Providing relevant diagnostic information using ontology rules

• US 9,104,573 B1
• Filed: 09/16/2013
• Issued: 08/11/2015
• Est. Priority Date: 09/16/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Shanmugasundaram, Satishkumar Kothandapani, Kancharla, Venkatesh
• Primary Examiner(s): GUYTON, PHILIP A
• Application Number:
  US14/028,103
• Time in Patent Office: 694 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

Embodiments of methods, systems, and storage medium associated with providing diagnostic information are disclosed herein. In one instance, the method may include applying a pattern to a log line included in a log file accessible by the computing device, to determine whether there is a match between the log line and the pattern. The pattern may be one of a plurality of patterns included in a collection of previously accumulated diagnostic information including one or more relationship descriptions between the pattern and other ones of the plurality of patterns. The method may further include generating and storing one or more additional relationship descriptions in response to determination of a match for the pattern. The additional relationship descriptions may indicate connections between the matched pattern and at least some other patterns included in the diagnostic information. Other embodiments may be described and/or claimed.

Claims

1. A computer-implemented method for assisting diagnosis of a computer issue from a log file, comprising:

receiving, by a diagnostic computing device, a log file having multiple log lines, including a log line indicating an event associated with a component of a user computing device;

matching, by the diagnostic computing device, one or more of a plurality of patterns to at least a portion of the log line, to identify a matched pattern, wherein the plurality of patterns are included in diagnostic information that is accessible by the diagnostic computing device, and wherein the matched pattern is related to at least another pattern of the plurality of patterns;

identifying, by the diagnostic computing device, additional ones of the patterns that are related to the matched pattern, based in part on relationship descriptions of the patterns included in the diagnostic information and on the related another pattern;

generating, by the diagnostic computing device, additional relationship descriptions indicating relationships among some of the additional patterns and the matched pattern; and

generating, by the diagnostic computing device, the log file for user access, including an indicia denoting the event of the log line as having patterns and the additional relationship descriptions available for viewing to assist in diagnosing the log file associated with the user computing device.

2. The computer-implemented method of claim 1, wherein the generating is based on applying ontology rules defining the relationships between patterns to the matched pattern and the additional patterns, the ontology rules being accessible by the diagnostic computing device.

3. The computer-implemented method of claim 2, wherein the applying ontology rules includes:

identifying, by the diagnostic computing device, a common pattern that relates to the matched pattern and at least one of the additional patterns;

identifying, by the diagnostic computing device, relationship descriptions defining relationships between the common pattern and the matched pattern and between the common pattern and the at least one of the additional patterns; and

providing, by the diagnostic computing device, a relationship description between the matched pattern and the at least one of the additional patterns based on the identified relationship descriptions and the relationships defined by the ontology rules.

4. The computer-implemented method of claim 1, wherein the identifying additional ones of the patterns related to the matched pattern includes determining, by the diagnostic computing device, which of the patterns are related to the matched pattern or to the related another pattern, based on corresponding relationship descriptions associated with the patterns.

5. A computer-implemented method for providing diagnostic information, comprising:

matching, by a computing device, a pattern to a log line included in a log file accessible by the computing device, to determine that there is a match between the at least a portion of a log line and the pattern, wherein the pattern is one of a plurality of patterns included in a collection of diagnostic information accessible by the computing device, the diagnostic information including one or more relationship descriptions between the pattern and one or more other patterns of the plurality of patterns; and

generating and storing, by the computing device, one or more additional relationship descriptions indicating relationships between the matched pattern and at least some other patterns included in the diagnostic information.

6. The computer-implemented method of claim 5, further comprising:

obtaining, by the computing device, the log file including multiple log lines, each log line indicating an event associated with a component of the computing device or another computing device.

7. The computer-implemented method of claim 5, further comprising:

associating, by the computing device, the additional relationships with the log line corresponding to the matched pattern; and

providing, by the computing device, the log file including the associated additional relationships for display via a user interface provided by the computing device.

8. The computer-implemented method of claim 7, further comprising:

enabling, by the computing device, a selection of the at least one log line via the user interface, wherein the selection causes the additional relationships to be displayed via the user interface.

