Log analysis in vector space

Abstract

Embodiments of the present disclosure relate to log analysis in a vector space. Disclosed embodiments provide identification of remedial actions based on analysis of system log files. In some example embodiments, messages from system log files are used as input to generate vectors within a vector space. Portions of log messages can generate vectors that cluster into regions in the vector space. Regions of the vector space are associated with one or more remedial actions. In some example embodiments, disclosed embodiments are configured to perform one or more remedial actions when activity in a log file maps to a region of the vector space associated with one or more remedial actions. In some example embodiments, a remedial action can include submitting a problem report to a problem tracking database.

Description

[0001] Related applications

[0002] This application is a divisional application of the invention patent application with application number 201911349976.9, application date December 24, 2019, and invention title "Log Analysis in Vector Space". Technical Field

[0003] This application generally relates to the analysis of log files generated by computer systems. Specifically, some embodiments employ machine learning techniques to correlate log file information with a database of known system behaviors. Background Technology

[0004] Many computer systems encounter abnormal conditions during normal operation. These conditions can be noted in log files. Over time, a collection of entries describing the various conditions that occurred during system operation is created. When a system fails to perform its functions correctly, the log files can be analyzed to determine the cause of the problem and possible solutions. However, this analysis only occurs after the problem has already occurred, resulting in at least some loss of system productivity. Therefore, methods for monitoring and improving computer systems are needed. Summary of the Invention

[0005] According to some embodiments of this disclosure, a method is provided, comprising: assigning multiple log messages to a first message block based on criteria; generating a message block vector in a vector space based on the content of the messages assigned to the first message block; determining that the position of the message block vector in the vector space is within a defined volume in the vector space, the defined volume being associated with a remedial action; and performing a remedial action based on the determination.

[0006] According to other embodiments of this disclosure, a non-transient computer-readable storage medium is provided that includes instructions, when executed, configuring hardware processing circuitry to perform operations including: allocating a plurality of log messages to a first message block based on criteria; generating a message block vector in a vector space based on the content of the messages allocated to the first message block; determining that the position of the message block vector in the vector space is within a defined volume in the vector space, the defined volume being associated with a remedial action; and performing a remedial action based on the determination.

[0007] According to further embodiments of this disclosure, a system is provided, including: hardware processing circuitry; one or more hardware memories storing instructions that, when executed, configure the hardware processing circuitry to perform operations including: assigning a plurality of log messages to a first message block based on criteria; generating a message block vector in a vector space based on the content of the messages assigned to the first message block; determining that the position of the message block vector in the vector space is within a defined volume in the vector space, the defined volume being associated with a remedial action; and performing a remedial action based on the determination. Attached Figure Description

[0008] The present disclosure is illustrated by way of example rather than limitation in the various figures of the accompanying drawings, wherein similar reference numerals indicate similar elements, and wherein:

[0009] Figure 1 This is an overview diagram of an example system that implements one or more of the disclosed embodiments.

[0010] Figure 2 This is a block diagram of an example access point that implements one or more of the disclosed embodiments.

[0011] Figure 3A This is a data flow diagram illustrating the processing of log data in one or more of the disclosed embodiments.

[0012] Figure 3B An example network management device is shown.

[0013] Figure 4 An example network node is shown.

[0014] Figure 5 An example communication device is shown.

[0015] Figure 6A The illustration shows a sample message 600A that can be included in the system logs of one or more devices.

[0016] Figure 6B The illustration shows the application of one or more of the heuristics discussed above. Figure 6A The image shows a sample message from the scaled-down system log following the log entry.

[0017] Figure 7A It shows the results of the pair Figure 6B The example table is derived from the analysis of the messages.

[0018] Figure 7B An example mapping of message blocks to message block vectors that can be generated by one or more of the disclosed embodiments is illustrated.

[0019] Figure 8 This is a flowchart of the method used for training and information storage processes.

[0020] Figure 9 It is a flowchart of a method for detecting message blocks that can be implemented in one or more of the disclosed embodiments.

[0021] Figure 10 This is a flowchart of a method for generating message block vectors for message blocks.

[0022] Figure 11 It is a sequence diagram showing how the message block vector is incrementally updated as each message in the block is processed.

[0023] Figure 12A This is a flowchart of an example method for identifying remedial actions to be taken due to one or more messages included in a log file.

[0024] Figure 12B This is a flowchart of an example method for generating message block vectors in some embodiments.

[0025] Figure 12C This is a flowchart of an example method for generating message block vectors in some embodiments.

[0026] Figure 13 An example data structure that can be implemented by one or more of the disclosed embodiments is illustrated.

[0027] Figure 14 A block diagram of an example machine on which any one or more of the techniques (e.g., methods) discussed herein can be executed is illustrated. Detailed Implementation

[0028] The following description and accompanying drawings fully illustrate specific embodiments to enable those skilled in the art to practice them. Other embodiments may be incorporated with structural, logical, electrical, process, and other variations. Parts and features of some embodiments may be included in, or replace, those parts or features of other embodiments. The embodiments set forth in the claims cover all available equivalents of those claims.

[0029] The disclosed embodiments are provided for the analysis and characterization of information provided by log messages via a networked system. Networked or distributed systems frequently provide system logs. System logs record information about system operations during operation. During normal operation, some log messages may be generated to record system operating parameters. During special circumstances, additional log messages are generated to record information that helps diagnose and resolve potential issues.

[0030] When problems occur, engineers responsible for maintaining networked or distributed systems can review system logs to gain a deeper understanding of their operation and develop troubleshooting strategies.

[0031] The disclosed embodiments are provided for the analysis of such system logs in a vector space. In some embodiments, individual log messages are grouped into blocks of related messages. This grouping may be based on the arrival or generation time of each message. For example, messages within a threshold elapsed time of each other may be grouped into a block. Alternatively, messages may be grouped based on the content of the messages themselves. For example, in some aspects, messages generated by a common computer / device, a common software component or module, or a common subsystem may be grouped into message blocks. In some cases, messages are grouped based on messages satisfying multiple criteria (e.g., within a threshold elapsed time of each other and generated by a common device).

[0032] Messages can be processed to remove less relevant information from each message. For example, in some cases, messages can be processed to remove field labels, punctuation marks, or other less relevant information. A vector is then generated based on the content of the messages assigned to message blocks. When additional messages are assigned to a specific block, a new vector is generated for that message block.

[0033] The vector generated for a message block corresponds to a vector space. In some embodiments, the message block is a symptom of a specific first system problem or difficulty. By projecting the vector into the vector space, a volume including the vector can be defined in the vector space. This volume or cluster can then be associated with a specific system problem or difficulty. Each specific problem or difficulty can also be associated with one or more remedial actions. Therefore, the disclosed embodiments can also associate one or more actions with a volume or cluster in the vector space.

[0034] Therefore, if the second message block (derived from the second system problem) is identified with a vector that also falls within the defined volume, the disclosed embodiments can infer that a second problem similar to the first problem already exists, and that the remedies associated with the first problem also apply to the second problem.

[0035] Therefore, the disclosed embodiments are provided for improved response times when solving network or distributed system problems. By projecting messages within a block into a vector space, similar problems can be correlated, allowing common root causes and / or remedies to be identified.

