Network event capture and retention system

• US 20070011306A1
• Filed: 05/26/2006
• Published: 01/11/2007
• Est. Priority Date: 12/03/2003
• Status: Abandoned Application

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Network Intelligence Corporation (Dell Technologies Inc.)
• Inventors: Volk, Scott, Johnson, Mark, Stevens, Matthew, Brady, Bernard
• Application Number:
  US11/441,926
• Publication Number:
  US 20070011306A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

Methods and apparatus are provided to monitor and analyze activity occurring on a networked computer system. In some embodiments, a method is provided for capturing, in a data structure, at least a portion of a notification describing a network event provided by a node on a computer network, identifying a data element (e.g., an IP address of the node) within the notification, and updating an index and/or summary based on the data element. The data structure may be stored in a file system maintained on a site, and sites may exchange information related to the notification data stored on each. In some embodiments, a query which is issued to a site may be processed using data transferred from other sites, and/or may be split into one or more additional queries which may be transmitted for processing to other sites.

Claims

1. A method for processing log data comprising:

receiving raw log data in a log data analyzer;

parsing the raw log data;

summarizing the parsed log data;

storing the summarized data in a database maintained by the log data analyzer;

receiving a database query from a management station;

generating a database report in the log data analyzer from the summarized data in response to the query received from the management station; and

, sending the database report to the management station.

2. A method as recited in claim 1 wherein the database report includes the time period of the summarized data.

3. A method as recited in claim 2 wherein the data in the report is sorted by the time period of the summarized data.

4. A method as recited in claim 1 wherein the data in the report is limited by the time period of the summarized data.

5. A data processing system for processing log data comprising:

a management station;

a log data analyzer connected to the management station via a data communications link and which receives raw log data;

parses the raw log data;

summarizes the parsed log data;

stores the summarized data in a database;

receives a database query from the management station;

generates a database report from the summarized data in response to the query received from the management station; and

, sends the database report to the management station.

6. A data processing system as recited in claim 5 wherein the log data analyzer includes in the database report the time period of the summarized data.

7. A data processing system as recited in claim 6 wherein the log data analyzer sorts the data in the report by the time period of the summarized data.

8. A data processing system as recited in claim 5 wherein the log data analyzer limits the data in the report by the time period of the summarized data.