Automatic correlation of dynamic system events within computing devices
First Claim
Patent Images
1. A method, comprising:
- providing, using one or more computing devices, an event log structured as a collection of tree-like graphs;
receiving, using the one or more computing devices, information regarding a new event to be logged;
creating, using the one or more computing devices, a new event node within the event log for the new event;
identifying, using the one or more computing devices, any existing event nodes within the event log that each represent a respective past event that possibly caused the new event, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises searching existing event nodes created within a specified time period;
for each new event identified as possibly caused by an existing event, creating, using the one or more computing devices, a causal link within the event log between the new event node and each of the identified existing event nodes; and
for each new event not identified as possibly cause by at least one existing event, storing, using the one or more computing devices, the new event node as an unattached root node in response to not identifying an existing event node representing a past event that may have caused the new event.
1 Assignment
0 Petitions
Accused Products
Abstract
Systems and methods are described herein for logging system events within an electronic machine using an event log structured as a collection of tree-like cause and effect graphs. An event to be logged may be received. A new event node may be created within the event log for the received event. One or more existing event nodes within the event log may be identified as having possibly caused the received event. One or more causal links may be created within the event log between the new event node and the one or more identified existing event nodes. The new event node may be stored as an unattached root node in response to not identifying an existing event node that may have caused the received event.
36 Citations
17 Claims
-
1. A method, comprising:
-
providing, using one or more computing devices, an event log structured as a collection of tree-like graphs; receiving, using the one or more computing devices, information regarding a new event to be logged; creating, using the one or more computing devices, a new event node within the event log for the new event; identifying, using the one or more computing devices, any existing event nodes within the event log that each represent a respective past event that possibly caused the new event, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises searching existing event nodes created within a specified time period; for each new event identified as possibly caused by an existing event, creating, using the one or more computing devices, a causal link within the event log between the new event node and each of the identified existing event nodes; and for each new event not identified as possibly cause by at least one existing event, storing, using the one or more computing devices, the new event node as an unattached root node in response to not identifying an existing event node representing a past event that may have caused the new event. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A system, comprising:
-
a storage device; and a processor communicatively coupled to the storage device, wherein the processor executes application code instructions that are stored in the storage device to cause the system to; receive information regarding a new event to be logged; create an event node representing the new event within an event log, the event log structured as a collection of tree-like graphs; identify any existing event nodes within the event log that each represent a respective past event that possibly caused the new event, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises searching existing event nodes created within a specified time period; for each new event identified as possibly caused by an existing event, create a causal link within the event log between the new event node and each of the identified existing event nodes; and for each new event not identified as possibly cause by at least one existing event, store the new event node as an unattached root node in response to not identifying an existing event node representing a past event that may have caused the new event; and provide an output of one or more result tree-like graphs in response to a user search for an event represented by an event node linked within the one or more result tree-like graphs. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. One or more tangible computer readable storage media encoded with software comprising computer executable instructions that when executed are operable to:
-
provide an event log structured as a collection of tree-like graphs; receive information regarding a new event to be logged; create a new event node within the event log for the new event; identify any existing event nodes within the event log that each represent a respective past event that possibly caused the new event, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises searching existing event nodes created within a specified time period; for each new event identified as possibly caused by an existing event, create a causal link within the event log between the new event node and each of the identified existing event nodes; and for each new event not identified as possibly cause by at least one existing event, store the new event node as an unattached root node in response to not identifying an existing event node representing a past event that may have caused the new event. - View Dependent Claims (14, 15, 16, 17)
-
Specification