[0036] Figure 1This is an overview diagram of an example system 100 implementing one or more of the disclosed embodiments. Example system 100 includes: multiple access points (AP 1 142, ..., AP X 144, AP 1' 150, ..., AP X' 152), wherein the access points may be wireless access points, routers, switches, or any other device capable of providing network access; multiple authentication, authorization, and accounting (AAA) servers (only one AAA server 110 is shown as an example); multiple dynamic host configuration protocol (DHCP) servers (only one DHCP server 116 is shown as an example); multiple domain name system (DNS) servers (only one DNS server 122 is shown as an example); multiple web servers (only one web server 128 is shown as an example); and a network management system (NMS) 136, such as an automated bug reporting and resolution system (server), coupled together via a network 134 (e.g., the Internet and / or a corporate intranet). Network 134 consists of a plurality of routers 185 and a plurality of switches 180. Network communication links (143, 145, 171, 173) couple access points (AP 1 142, AP X 144, AP 1' 150, AP X' 152) to network 134, respectively. Network communication link 111 couples an AAA server (only AAA server 110 is shown as an example) to network 134. Network communication link 117 couples a DHCP server (only one DHCP server 116 is shown as an example) to network 134. Network communication link 123 couples a DNS server (only one DNS server 122 is shown as an example) to network 134. Network communication link 129 couples a web server (only one web server 128 is shown) to network 134. System 100 also includes multiple user equipment devices (UE 1 138, ..., UE Z 140, UE 1' 146, ..., UE Z' 148). User equipment (UE) is any wired, wireless, or optical equipment that provides network access to communication devices used by users such as people or automated devices such as IoT devices. Some UEs (138, 140, 146, 148) are wireless devices that can be moved throughout the system 100.

[0037] System 100 has access points located in different customer locations. For example, customer location 1 in a shopping mall includes access points (AP 1 142, ..., AP X 144). Customer location 2 in a stadium includes access points (AP 1' 150, ..., AP X' 152). Figure 1As an example, UEs (UE 1 138, ..., UE Z 140) are currently located at customer site 1 102; UEs (UE 1' 146, ..., UE Z' 148) are currently located at customer site 2 104. Each of the servers, routers, switches, APs, UE NMS, and other servers attached to the network may, and often does, include a system log or error log module, in which each of these devices records the status of the device, including normal operating status and error conditions.

[0038] Figure 2 This is a block diagram of an example access point configured to implement one or more of the disclosed embodiments. Figure 2 The access point 200 shown can achieve the above-mentioned... Figure 1 The discussion focuses on any one of the access points AP 1 142, ..., AP X 144, AP 1'150, ..., APX'152.

[0039] Access point 200 includes: a wired interface 230; wireless interfaces 236 and 242; a processor 206 (e.g., a CPU); a memory 212; and component assemblies 208 (e.g., hardware component assemblies, circuit assemblies), which are coupled together via a bus 209, allowing various components to exchange data and information. The wired interface 230 includes a receiver 232 and a transmitter 234. The wired interface couples access point 200 to... Figure 1 The network and / or Internet 134. A first wireless interface 236 (e.g., a wireless Wi-Fi interface, e.g., an 802.11 interface) includes: a receiver 238 coupled to a receiving antenna 239, through which an access point can receive wireless signals from, for example, a communication device of a wireless terminal; and a transmitter 240 coupled to a transmitting antenna 241, through which the access point can transmit wireless signals to, for example, a communication device of a wireless terminal. A second wireless interface 242 (e.g., a Bluetooth interface) includes: a receiver 244 coupled to a receiving antenna 245, through which an access point can receive wireless signals from, for example, a communication device of a wireless terminal; and a transmitter 246 coupled to a transmitting antenna 247, through which the access point can transmit wireless signals to, for example, a communication device of a wireless terminal.

[0040] Memory 212 includes routines 214 and data / information 216. Routines 214 include component assemblies 218 (e.g., software component assemblies) and application programming interfaces (APIs) 220. Data / information 216 includes: configuration information 222; a device status log 224, which includes error events and normal events captured as messages in a system log or error log; and a set of remedial actions 226 to be taken in the event of an abnormal message flow.

[0041] Figure 3A This is a data flow diagram showing the model training process 300 and the classification process 320. Figure 3A A set of log files 302 is shown. Log files 302 may be generated by one or more network components. As discussed above, log files store information related to the operation of the networked system. Log files may store information related to errors and / or normal operation of the networked system. Some disclosed embodiments may process log files 302 to extract data meaningful to the embodiments disclosed herein. As discussed in more detail below, in some embodiments, heuristics and algorithms such as word frequency-inverse document frequency (TFIDF) generate a reduced system log of phrases 304 from log files 302. Phrases consist of meaningful keywords, messages, or message sequences extracted from the log files. In this context, "meaningful" indicates that the keywords, messages, or sequences provide an indication of the root cause of one or more problems occurring in the monitored network system. Once the log files have been processed to identify meaningful phrases, the phrases are encoded into a vector space 306. Encoding can be performed in various ways. In some example embodiments, Doc2Vec is used to encode phrases into a vector space. In some other embodiments, Word2Vec is used to encode phrases into a vector space. The encoding of phrases into a vector space is stateful. In other words, as encoding proceeds, the state of the vector space encoding is maintained, so that subsequent encodings of a phrase are influenced by the previous encodings of the phrase in the vector space.

[0042] Once the phrases have been vectorized, clusters 308 of the vectors are identified. For example, in some embodiments, phrase vectors 306 that are within a threshold distance of each other can be grouped into clusters 308. In some embodiments, centroids in the vector space can be determined, wherein vectors within a threshold distance of the centroids are grouped into single clusters within clusters 308.

[0043] After clustering the vectors into vectors, it is determined whether one or more root causes and / or solutions to the problems associated with a particular cluster have been identified. In some example embodiments, this can be achieved via interaction with a defect database 310. The problem tracking database may provide an API for programmatic querying and typing of problem reports. An example of a problem tracking database is JIRA. Some disclosed embodiments may interface with the problem tracking database to determine whether root causes, problems, and / or solutions are associated with a particular cluster. For example, the problem tracking database may be configured to record locations within the vector space associated with problems, root causes, fixes, and / or solutions. If no record is associated with a specific region of the vector space corresponding to a vector cluster, the disclosed embodiments may generate a new record in the problem tracking database. The new record may store cluster-related information, such as log entries associated with the cluster, the time associated with the log entries, etc.

[0044] Figure 3A The diagram also illustrates the data flow from the health detection component 322, the automatic log collection component 324, the log processing component 326, the cluster identification component 328 to the defect database search and repair suggestion component 330.

[0045] Figure 3B An example network management device 300 is illustrated. In one or more of the disclosed embodiments, the network management device implements a real-time and / or predictive fault detection network management node. In some embodiments, the network management device 300 is a network management node, such as a network management server, like a network management automation program error reporting and resolution server. In some embodiments, Figure 3B Network management device 300 is Figure 1 The network management system (NMS) 136. In some embodiments, the network management device 300 is such as through... Figure 1 The example shown is any of the access points or devices shown in the example, or a portion thereof.

[0046] The network management device 300 includes: a communication interface 330; a processor 306; an output device 308, such as a display, printer, etc.; an input device 310, such as a keyboard, keypad, touchscreen, mouse, etc.; a memory 312; and assemblies of components 340, such as hardware component assemblies, such as circuit assemblies, which are coupled together via a bus 309, allowing various components to exchange data and information. In some embodiments, the communication interface 330 includes an Ethernet interface. The communication interface 330 couples the network monitoring system 300 to a network and / or the Internet. The communication interface 330 includes: a receiver 332, through which the network monitoring device can receive data and information from various devices such as AAA servers, DHCP servers, web servers, routers, and switches, including service-related information such as messages registered in system logs or error logs; and a transmitter 334 through which the network monitoring device 300 can send data and information, including configuration information and instructions such as instructions to access points, routers, switches, or any other servers attached to the network, to restart, change operating parameters, download and install another SW version, etc.

