Visualization of graphical representation of log files

• US 9,984,148 B2
• Filed: 08/22/2017
• Issued: 05/29/2018
• Est. Priority Date: 01/20/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lee, Tien Hiong, Levinski, Konstantin, Tang, Weng Sing, Zhu, Liang
• Primary Examiner(s): HASAN, SYED HAROON
• Application Number:
  US15/682,610
• Publication Number:
  US 20170351748A1
• Time in Patent Office: 280 Days
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/287 Visualization; Browsing

Abstract

A computer-implemented method includes receiving one or more log files. Each of the one or more log files includes one or more logs. The computer-implemented method further includes extracting one or more event records from said one or more logs. The computer-implemented method further includes, for each event record of the one or more event records, determining one or more attributes and one or more dimensions based on the event record, respectively. The computer-implemented method further includes grouping the one or more event records into one or more attribute groups. The computer-implemented method further includes ordering the one or more event records of each of the one or more attribute groups by the one or more dimensions. The computer-implemented method further includes generating one or more graphical representations of the one or more attribute groups. A corresponding computer system and computer program product are also disclosed.

Claims

1. A computer system, the computer system comprising:

one or more computer processors;

one or more computer readable storage media;

computer program instructions;

said computer program instructions being stored on said one or more computer readable storage media;

said computer program instructions comprising instructions to;

receive one or more log files, each of said one or more log files comprising one or more logs, said one or more logs comprising structured data written in text format;

extract one or more event records from said one or more logs, wherein each of said one or more event records comprises at least one of an event message, an event origin, and an event type;

normalize each of said at least one event message, said instructions to normalize further comprising instructions to normalize variable fields located within each of said one or more event records into a set of predefined symbols;

for each event record of said one or more event records;

determine one or more attributes based on said event record; and

determine at least one dimension based on said event record, said at least one dimension being selected from the group consisting of;

(a) time;

(b) frequency; and

(c) message length;

group said one or more event records into one or more attribute groups;

order said one or more event records of each said one or more attribute groups by said one or more dimensions, each of said one or more event records of said one or more attribute groups being ordered according to at least one metric selected from the group consisting of;

(a) time of occurrence;

(b) message length;

(c) frequency of occurrence;

(d) importance; and

(e) relevance; and

generate one or more graphical representations of said one or more attribute groups, wherein at least one of said one or more graphical representations comprises;

a scatter plot, said scatter plot displaying data based on at least one of said one or more events records, at least one of said one or more attributes, and at least one of said one or more dimensions, said scatter plot identifying at least one pattern event selected from the group consisting of;

(a) repeated events;

(b) periodical events;

(c) missing events;

(d) abnormal events; and

(e) related events,

said scatter plot further being modified by filtering said one or more event records based on one or more filter criteria, said filtering comprising updating a relevance score; and

displaying details of at least one of said one or more event records.