9. The computer-implemented method of claim 5, wherein the generating includes:

identifying, by the computing device, the at least some other patterns corresponding to the matched pattern; and

applying, by the computing device, ontology rules to the relationships associated with the identified other patterns, to generate the additional relationships.

10. The computer-implemented method of claim 9, wherein the ontology rules are configured to define the relationships based at least in part on one or more of a transitory or ancestral dependency between at least some of the relationships.

11. The computer-implemented method of claim 10, wherein the applying includes:

identifying, by the computing device, a common pattern that relates to the matched pattern and at least one of the additional patterns;

identifying, by the computing device, relationship descriptions defining relationships between the common pattern and the matched pattern and between the common pattern and the at least one of the additional patterns; and

providing, by the computing device, a relationship description between the matched pattern and the at least one of the additional patterns based on the identified relationship descriptions and the relationships defined by the ontology rules.

12. The computer-implemented method of claim 5, further comprising:

receiving, by the computing device, input provided by multiple users, the input including data entries providing the plurality of patterns and relationships between at least some of the plurality of patterns.

13. A computer system for providing diagnostic information, the system comprising:

at least one processor; and

at least one memory having processor-executable instructions that, in response to execution by the at least one processor, cause the computer system to;

identify a log line in a log file including multiple log lines that includes at least a portion thereof that matches a pattern of multiple patterns included in a collection of previously accumulated diagnostic information that is accessible by the computer system, the diagnostic information including one or more relationship descriptions between the pattern and one or more other patterns of the plurality of patterns; and

generate additional relationship descriptions associated with the matched pattern, based in part on the relationship descriptions included in the diagnostic information, the additional relationships indicating relationships between the matched pattern and at least some other patterns included in the diagnostic information.

14. The computer system of claim 13, wherein the processor-executable instructions further cause the computer system, in response to execution by the processor, to associate the additional relationships with the identified log line and to provide the log file with the associated additional relationships for user access via a user interface associated with the computer system.

15. The computer system of claim 13, wherein the processor-executable instructions that cause the computer system to generate the additional relationships further cause the computer system, in response to execution on the processor, to identify the at least some other patterns corresponding to the matched pattern and to apply ontology rules to relationships between the matched pattern and the at least some other patterns.

16. The computer system of claim 13, wherein the diagnostic information is stored at a data repository accessible by the computer system.

17. A non-transitory computing device-readable medium comprising computing device-executable instructions for providing diagnostic information, wherein the instructions, in response to execution by a computing device, cause the computing device to:

identify a log line in a log file including multiple log lines that includes at least a portion thereof that matches a pattern of multiple patterns included in diagnostic information that is accessible by the computer system, the diagnostic information including one or more relationship descriptions between the pattern and one or more other patterns of the plurality of patterns; and

generate additional relationship descriptions associated with the matched pattern, based in part on the relationship descriptions included in the diagnostic information, the additional relationship descriptions indicating relationships between the matched pattern and at least some other patterns included in the diagnostic information.

18. The non-transitory computing device-readable medium of claim 17, wherein the computing device-executable instructions further cause the computing device, in response to execution, to update the log file to include the additional relationship descriptions in association with the log line corresponding to the matched pattern.

19. The non-transitory computing device-readable medium of claim 18, wherein the computing device-executable instructions further cause the computing device, in response to execution, to provide the updated log file for display in at least one of a timeline view or a log view.

20. The non-transitory computing device-readable medium of claim 17, wherein the diagnostic information further includes one or more tags associated with at least some of the patterns, each tag including indicia denoting an event described by the associated pattern.

21. The non-transitory computing device-readable medium of claim 20, wherein the diagnostic information further includes one or more descriptions of events associated with the patterns, wherein each event is associated with one of a plurality of computing devices, wherein the diagnostic information is obtained from the plurality of computing devices.

22. The non-transitory computing device-readable medium of claim 17, wherein the computing device-executable instructions further cause the computing device, in response to execution, to obtain the log file from another computing device.