[0047] Memory 312 includes routines 314 and data / information 317. Routines 314 include component assemblies 318 (e.g., software component assemblies) and application programming interfaces (APIs) 320. Data / information 317 includes configuration information 322; messages captured in the system log 324, including message and / or message fields and timing information, such as the time the message was registered in the system or error log. Memory 312 also includes message block cluster related information 319, including message block cluster definition information 325, action information to be taken 326, and message block IDs 327 for the corresponding cluster. In information 329, the first line provides a header, while each additional line provides information for a message block. For example, the second line corresponds to a message block cluster definition for a first message block cluster, which is represented by or corresponds to a first message block vector cluster defined by the volume specified in the first element of the second line of information 319. As an example, the second column 326 of line 2 of information 319 shows the action to be taken when a message block is found to correspond to message block cluster 1, such as increasing the AP transmission power level, and the third column 327 shows that cluster 1 corresponds to tag ID 19864, where a tag or ID can be used as a reference entry for accessing a bug tracking system such as JIRA. Line 3 of information 319 includes information for message block cluster 2, which includes: information defining the message block vector cluster corresponding to message block 2, for example, in terms of volume in N dimensions, and an indication that message block cluster 2 also corresponds to tag ID 72956, where a tag or ID can be used as a reference entry for accessing a bug tracking system such as JIRA service. Additional information and actions may be included and are typically included in information 319 for other message blocks corresponding to poor service. Message block definition information for message blocks associated with good service may also be included in information 319, but remedial action information may be omitted and is typically omitted for message blocks corresponding to good service included in information 319.

[0048] Remedial actions can be configured by the system administrator based on past experience. According to some example embodiments, remedial actions can be downloaded to a specific access point (AP). According to other embodiments, remedial actions are automatically invoked once an abnormal message flow is detected by the message delivery model 327, which can also reside in memory 312.

[0049] The memory 312 also includes detected message block information 350 for one or more message sequences (e.g., communication control-related message blocks). In some embodiments, each message block may identify the device that originated the messages included in the block. In some embodiments, the message block may further indicate other devices communicating with the originating device. In some embodiments, in addition to information identifying the devices involved in the message block, the message block information 350 also includes a current message block vector value for each message block. This value is typically updated when a message in the corresponding block is received, wherein the value is compared with message block cluster definition information to determine whether the message block matches a defined message block cluster indicated by the message block vector of the message block that can fall within the message block vector cluster volume used to define the message block cluster in the definition information 319. As an example, the message block information 350 is shown as including message block information (351, ..., 353) for multiple message blocks (e.g., message block 1 to message block X).

[0050] Figure 4 An example network node 400 is shown. In one or more of the disclosed embodiments, network node 400 implements a device or server attached to network 134, such as a router, switch, AAA server, DHCP server, DNS server, web server, etc., or a network device such as router 185, switch 180, etc. In some embodiments, Figure 4 Network node 400 can be Figure 1 Servers 110, 116, 122, 128 or Figure 1 Router 185, switch 180. For example, a server network node 400 includes: a communication interface 402, such as an Ethernet interface; a processor 406; output devices 408, such as a monitor, printer, etc.; input devices 410, such as a keyboard, keypad, touchscreen, mouse, etc.; memory 412; and assemblies of components 416, such as hardware module assemblies, such as circuit assemblies, which are coupled together via a bus 409, through which various components can exchange data and information. The communication interface 402 couples the network node 400 to a network and / or the Internet. Although only one interface is shown as an example, those skilled in the art will recognize that routers and switches can and often do have multiple communication interfaces. The communication interface 402 includes: a receiver 420 through which the network node 400 (e.g., a server) can receive data and information, such as operation-related information, such as registration requests, AAA services, DHCP requests, Simple Notification Service (SNS) lookups, and web page requests; and a transmitter 422 through which the network node 400 (e.g., the server) can send data and information, such as configuration information, authentication information, and web page data.

[0051] Memory 412 includes routines 428 and data / information 430. Routines 428 include an assembly of components 432 (e.g., an assembly of software components) and data / information 430. Data / information 430 includes system logs and / or error logs.

[0052] Figure 5 An example communication device 500 is illustrated. In one or more of the disclosed embodiments, the communication device 500 may implement a user equipment (UE) device, such as any one or more of user equipment UE 1 138, ..., UE Z 140, UE 1' 146, ... or UE Z' 148. The communication device 500 (e.g., UE) includes: a wired interface 502; a wireless interface 504; a processor 506, such as a CPU; a memory 512; and an assembly 516 of components, such as an assembly of hardware modules, such as an assembly of circuits, coupled together via a bus 509 through which various components can exchange data and information. The wired interface 502 includes a receiver 520 and a transmitter 522. The wired interface 502 couples the communication device 500 (e.g., UE) to... Figure 1 134. Network and / or Internet.

[0053] The wireless interface 504 includes a cellular interface 524, a first additional wireless interface 526 (e.g., an 802.11 WiFi interface), and a second additional wireless interface 528 (e.g., a Bluetooth interface). The cellular interface 524 includes: a receiver 532 coupled to a receiver antenna 533, through which the communication device 500 (e.g., a UE) can receive wireless signals from access points such as AP 1 142, ..., AP X 144, AP1' 150, ..., APX' 152; and a transmitter 534 coupled to a transmitting antenna 535, through which the communication device 500 (e.g., a UE) can transmit wireless signals to APs such as AP 1 142, ..., AP X 144, AP 1' 150, ..., APX' 152. The first additional wireless interface 526 (e.g., a Wi-Fi interface, such as an 802.11 interface) includes: a receiver 536 coupled to a receiving antenna 537, through which the communication device 500 (e.g., a UE) can receive wireless signals from a communication device (e.g., an AP); and a transmitter 538 coupled to a transmitting antenna 539, through which the communication device 500 (e.g., a UE) can transmit wireless signals to the communication device (e.g., an AP). The second additional wireless interface 528 (e.g., a Bluetooth interface) includes: a receiver 540 coupled to a receiving antenna 541, through which the communication device 500 (e.g., a UE) can receive wireless signals from a communication device (e.g., an AP); and a transmitter 542 coupled to a transmitting antenna 543, through which the communication device 500 (e.g., a UE) can transmit wireless signals to the communication device (e.g., an AP).

[0054] Memory 512 includes routines 528 and data / information 517. Routines 528 include assemblies 515 of components, such as software components. Data / information 517 may include configuration information and any other information required for the normal operation of UE 500. Data / information also includes system logs or error logs.

[0055] Figure 6A The illustration shows a sample message 600A that can be included in the system logs of one or more devices. Devices may include... Figure 1 Any one or more of the UE, AP, server, router, switch, etc. in the system. Each of messages 601, 602, ... 607 begins with a timestamp. For example, message 601 begins with timestamp 610a, and message 602 begins with timestamp 610b. Message 607 begins with timestamp 610c. For clarity of illustration, other timestamps used for other messages are not specifically identified.

