Identifying problematic messages

• US 10,187,495 B2
• Filed: 09/23/2016
• Issued: 01/22/2019
• Est. Priority Date: 09/23/2016
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: entIT Software LLC (Open Text Corporation)
• Inventors: Galkin, Ola, Mendel, Sigal, Kedem, Gil
• Primary Examiner(s): Lazaro, David R
• Assistant Examiner(s): Shitayewoldetadik, Berhanu
• Application Number:
  US15/275,070
• Publication Number:
  US 20180091404A1
• Time in Patent Office: 851 Days
• Field of Search: 709224
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Examples relate to identifying problematic messages. In one example, a computing device may: obtain, for each of a plurality of server requests, at least one log message; obtain, for each of the server requests, a measure of server request success; for each of the obtained log messages, cluster the obtained log message into one of a plurality of log clusters, the clustering being based on a measure of similarity between the obtained log message and other log messages included in the log cluster; and for each of the obtained log messages, increment a particular counter associated with the log cluster into which the obtained log message is clustered, the particular counter being selected for incrementing based on the measure of server request success.

Claims

1. A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing device for identifying problematic messages, the machine-readable storage medium comprising instructions to cause the hardware processor to:

obtain log messages associated with a server request;

obtain a latency measure of the server request;

cluster each of the obtained log messages into one of a plurality of log clusters based on a measure of similarity between the obtained log message and other log messages included in the log cluster, wherein each of the log clusters includes a problematic counter indicating a total number of problematic messages in the log cluster and a benign counter indicating a total number of non-problematic messages in the log cluster;

compare the latency measure of the server request to a threshold;

increment the problematic counter in each of the log clusters if the latency measure exceeds the threshold or increment the benign counter in each of the log clusters if the latency measure does not exceed the threshold;

determine that one of the obtained log messages is a problematic log message based on a ratio of the problematic counter over the benign counter in the log cluster to which the problematic log message belongs; and

display the problematic log message as a notification of a potential problem.

2. The storage medium of claim 1, wherein the instructions further cause the hardware processor to:

receive a plurality of log messages that are associated with a new server request;

identify, for each of the plurality of log messages, one of the plurality of log clusters to which the log message belongs; and

identify one of the plurality of log messages as a target log message based on the log cluster to which the target log message belongs.

3. The storage medium of claim 2, wherein the instructions further cause the hardware processor to:

generate a notification associated with the target log message, the notification indicating that the target log message is potentially problematic.

4. The storage medium of claim 2, wherein the identification of one of the plurality of log messages as a target message based on the log cluster to which the target log message belongs is based on a ratio of the problematic counter over the benign counter in the log cluster to which the target log message belongs.

5. The storage medium of claim 1, wherein the problematic counter indicates a number of log messages that are associated with a potentially problematic server request;

and the benign counter indicates a number of log messages that are not associated with a problematic server request.

6. The storage medium of claim 1, wherein the instructions further cause the hardware processor to:

identify each of the plurality of log clusters as one of potentially problematic or benign, the identification being based on the ratio of the problematic counter over the benign counter for each of the plurality of log clusters.

7. A computing device comprising:

a hardware processor; and

a data storage device storing instructions that, when executed by the hardware processor, cause the hardware processor to;

receive a plurality of log messages associated with a server request;

receive a latency measure of server request;

identify, for each of the plurality of log messages, one of a plurality of log clusters to which the log message belongs, wherein each of the log clusters includes a problematic counter indicating a total number of problematic messages in the log cluster and a benign counter indicating a total number of non-problematic messages in the log cluster;

compare the latency measure of the server request to a threshold;

increment the problematic counter in each of the log clusters if the latency measure exceeds the threshold or increment the benign counter in each of the log clusters if the latency measure does not exceed the threshold;

identify one of the identified log clusters as a problematic log cluster based on a ratio of the problematic counter over the benign counter in the problematic log cluster; and

display the log message that belongs to the problematic log cluster as a problematic log message.

8. The computing device of claim 7, wherein the latency measure of server request indicates a period of time between the server request and a response from a server to which the server request was provided.

9. The computing device of claim 7, wherein each of the plurality of log messages are identified as belonging to one of the plurality of log clusters based on similarities between the plurality of log messages and the log clusters to which they belong.

10. The computing device of claim 7, wherein the problematic log cluster is identified based on a ratio of the problematic counter over the benign counter in the problematic log cluster.

11. The computing device of claim 7, wherein the problematic counter indicates a number of log messages that are associated with a potentially problematic server request;

and the benign counter indicates a number of log messages that are not associated with a problematic server request.

12. The computing device of claim 7, wherein the instructions further cause the hardware processor to:

increment the problematic counter associated with the problematic log cluster.

13. The computing device of claim 7, wherein the instructions further cause the hardware processor to:

identify a second of the identified log clusters as a benign log cluster based on a ratio of the problematic counter over the benign counter in the benign log cluster;

identify the log message that belongs to the benign log cluster as a benign log message; and

increment a benign counter in the benign log cluster.

14. The computing device of claim 7, wherein the instructions further cause the hardware processor to:

provide data indicating the problematic log message and the server request to a problematic request analyzer.

15. A method, implemented by a hardware processor, the method comprising:

receiving a plurality of log messages associated with a server request;

receiving a latency measure of the server request;

identifying, for each of the plurality of log messages, one of a plurality of log clusters to which the log message belongs, wherein each of the log clusters includes a problematic counter indicating a total number of problematic messages in the log cluster and a benign counter indicating a total number of non-problematic messages in the log cluster;

comparing the latency measure of the server request to a threshold;

incrementing the problematic counter in each of the log clusters if the latency measure exceeds the threshold or incrementing the benign counter in each of the log clusters if the latency measure does not exceed the threshold;

determining that one of the plurality of log messages is a problematic log message based on a ratio of the problematic counter over the benign counter in the log cluster to which the problematic log message belongs; and

displaying the problematic log message as a notification of a potential problem.

16. The method of claim 15, wherein each of the plurality of log messages are identified as belonging to one of the plurality of log clusters based on similarities between the plurality of log messages and the log clusters to which they belong.

17. The method of claim 15, wherein the problematic counter indicates a number of log messages in the log cluster that are associated with a potentially problematic server request;

and the benign counter indicates a number of log messages in the log cluster that are not associated with a problematic server request.

18. The method of claim 15, wherein determining one of the plurality of log messages to be the problematic log message when the ratio of the problematic counter over the benign counter is greater than a predetermined number.

19. The method of claim 15, wherein incrementing the problematic counter in each of the log clusters includes incrementing the problematic counter for each of the log messages associated with the server request that are identified as belonging to the log cluster.

20. The method of claim 15, wherein the latency measure of server request indicates a period of time between the server request and a response from a server to which the server request was provided.