Extensible event-driven log analysis framework

• US 8,832,125 B2
• Filed: 06/14/2010
• Issued: 09/09/2014
• Est. Priority Date: 06/14/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Boctor, Victor William Habib
• Primary Examiner(s): LE, DEBBIE M
• Application Number:
  US12/814,495
• Publication Number:
  US 20110307502A1
• Time in Patent Office: 1,548 Days
• Field of Search: 707/754, 707/793, 707/804, 707/758
• US Class Current: 707/758
• CPC Class Codes: G06F 8/37 Compiler construction; Parser generation

Abstract

A log analysis framework is provided that includes a core that is configured to support the execution of one or more extensions and one or more analyzers. The core provides a common infrastructure, base classes, and utilities for supporting the execution of the extensions and the analyzers. Extensions are software components configured to parse a log file and to trigger events based upon the contents of the log file. Analyzers are executable software components configured to consume events generated by the extensions, to analyze the events, and to generate a report based on the events.

Claims

1. A computer-implemented method for providing a log analysis framework, the method comprising performing computer implemented operations for:

executing a log analysis framework extension, the log analysis framework extension configured to parse a log file and to trigger one or more events based upon the contents of the log file;

compiling a log analysis framework analyzer at a runtime of the log analysis framework analyzer;

providing a log analysis framework core configured to support the execution of the analysis framework extension and the log analysis framework analyzer; and

executing the log analysis framework analyzer, the log analysis framework analyzer configured to consume the events triggered by the log analysis framework extension and to generate one or more reports based upon the events.

2. The computer-implemented method of claim 1, further comprising providing one log analysis framework extension per type of log file.

3. The computer-implemented method of claim 1, further comprising providing a plurality of analyzers per extension.

4. The computer-implemented method of claim 2, further comprising providing the report to a graphing engine.

5. The computer-implemented method of claim 2, further comprising providing the report to a parsing engine, to another analyzer, or to another analysis framework.

6. The computer-implemented method of claim 5, wherein the framework can be executed as a standalone tool or hosted within an application program.

7. The computer-implemented method of claim 1, wherein the log analysis framework core is configured to detect the log analysis framework extensions at a runtime of the log analysis framework core.

8. The computer-implemented method of claim 7, wherein the log analysis framework analyzer is configured to process one or more log files generated by a plurality of computing systems and wherein events are triggered from the one or more log files in chronological order.

9. The computer-implemented method of claim 8, wherein the log analysis framework analyzer is configured to process a plurality of log file types.

10. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

execute a log analysis framework core, the log analysis framework core configured to support the execution of one or more log analysis framework extensions and one or more log analysis framework analyzers;

execute a log analysis framework extension, the log analysis framework extension configured to parse a log file and to trigger one or more events based upon the contents of the log file;

compile a log analysis framework analyzer at a runtime of the log analysis framework analyzer;

provide a log analysis framework core configured to support the execution of the analysis framework extension and the log analysis framework analyzer; and

to

execute a log analysis framework analyzer, the log analysis framework analyzer configured to consume the events triggered by the log analysis framework extension and to generate a report based upon the events.

11. The computer-readable medium of claim 10, wherein the log analysis framework analyzer is configured to process one or more log files generated by a plurality of computing systems.

12. The computer-readable medium of claim 10, wherein the log analysis framework analyzer is configured to process a plurality of log file types.

13. The computer-readable storage medium of claim 12, wherein the events comprise one or more arguments.

14. The computer-readable storage medium of claim 13, having further computer-executable instructions stored thereupon which, when executed by the computer, will cause the computer to provide the report to a graphing engine or a parsing engine.

15. A computer-implemented method for providing an extensible event-driven log analysis framework, the method comprising performing computer-implemented operations for:

providing a log analysis framework core configured to support the execution of one or more log analysis framework extensions and one or more log analysis framework analyzers;

executing a log analysis framework extension configured to parse a log file and to trigger one or more events based upon the contents of the log file;

compiling a log analysis framework analyzer at a run time of the log analysis framework analyzer; and

executing the compiled log analysis framework analyzer to consume the events triggered by the log analysis framework extension and to generate a report based upon the events.

16. The computer-implemented method of claim 15, wherein the log analysis framework analyzer is configured to process one or more log files generated by a plurality of computing systems and to process a plurality of log file types.

17. The computer-implemented method of claim 16, wherein the log analysis framework core is configured to detect the log analysis framework extensions at a runtime of the log analysis framework core.