[0056] Figure 6B The illustration shows the application of one or more of the heuristics discussed above. Figure 6A The example message 600B in the diagram is a scaled-down version of the system log following the log entry shown. For example, in example message 600B, timestamps such as 610a-b are present. Figure 6A The timestamp was replaced with a time increment of 620 bits since the immediately preceding message. (From...) Figure 6A The timestamp 610a was replaced with a pre-defined special character, which in Figure 6B The symbol is represented by a minus sign (-) and is labeled 620a. This is a special case for the first message in the log file, as indicated by messages 601 and 601R.

[0057] As explained above, log files may initially include words or phrases that make the system logs human-readable. As discussed in this article, these words may not be necessary for fully training a machine learning model to generate results. For example, words and / or phrases describing the meaning can be removed where their place in the log file is sufficient to convey the information's meaning, thus reducing the overall size and complexity of the log file. An example of this is in the comparison... Figure 6A and Figure 6B It was shown at the time. Figures 6A-6B In the above, message 601 is mapped to the reduced message 601R, message 602 is mapped to the reduced message 602R, message 603 is mapped to the reduced message 603R, message 604 is mapped to the reduced message 604R, message 605 is mapped to the reduced message 605R, message 606 is mapped to the reduced message 606R, and message 607 is mapped to the reduced message 607R.

[0058] Some disclosed embodiments analyze the time difference between two messages; for example, the time difference is in... Figure 6B In the log file, it is shown as 620b. Compared to the increment between messages 603 and 604, the time increments between messages 601, 602 and 603 are grouped more closely together (as an example, for messages 604R and 605R, they are shown as entries 620d and 620e).

[0059] Thus, the disclosed embodiments may include messages 601, 602, and 603 in a first block, and messages 604, 605, and 607 in a second block.

[0060] Figure 7A Example table 700A is shown, derived from the analysis of messages from 600B. This analysis will... Figure 6B Each message in a message block, having its corresponding position, is mapped as a message vector. Each message vector consists of multiple elements. The value of each element corresponds to one of the N dimensions of the reduced message block vector.

[0061] exist Figure 7AIn the information set shown as an example in Table 700A, the first row 720 includes a header for each column. The first column 710 stores the message ID of the message. For example, Figure 6B The first message 601R can be assigned a message identifier with a value equal to one (1), the second message 602R can be identified by a second message identifier with a value of two (2), and so on. Alternatively, in some embodiments, table 700A may contain the entire message, not just the message identifier.

[0062] The second column 712 stores vectors for the messages identified in column 710. Each row in rows 721, 722, ..., 749 stores data derived from different messages in the system log. As explained above, each of these messages is processed by at least some of the disclosed embodiments to generate the vector illustrated in column 712. The values ​​of each vector are based on the number of times each message appears in the reduced message log and the message's position in the log file in message order. Although... Figure 7A The illustration shows a five (5) dimensional vector, but various embodiments may include vectors of any order and virtually any dimension.

[0063] Figure 7B An example mapping 700B from message block to message block vector is illustrated, which can be generated by one or more of the disclosed embodiments. Figure 7B Table 700B shows the first row 750, which includes headers for each column. The first column 780 provides the message block ID for the message. Column 782 indicates the sequence of messages assigned to the message block identified by column 780. The number of messages assigned in each message block can be different. For example, the first message block 751 includes eight messages, the second message block 752 includes six messages, the third message block 753 includes four messages, and the fourth message block 754 includes eight messages.

[0064] Column 784 indicates the vector generated for the message block identified by column 780. The vector can be generated using machine learning methods, which will be discussed in more detail below. The vector stored in column 784 can include N dimensions; for simplicity and clarity of explanation, Figure 7B Use N=5.

[0065] Figure 8 This is flowchart 800, used for the training and information storage processes. The following is about… Figure 8 One or more functions discussed in process 800 can be executed by hardware processing circuitry. For example, one or more hardware memories can store instructions that, when executed, configure the hardware processing circuitry to perform one or more functions.

[0066] Some disclosed embodiments use the output of process 800 to cluster message blocks and associate message blocks with remedial actions. As explained above, blocks corresponding to a common root cause are grouped into clusters. Each cluster is then assigned a remedial action that can be taken when the cluster is identified in the monitored system.

[0067] Clusters can be identified by their centroids. A centroid can be represented as a vector. In some embodiments, the elements of the vector represent the average value of the block vectors belonging to that cluster. Alternatively, a cluster can be defined by the boundary of the volume in the vector space occupied by the cluster. Other embodiments may represent clusters of blocks in some other way.

[0068] Process 800 begins at start operation 805 and then moves to operation 810, which identifies the message sequence. In some example embodiments, operation 805 may also determine the position of each message relative to other identified messages.

[0069] In operation 811, the identified message sequence is stored in the training set data. The training set data can be used later to train a machine learning model.

[0070] In operation 812, one or more heuristics are applied to the message sequence leading to 805. In some example embodiments, one or more heuristics may remove parts of the message that are classified as redundant, such as words or phrases. For example, in some example embodiments, data identified within a message can be identified by its relative position within the message itself. In this case, the human-readable label identifying the data may be redundant, or at least unnecessary for further processing. To reduce the size of the data processed by embodiments of this disclosure, in some embodiments, this redundant data is removed. The above relates to relative to Figure 6A of Figure 6B The illustration shows an example of removing a section of a message.

[0071] In operation 813, a dictionary of observed messages is generated, containing entries for identified messages. In embodiments that consider message timing, the dictionary may be generated to include information indicating when each identified message was created. As discussed above, some embodiments consider the elapsed time between messages when clustering messages into blocks. In some aspects, the dictionary generated in operation 813 may include... Figure 6B One or more of the characteristics and / or data fields of dictionary 600B are shown as an example.

[0072] In operation 814, message block boundaries are identified. For example, as described above, some disclosed embodiments may identify message block boundaries based on the elapsed time between messages. For example, messages generated within a first threshold time period may be assigned to a common block, while messages generated after a second threshold time period may be assigned to different blocks. In some example embodiments, message-to-message block assignment may be determined dynamically. For example, a moving average of the elapsed time between a first set of messages may be determined. When a subsequent block is generated at an elapsed time, for example, greater than one standard deviation of the moving average, the subsequent block may be assigned to a different block than the first set of messages. In some embodiments, the system may use heuristics other than timing between messages. For example, in some embodiments, procedure 800 identifies a predetermined condition or expression (e.g., specified by a regular expression definition) indicating the start of a message block. These expressions include, but are not limited to, "PC at..." or "LR at...".

[0073] In operation 815, a message vector is generated for each message or message / timing combination included in the dictionary. The generated message vector comprises N dimensions. Each of the N elements is generated based on one or more specific features of the message. These features may include: message frequency, the message's relative position within a message block, the timing of the message relative to a preceding message, the value of a specific field of the message, or other features. In some example embodiments, vectorization libraries such as Doc2Vec() or Word2Vec() are used to generate the message vectors. In these example embodiments, the dimensions of the vectors may each be based on the entire message. In some example embodiments, the message vectors are stored in a format similar to... Figure 6B In the example data structure.

[0074] The operation proceeds to operation 820, where message block vectors are generated for individual message blocks in the training dataset. These message blocks can be written to the system log from various devices. Some message blocks represent nominal device operations, while others represent abnormal conditions encountered by the device or system as a whole.

