Managing log entries

• US 8,533,193 B2
• Filed: 11/17/2010
• Issued: 09/10/2013
• Est. Priority Date: 11/17/2010
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Hubbard, Eric
• Primary Examiner(s): PYO, MONICA M
• Application Number:
  US12/948,549
• Publication Number:
  US 20120124047A1
• Time in Patent Office: 1,028 Days
• Field of Search: 707/737, 707999002-999005, 709/224
• US Class Current: 707/737
• CPC Class Codes: G06F 16/332 Query formulation

Abstract

Example methods, apparatus, and articles of manufacture to manage log entries are disclosed. A disclosed example method involves grouping first log entries into a first group based on a matching portion among the first log entries. The example method also involves identifying a non-matching portion of the first log entries and associating an identifier with the non-matching portion. A processor is operated to generate a text string template comprising the identifier and the at least one matching portion in a human-readable format. The identifier replaces the non-matching portion in the template.

Claims

1. A method to manage log entries, the method comprising:

grouping first log entries into a first group based on a matching portion among the first log entries;

identifying a non-matching portion of the first log entries;

associating an identifier with the non-matching portion;

generating, with a processor, a text string template comprising the identifier and the matching portion in a human-readable format, the identifier replacing the non-matching portion in the template;

providing the text string template via a user interface as a pre-generated template with a plurality of other pre-generated text string templates for selection by a user to search log entries;

receiving a user input specifying a selected variable definition for the identifier associated with the non-matching portion;

generating a search string based on the selected variable definition replacing the identifier in the text string template; and

selecting ones of the first log entries having text matching the entire search string.

2. The method as defined in claim 1, further comprising:

detecting a second log entry having a first portion matching the matching portion of the template; and

updating the template to reference the second log entry and the first log entries.

3. The method as defined in claim 2, wherein updating the template to reference the second log entry and the first log entries comprises associating a non-matching portion of the second log entry with the text string template.

4. The method as defined in claim 1, further comprising:

detecting a second non-matching portion among the first log entries; and

structuring the text string template to include a second identifier to replace the second non-matching portion in the template.

5. The method as defined in claim 1, wherein the non-matching portion is indicative of different network entities.

6. An apparatus to manage log entries, the apparatus comprising:

a user interface to;

receive a first user input to select a pre-generated text string template presented via the user interface with a plurality of other pre-generated text string templates for selection by a user to search log entries, the pre-generated text string template comprising a matching portion present in at least two of the previously stored log entries, and a non-matching portion corresponding to non-matching portions between the at least two previously stored log entries;

receive a second user input indicative of a definition for an identifier in the pre-generated text string template, the definition corresponding to one of the at least two previously stored log entries, the definition to replace the identifier of the pre-generated text string template to generate a search string that exactly matches with text of the one of the at least two previously stored log entries; and

receive a third user input indicative of metadata to be associated with the one of the at least two log entries; and

a processor to associate the metadata with the one of the at least two log entries.

7. The apparatus as defined in claim 6, wherein the user interface is to receive the text string template and the definition for the identifier via a search user interface, and the apparatus further comprising a log searcher to search a log source for an instance of a log entry that matches the text string template and the definition.

8. The apparatus as defined in claim 7, wherein the user interface is to present an instance of a matching log entry and the metadata for the matching log entry in response to finding the instance of the matching log entry.

9. The apparatus as defined in claim 6, wherein the non-matching portion corresponds to different network entities.

10. A tangible machine accessible storage device or disk comprising instructions that, when executed, cause a machine to at least:

group first log entries based on at least one matching portion and at least one variable portion among the first log entries;

associate an identifier with the at least one variable portion;

generate a text string template comprising the identifier and the at least one matching portion in a human-readable format, the identifier replacing the at least one variable portion in the template, and the template being in reference to the first log entries;

provide the text string template via a user interface as a pre-generated template with a plurality of other pre-generated text string templates for selection by a user to search log entries;

receive a user input specifying a selected variable definition for the identifier associated with the at least one variable portion;

generate a search string based on the selected variable definition replacing the identifier in the text string template; and

select ones of the first log entries having text matching the entire search string.

11. The tangible machine accessible storage device or disk as defined in claim 10, wherein the variable portion among the first log entries are indicative of different network entities.

12. The tangible machine accessible storage device or disk as defined in claim 10 having instructions stored thereon that, when executed, cause the machine to:

detect a match between the template and a second log entry based on the second log entry having a first portion matching the at least one matching portion of the first log entries; and

based on the detected match, update the text string template to further be in reference to the second log entry and the first log entries.

13. The tangible machine accessible storage device or disk as defined in claim 12 having instructions stored thereon that, when executed, cause the machine to update the text string template to further be in reference to the second log entry and the first log entries by associating the text string template with a variable portion of the second log entry.