

21. A non-transitory computer storage device storing instructions operable to cause one or more computer processors to perform operations comprising:

receiving a first message, the first message comprising a structure that includes a value and a context of the value;

searching the first message using a value pattern, the value pattern including a string pattern of the value and being different from the structure;

generating a first message description for the first message, wherein generating the first message description comprises;

identify the value from the first message that matches the value pattern;

generating a token, the token including a named string for the value; and

generating the first message description using the structure in the first message in which the token replaces the value, the first message description comprising the structure of the first message, wherein in the first message description, the token is placed in the context of the value according to the structure in the first message; and

storing the first message description as a reference to the first message.