[0075] Historical messages in the logs are used to aid training. In some embodiments, the system monitors messages in the system (or error) logs of a specific device before training. According to another embodiment, such as Figure 1 All or some devices in a network such as a network forward their system logs to Figure 1 The network management system 136. According to another embodiment, the device only forwards its logs to the network management system for analysis when an error condition is detected. Monitoring of the system logs occurs within a time period. During this time period, messages belonging to multiple different message blocks can be stored.

[0076] As discussed above, clustering a portion of multiple messages into a single message block can be automatically determined through at least some of the disclosed embodiments. For example, as described above, some embodiments may employ heuristics to cluster messages into blocks, or group messages in other ways, such as based on the creation time of the message(s). In some embodiments, messages clustered by time may be associated with a common message block. In some example embodiments, messages may be clustered based on the technical function or component that generated the messages. For example, messages generated by a specific network interface, a specific device, or a specific software component may be clustered into a first message block, while messages generated by a second device, interface, or software component may be clustered into a second message block. Alternatively, in some embodiments, the manual association of messages with message blocks may be performed. For example, a user interface may be displayed, wherein the user interface is configured to receive input indicating the association. Figure 6B The illustration shows an example of clustering messages into message blocks based on message creation time.

[0077] In some embodiments, the generation of the message block vector for a particular message block is based on the creation date of each message in that block. In some example embodiments, the message block vector may be based on the relative order of the creation dates of each message.

[0078] After generating message block vectors in operation 820, process 800 moves to operation 825, where the message block vectors are clustered. In operation 825, any of a variety of clustering techniques, such as those used for machine learning, can be used to map the message block vectors into clusters. In some example embodiments, a machine learning model can be used to cluster the message blocks. In some example embodiments, clustering message blocks may include defining centroids in a vector space within a predefined distance of two or more message block vectors. A volume within the vector space can then be defined to contain the vectors within the predefined distance. This volume then defines a cluster. Any message or message block vector falling within the defined volume is considered to be included in or associated with the cluster defined by that volume.

[0079] The results of operating the cluster in 825 are as follows: Figure 3B Multiple message block cluster definitions, such as message block cluster 317, are stored in operation 826. A message cluster definition may include, and sometimes does include, an individual value for each of the N elements of a message block vector, and a range of permissible deviations between the element values ​​that may occur from messages that still belong to the cluster.

[0080] In some embodiments, as discussed above, a cluster definition defines a volume within a vector space. Vectors falling within the defined volume are included in or associated with a cluster.

[0081] In operation 827, each message cluster is associated with a nominal system operation or anomaly. In some example embodiments, nominal operation indicates that the monitored system is operating within the Service Level Agreement (SLA) or within the parameters specified in the system specification. An anomaly may occur when system performance deviates from acceptable parameter values ​​or the range specified as nominal. In some embodiments, this classification of each message cluster can be performed automatically. For example, in some example embodiments, a service level metric below a predefined level for a communication session corresponding to a message block in the cluster may be considered to correspond to a good service level cluster, which is used to identify faulty devices in the remaining message block clusters that are not considered to correspond to faulty devices. Although in some embodiments, the labeling of message block clusters is performed automatically (without human input), in some other embodiments, manual labeling may be provided to associate message block clusters with classifications of system behavior and / or performance.

[0082] For a message block cluster associated with an anomalous condition, most or even all of the messages included in the cluster may indicate the anomalous condition and may also indicate the root cause of the anomalous condition. Therefore, remedial actions can be associated with the cluster.

[0083] In operation 835, such as Figure 3B Remedial actions such as Action 326 are associated with at least some clusters related to the anomalous condition. The association between clusters and remedial actions is stored in a database. The database can be relied upon during log file analysis to determine the remedial action to take when a cluster of message blocks is detected.

[0084] Therefore, process 800 generates information for message blocks to be processed in real time, which is then checked to determine whether the message block corresponds to a message block vector cluster for which remedial action should be taken. By taking remedial action in real time, some anomalous conditions can be improved or avoided. For example, in some cases, the “dominant indicators” of an anomalous condition can be detected and improved before users of the system notice any performance degradation. This will be discussed further below.

[0085] Figure 9 This is a flowchart of a process for detecting message blocks, which can be implemented in one or more of the disclosed embodiments. In some example embodiments, one or more functions discussed below can be performed by hardware processing circuitry. In some example embodiments, instructions stored in electronic hardware memory configure the hardware processing circuitry to perform one or more of the functions discussed below. In some example embodiments, the instructions are included in the network management system 136. In some embodiments, the following regarding... Figure 9One or more of the functions discussed can be performed by a device configured to collect system or error logs, or on any other server attached to the network. In some example embodiments, process 900 can be performed in parallel with the storage of messages in the system or error log. In these example embodiments, process 900 can, for example, detect and correct in real time potential errors such as those occurring while the logging of message blocks is in progress. Figure 1 The network described herein refers to the malfunctions or problems encountered by users of networks such as the network described herein, which are due to poor equipment or network performance.

[0086] The method shown in flowchart 900 begins with start operation 905, which corresponds to the processor of the network management system. Operation 905 begins executing instructions of real-time monitoring and network management routines, such as those executed by the processor 306 of the network management system 300. These instructions can be used, and sometimes are used, via... Figure 1 The network management system 136 is shown as an example of a system.

[0087] Method 900 proceeds from start operation 905 to operation 910, which retrieves a message from a log. This log may be a system log or an error log. As described above, in some embodiments, a message from the error log indicates when the message was registered or created in the log. This indication is provided to determine the order and / or elapsed time of messages in a sequence. This timing information is used in conjunction with other heuristics to determine the specific message block corresponding to the message. In at least some embodiments, as previously discussed, individual message blocks correspond to the state of a specific module in a specific device. In embodiments where the network management system is implemented as part of a specific device, the system can monitor messages when they are registered in the system or error log of that specific device.

[0088] In monitoring operation 910, message detection is performed on an ongoing basis, enabling the operation to proceed with the individual detected messages from operation 910 to operation 915. In operation 915, the messages detected by the monitoring performed in operation 910 are associated with new or ongoing message blocks. In operation 915, if the observed message is the start of a new message block, information indicating the specific device and / or module from which the message block is registered is stored. When an additional message corresponding to the same message block is detected, information for each message block is stored and updated. Message-to-message-block matching can be performed by comparing time intervals between consecutive messages or by using other heuristics as described above.

[0089] Method 900 proceeds to operation 916, in which heuristics such as those described above are applied to the original message and used to strip away message elements that convey little or no information about the underlying state of a particular device or the overall system. Typically, the removed message words or phrases are message elements that have been added to the system or error log to make them easily readable by personnel such as IT technicians.

[0090] Method 900 proceeds from operation 916 to operation 917, in which the message block vector is updated based on the message. In some example embodiments, the generation of the message block vector is stateful. The state is based on the previous generation of other messages before the current message is processed. In some example embodiments, this can be related to the following... Figure 11 The process discussed in 1100 essentially performs message block vector generation consistently.

[0091] Operation 918 determines whether the generated message block vector is associated with any defined message block cluster. In some example embodiments, this is done by determining whether each value in the generated message block vector falls within a range of values ​​used to define the message block cluster. For example, whether each of the N element values ​​of the message block vector falls within the range of the corresponding element value in the message cluster definition. In some other example embodiments, the disclosed embodiments may define multiple volumes in a vector space, each volume associated with a specific message block cluster. In some example embodiments, the volumes may be defined via a training process. In these example embodiments, operation 918 determines whether a message block vector is associated with a specific message block cluster by determining whether the vector of the message block vector is contained within a volume associated with the specific message block cluster.

