Method for estimating format of log message and computer and computer program therefor
First Claim
1. A method for use in a computer to estimate a format of a log message, the method comprising:
- creating a first directed graph structure by dividing a first log message by predetermined characters to define divided portions as nodes and arranging the nodes in order from the beginning of the first log message;
creating a second directed graph structure by dividing a second log message by the predetermined characters to define divided portions as nodes and arranging the nodes in order from the beginning of the second log message;
comparing nodes in the first directed graph structure with nodes in the second directed graph structure to detect a node in the first directed graph structure and a node in the second directed graph structure that are nodes other than nodes including a corresponding character string;
adding to the first directed graph structure the node detected in the second directed graph structure among the detected nodes as a first branch node; and
estimating the format, based on the first directed graph structure including the first branch node added thereto, wherein the format includes a first portion associated with a node including a corresponding character string, a second portion associated with a node whose appearance tendency of character string is similar between the node detected in the first directed graph structure and the node detected in the second directed graph structure, and a third portion associated with a node other than nodes having a similar appearance tendency of character string.
1 Assignment
0 Petitions
Accused Products
Abstract
A technique for estimating a format of a log message (LM) according to the present invention includes creating a first directed graph structure by dividing a first LM by predetermined characters to define divided portions as nodes and arranging the nodes in order from the beginning of the first LM; creating a second directed graph structure by performing on a second LM the same processing as that performed on the first LM; comparing nodes in the first directed graph structure with nodes in the second directed graph structure to detect nodes other than nodes including a corresponding character string; adding to the first directed graph structure the node detected in the second directed graph structure among the detected nodes as a first branch node; and estimating the format, based on the first directed graph structure including the first branch node added thereto.
44 Citations
16 Claims
-
1. A method for use in a computer to estimate a format of a log message, the method comprising:
-
creating a first directed graph structure by dividing a first log message by predetermined characters to define divided portions as nodes and arranging the nodes in order from the beginning of the first log message; creating a second directed graph structure by dividing a second log message by the predetermined characters to define divided portions as nodes and arranging the nodes in order from the beginning of the second log message; comparing nodes in the first directed graph structure with nodes in the second directed graph structure to detect a node in the first directed graph structure and a node in the second directed graph structure that are nodes other than nodes including a corresponding character string; adding to the first directed graph structure the node detected in the second directed graph structure among the detected nodes as a first branch node; and estimating the format, based on the first directed graph structure including the first branch node added thereto, wherein the format includes a first portion associated with a node including a corresponding character string, a second portion associated with a node whose appearance tendency of character string is similar between the node detected in the first directed graph structure and the node detected in the second directed graph structure, and a third portion associated with a node other than nodes having a similar appearance tendency of character string. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
-
Specification