[0092] Operation 920 determines whether the generated message block vector corresponds to a message block cluster associated with nominal performance or an abnormal condition. The decision operation 925 evaluates the cluster. If the cluster is associated with a nominal performance, processing returns to operation 910, where additional messages are processed. Otherwise, if the cluster is associated with an abnormal condition, method 900 moves from decision operation 925 to operation 930.

[0093] In operation 930, a corrective action is identified, i.e., a remedial action is determined by accessing memory to identify the message block vector cluster that matches the message block, and then, in operation 950, the corrective action, such as the remedial action, is implemented. This action may include, and sometimes does include, automatically restarting a component or module of a specific device, restarting the entire device, switching to a backup component, changing the operating parameters of at least one device, etc. In some embodiments, when no specific remedial action is specified, the method proceeds to operation 950 without taking any specific action.

[0094] Operation 900 proceeds from operation 950 to operation 952, in which a report is generated and communicated to the user and / or system administrator. In some embodiments, the report in operation 952 includes generating a problem, troubleshooting, or bug report. Report generation may include automatically opening a bug report in a bug reporting tool such as JIRA. Opening a bug report may also include generating an error message with suggested actions and references to other similar root causes. Some embodiments of method 900 may omit operation 952.

[0095] In addition to or as an alternative to the automatic corrective action in Operation 952, some disclosed embodiments generate alerts indicating problems and potential corrective actions. Alerts may be in the form of text messages, SNMP alert messages, email messages, or pop-up user interfaces on the specified user's terminal. For example, in some embodiments, alerts may be generated... Figure 5 The user interface is displayed on the user monitor 508, thereby notifying the system administrator, for example, by... Figure 1 The message is displayed on monitor 308 of the NMS 136. In this way, users or administrators can understand the problem in an automated manner and take corrective actions or perform system maintenance, which may and sometimes is attached to the automatically performed or recommended corrective actions.

[0096] Correction messages can be executed by sending a message to... Figure 2 The processor 206 of AP 200 is reconfigured with new operating parameters, a newer SF version is downloaded, a specific radio in a given AP is restarted, and one of the APs or one of the network servers is restarted. Similarly, corrective actions can be performed by sending a message to the processor 406 of the offending device 400, such as any faulty server attached to the network, or by sending a power source that is favorable to the operation of such a faulty device.

[0097] Operation 900 proceeds from operation 952 to operation 910, in which monitoring for the next message is performed. In those embodiments where operation 952 is skipped or not performed, operation 900 proceeds from operation 950 to operation 910.

[0098] Figure 10 This is a flowchart of a method 1000 for generating message block vectors for message blocks. In some example embodiments, Figure 8 Operation 820 can perform the following operations: Figure 10 One or more functions are discussed. Procedure 1000 generates a message block vector based on the messages included in the message block.

[0099] After starting block 1001, method 1000 moves to operation 1002. In operation 1002, the messages included in the message block are identified. In operation 1004, the message vector for the identified messages is identified. In operation 1006, the message block vector for the message block is updated based on the message vector identified in operation 1004.

[0100] In operation 1006, the vector for the message block is updated based on the message vector identified in operation 1004. In some example embodiments, operation 1006 utilizes a recurrent neural network (RNN) to generate the message block vector. The RNN can maintain the state information of the message block vector that each iteration of method 1000 depends on.

[0101] In various embodiments, the message block vector for a message block will include the same number of dimensions as the message vector used to generate the message block vector, and therefore include the same number of elements and corresponding values. Thus, in some embodiments, when an N-dimensional message vector is used, the message block vector will also include N dimensions.

[0102] Figure 11 This is a sequence diagram 1100 illustrating how the message block vector is incrementally updated as each message in a processing block is processed. In some example embodiments, the update... Figure 11 The message block vector shown in the figure is related to the one above. Figure 10 The operation of the method discussed is consistent with that of method 1000.

[0103] Rows 1114 and columns 1102 of sequence diagram 1100 provide column and row labels to facilitate understanding of the information shown as examples in each column and row. For example, row 1114 shows the message block state at a given time in the form of a message block vector Vec, which is an updated message block vector for the indicated message time t0, t1, t2, t3, or t4.

[0104] Line 1116 shows the input and output of the machine model at a given time. Each column of line 1118 shows a message vector corresponding to the message shown as an example in the corresponding column of line 1120, which is, for example, the message in the detected block at the time shown as an example in line 1122, such as the message position in the sequence. For illustrative purposes, the message block in this example is taken from... Figure 7B Line 751 (as an example, only the first five messages in the message block are shown).

[0105] Each of columns 1104, 1106, 1108, 1110, and 1112 illustrates the processing of a single message within a message block. In some example embodiments, the temporal order of message processing in sequence list 1100 is equivalent to the second temporal order in which each message is created in the log. Figure 11 This shows that the message block vector for time T is used as input for updating the message block vector for time T+1. Therefore, when Figure 10 When iterating over messages associated with a single message block, Method 1000 updates the message block vector. The state of the message block vector affects the generation of the next version of the message block vector.

[0106] Figure 11 The illustration shows that, in some example embodiments, in response to detecting message MSG 11 at time t0, method 1000 uses message vector V MSG 11 The initial vector is used as input to the RNN. Since MSG 11 is the first message in the message block, the RNN processes the message vector (V) for MSG 11. MSG 11 The message block vector state has an initial default state. In some example embodiments, the initial message block vector state is equivalent to the zero value at each element of the message block vector. Then, the RNN generates the corresponding message block vector state Vect0. The next message MSG 34 is processed at time t1. The message vector V for message MSG 34 is... MSG 34 The input is provided to the RNN, which then generates the state vector Vect1. Note that the state vector Vect1... T1 The generation of Vec depends on the state generated after processing the previous message. T0 Method 1000 continues until all messages associated with the message block have been processed.

[0107] It should be understood that during the training phase, complete message blocks are available for processing. However, during use, message vectors for message blocks are generated and updated as individual messages are observed, for example, in real time, without waiting for the complete message block to be received (or logged in the system log) before attempting to determine whether a message block vector corresponds to a cluster of message block vectors associated with a device fault and also with a correction action.

[0108] In some embodiments, in response to the detection of the start of a message block, such as by detecting a large time gap between individual messages or by using other heuristics as described above, the message block vector is set to an initial starting value. Additional messages in the message block are used to update the message block vector for the message block being processed until the complete set of messages for the detected message block in the training database has been processed and used to update the message block vector, thereby obtaining the final message block vector for the message block.

[0109] Figure 12A This is a flowchart for identifying remedial actions to be taken due to one or more messages included in a log file. In some example embodiments, Figure 12A Method 1200 can operate to analyze messages in the log file as the message is generated. In other words, the message can be processed within a short, finite period of time after it enters the log file (e.g., less than five seconds, less than one second, less than 30 seconds, etc.). In some example embodiments, an event can be triggered when an entry is entered into the log file (the message is written). This event can also initiate the operation of method 1200.

[0110] Alternatively, messages can be processed in batches periodically, such as every 10 minutes, 30 minutes, or an hour.

[0111] The method begins at operation 1202 and proceeds to operation 1205, in which a message is received. As discussed above, messages can be received from a log file. In some example embodiments, receiving a message includes reading the message. The message received in operation 1205 may include the information described above. Figure 6A and / or Figure 6B Any one or more fields of any message shown. In some example embodiments, operation 1205 may include generating message vectors based on messages. In some example embodiments, message vectors may be generated based on libraries provided for vectorization of data. For example, in some example embodiments, message vectors may be generated by the Doc2Vec or Word2Vec libraries, but the disclosed embodiments are not limited to these specific vectorization libraries. The vectorization performed in operation 1205 may generate vectors in a vector space. Vectorization may be stateful, as previous vectorization affects the result of vectorization of messages received in 1205. The stateful nature of vectorization is provided to remember message context. Thus, for example, if a particular sequence of messages is associated with a particular type of system problem, the stateful nature of vectorization at least partially represents this context.

[0112] Some of the disclosed embodiments can implement a publish / subscribe model for messages about a log file. Therefore, when a message is published to a log file, a publish event is generated. Subscribers to the publish event will receive a notification. In these embodiments, method 1200, and particularly operation 1205, can operate in response to receiving an event notification.

[0113] Decision operation 1212 determines whether a message is a new message. In some example embodiments, decision operation 1212 searches a database of previously processed messages, message blocks, and message clusters for messages that are equivalent to or at least similar to the message received in operation 1205. In some embodiments, the search for similar messages may mask one or more fields in the message that are less important for identifying similar messages. In some aspects, edit distance can be used to measure the similarity between two messages.

[0114] If decision operation 1212 does not find a similar or equivalent message, method 1200 moves from decision operation 1212 to operation 1215, whereby operation 1215 initiates a training operation based on the new message. Initiating the training operation may include generating a message vector for the new message and identifying message blocks associated with that message. A description of one embodiment of operation 1215 yields a vector model of message blocks derived from error logs or system logs. Regarding the above... Figure 8 This is described in detail. At the conclusion of rerunning the training process with the new messages, the new messages and their corresponding message vectors can be used for further processing and to determine the corresponding message block vectors. According to some embodiments, the newly invoked training process includes identifying new root causes for the underlying problem and configuring corresponding remedial actions.

[0115] In operation 1220, the message received in operation 1205 is associated with a message block. In some embodiments, messages are associated with message blocks via one or more heuristics. For example, as discussed above, time-grouped messages can be associated with a common message block. In some cases, messages share equivalent keywords, source devices (devices that generate messages), or subsystems / software components / modules that generate messages. In some embodiments, heuristics can use combinations of these message attributes to group messages with shared attributes into message blocks.

[0116] As shown below Figure 13 Some embodiments discussed define one or more of the following message block start, maintenance, or termination criteria or conditions (e.g., fields 1334, 1336, and / or 1338). Therefore, in these embodiments, these conditions are evaluated for the messages received in operation 1205 to determine which conditions in the block definition of block definition table 1330 are met. As described above, conditions may define the maximum elapsed time between messages included in a block, the device or software component that generated the message, keywords included in the message, or other start, maintenance, or termination conditions for the block.

[0117] Operation 1230 determines whether a message can be associated with an existing message block or whether a new block should be generated. If the message is associated with an existing message block, the process proceeds directly to operation 1235. Otherwise, if the message is associated with an existing message block, process 1200 moves from operation 1230 to operation 1235. If the new block is appropriate, process 1200 moves from decision operation 1230 to operation 1232, which generates the new block and adds the message received in operation 1205 to the new block. As discussed above, in at least some aspects, adding a message to a message block includes encoding the contents of the messages included in the block (including the newly added message) into a vector space. Processing then proceeds from operation 1232 to decision operation 1235.

[0118] Decision block 1235 determines whether a message block is associated with a message block cluster. In some example embodiments, decision block 1235 includes comparing the position of the message block, which includes the received message, within a vector space with one or more cluster definitions. A cluster definition defines a volume within the vector space. If the message block vector falls within the volume associated with a particular cluster, then decision block 1235 determines that the message block is “associated” with the message block cluster. Therefore, if the vector generated from the message block (including the message of 1205) is within the volume defined by that cluster, then the message block is associated with that cluster. If the message block is associated with a cluster, process 1200 moves to operation 1245.

[0119] In operation 1245, remedial actions associated with the cluster are performed. Remedial actions may include one or more of the following: restarting a specific component, changing operating parameters, or upgrading a software component from version one to version two. Possible remedial actions are not limited to these examples. In some example embodiments, remediation may include submitting a new bug report to a bug report database. In some example embodiments, a new bug report may be entered via an API provided by the bug report database.

[0120] Figure 12B This is a flowchart of the method used to generate message block vectors. This event can also initiate the operation of method 1250. In some aspects, the following is about... Figure 12B One or more functions under discussion may be included Figure 12A In operation 1220.

[0121] In operation 1262, a message vector is generated from the message content. For example, as discussed below, in at least some embodiments, the content included in the log message can be filtered to remove less relevant information. The remaining content is then fed to a machine learning algorithm to generate a vector in a vector space. In some embodiments, the machine learning algorithm is Word2Vec() or Doc2Vec(). Then, in some embodiments, the message vector is stored. For example, as discussed below... Figure 13 Some of the embodiments discussed maintain message tables that uniquely identify log messages (e.g., table 700A and table 1300 below). The message table stores message vectors generated from the content of the messages (e.g., in field 1306).

[0122] In operation 1264, a message block to be associated with the message (of operation 1262) is determined. In some embodiments, the association between a message and a message block is determined based on one or more criteria. For example, as follows regarding... Figure 13 As discussed, some embodiments maintain message block definitions, such as those described below with respect to Table 1330. In at least some embodiments, the message block definition for a particular block defines start criteria (e.g., a message satisfying the start criteria indicates the first message in the block), maintenance criteria (e.g., a message satisfying the maintenance criteria indicates a message included in the block, but not a message indicating the start or end of the block), or termination criteria (e.g., field 1338). Termination criteria define a message that indicates the last message in the message block.

[0123] In operation 1266, the association between messages and message blocks is stored. For example, in some embodiments, the association is stored in a data structure similar to the data structure in table 700B or message table 1300. As discussed below, field 1308 is provided for identifying the block associated with a particular message.

[0124] In operation 1268, a message block vector is generated based on the vectors of the messages associated with the block. Therefore, operation 1268 identifies any messages associated with a specific message block, and the message vectors generated from the content of those messages. These message vectors are used as input when generating the message block vector for the message block. In some embodiments, a machine learning algorithm is used to generate the message block vector. For example, vectors for individual messages assigned to a message block are provided to the machine learning algorithm, which then provides the message block vector based on these input vectors and their positions within the message block. This approach takes into account the sequence of messages provided to the machine learning algorithm, because if the order of two message vectors is interchanged, the machine learning algorithm will generate different outputs. This sequence can be equivalent to the sequence of messages generated in the log.

[0125] In some other embodiments, the message block vector is generated by averaging the corresponding element values ​​in the message vector.

[0126] Figure 12C This is a flowchart of a method for generating message block vectors. In some aspects, the following is about... Figure 12C One or more of the features discussed are included Figure 12A In operation 1220.

[0127] After starting operation 1275, process 1270 moves to operation 1277, where operation 1277 determines the message block to be associated with the message. As mentioned above, at least regarding... Figure 12B In some embodiments, the association between messages and message blocks is determined based on one or more criteria. For example, as discussed below... Figure 13 As discussed, some embodiments maintain message block definitions, such as those described below with respect to Table 1330. At least in some embodiments, the message block definition for a particular block defines start criteria (e.g., a message satisfying the start criteria indicates the first message in the block), maintenance criteria (e.g., a message satisfying the maintenance criteria indicates messages included in the block, but not messages indicating the start or end of the block), or termination criteria (e.g., field 1338). Termination criteria define messages that indicate the last message in the message block. In some embodiments, messages grouped by time are associated with message blocks. In some embodiments, messages generated by a common device or software module are associated with common message blocks.

[0128] In operation 1278, the association between messages and message blocks is stored. For example, in some embodiments, the association is stored in a data structure similar to the data structure of message table 1300. As discussed below, field 1308 is provided for identifying the block associated with a specific message.

[0129] In operation 1280, a message block vector is generated based on the content of the message associated with the message block. Therefore, in some embodiments, the message content is provided as input to a machine learning model (e.g., Doc2Vec() or Word2Vec()), which generates the message block vector as output. Operation 1280 is the opposite of operation 1268 because the message content is not first mapped into the vector before generating the message block vector. In other words, in operation 1280, the message block vector is not based on the message vector as in operation 1268. Following operation 1281, process 1270 ends at operation 1281.

[0130] Figure 13The illustration shows an example data structure that can be implemented by one or more of the disclosed embodiments. Although below Figure 13 The discussion refers to the data structure illustrated as a relational database table, but those skilled in the art will understand that various embodiments may use various techniques to organize data, including, for example, unstructured data repositories, conventional memory structures such as linked lists, trees, graphs, arrays, or other structures, and the disclosed embodiments are not limited to any particular data structure organization.

[0131] Figure 13 The illustration shows message table 1300, message block table 1310, cluster table 1320, and message block definition table 1330. In some example embodiments, one or more of message table 1300, message block table 1310, cluster table 1320, or message block definition table 1330 may be stored in mass storage device 1416.

[0132] Message table 1300 includes a message identifier 1302, a message content field 1304, a message vector field 1306, and a message block identifier field 1308. The message identifier field 1302 uniquely identifies a specific message. The message content field 1304 stores the values ​​of one or more fields of the message. For example, the message content field 1304 could store the values ​​of the above-mentioned messages. Figures 6A-6B One or more of the message fields discussed. Message vector field 1306 stores the message vector for the message identified by message identifier field 1302 and / or message content field 1306. Message block identifier field 1308 identifies the message block associated with the message. Message block identifier field 1308 may be cross-referenced with message block identifier field 1312 discussed below.

[0133] Message block table 1310 includes a message block identifier field 1312, a message block type identifier 1313, a block vector field 1314, and a cluster identifier field 1316. The message block identifier field 1312 uniquely identifies a message block. The message block type identifier field 1313 identifies the type of the block identified by the message block identifier field 1312. For example, in some embodiments, the message block type identifier field 1313 cross-references the message block type in the message block type definition table 1330 (e.g., via field 1332 discussed below). The block vector field 1314 stores the values ​​of vectors in a defined vector space. The vectors are generated based on the content of the messages included in the message block. The cluster identifier 1316 identifies the message block cluster associated with the message block (identified via 1312). The cluster identifier field 1316 may cross-reference with the cluster identifier field 1322 discussed below.

[0134] Cluster table 1320 includes a cluster identifier field 1322, a cluster range field 1324, and a remedial action field 1326. The cluster identifier field 1322 uniquely identifies a message block cluster and can be cross-referenced with the cluster identifier field 1316. In some example embodiments, the cluster range field 1324 defines a range of values ​​for one or more dimensions of a message vector. In these example embodiments, if the dimension values ​​of a message block vector fall within the range specified by the cluster range / cluster volume field 1324, the corresponding message block associated with the message block vector can also be associated with the cluster (identified via the cluster ID field 1322). In some other example embodiments, the cluster range / cluster volume field 1324 defines a volume in the vector space associated with the cluster identified via the cluster identifier 1322. Message block vectors located within the volume defined by the cluster range / cluster volume field 1324 are considered "associated" with the cluster by the disclosed embodiments. Therefore, when the disclosed embodiments encounter message blocks mapped to these message block vectors, they can trigger the invocation of one or more remedial actions 1226 associated with the cluster as described below.

[0135] The (multiple) remedial action field 1326 identifies one or more remedial actions that can be performed when an event associated with the cluster (identified via the cluster ID field 1322) is detected. Remedial actions may include one or more of the following: restarting or resetting a component or device, changing the operating parameters of one or more components or devices, upgrading the software running on one or more network components or devices, opening a problem report in the problem tracking database, notifying the system administrator, or other remedial actions.

[0136] Message block definition table 1330 stores the conditions that define the boundaries of message blocks. Message block definition table 1330 includes: a block type id field 1332, (multiple) start condition fields 1334, (multiple) sustain condition fields 1336, and (multiple) end condition fields 1338. The block type identifier field 1332 uniquely identifies a specific field block type, i.e., the block defined by the conditions in fields 1334, 1336, and 1338. The (multiple) start condition fields 1334 identify one or more criteria or conditions indicating the start of a message block. Some disclosed aspects can evaluate the conditions defined by the (multiple) start condition fields 1334 to detect the start of a message block of the type identified by the block type identifier field 1332. The (multiple) sustain condition fields 1336 define conditions for a message, providing the conditions for a message to be included in a block of the type defined by the block type identifier field 1332. (Multiple) Termination Condition Field 1338 defines the following criteria or conditions: the criteria or conditions define the end of a block of the type identified by the Block Type Identifier Field 1332.

[0137] Figure 14 A block diagram of an example machine 1400 is illustrated, on which any one or more of the techniques (e.g., methods) discussed herein can be performed. The machine (e.g., computer system) 1400 may include a hardware processor 1402 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), main memory 1404, and static memory 1406, some or all of which may communicate with each other via interconnect links (e.g., buses) 1408.

[0138] Specific examples of main memory 1404 include random access memory (RAM) and semiconductor memory devices, which in some embodiments may include storage locations in semiconductors such as registers. Specific examples of static memory 1406 include non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; disks, such as internal hard disks and removable disks; magneto-optical disks; RAM; and CD-ROM and DVD-ROM disks.

[0139] Machine 1400 may also include a display device 1410, an input device 1412 (e.g., a keyboard), and a user interface (UI) navigation device 1414 (e.g., a mouse). In the example, the display device 1410, input device 1412, and UI navigation device 1414 may be a touchscreen display. Machine 1400 may additionally include a mass storage device (e.g., a drive unit) 1416, a signal generation device 1418 (e.g., a speaker), a network interface device 1420, and one or more sensors 1421, such as a Global Positioning System (GPS) sensor, a compass, an accelerometer, or any other sensor. Machine 1400 may include an output controller 1428, such as a serial (e.g., Universal Serial Bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection, to transmit or control one or more peripheral devices (e.g., a printer, a card reader, etc.). In some embodiments, processor 1402 and / or instruction 1424 may include processing circuitry and / or transceiver circuitry.

[0140] Storage device 1416 may include machine-readable medium 1422 on which one or more data structures or sets of instructions 1424 (e.g., software) are stored, which are embodied in or utilized by any one or more technologies or functions described herein. Instructions 1424 may also reside wholly or at least partially within main memory 1404, static memory 1406, or hardware processor 1402 during execution by machine 1400. In this example, one or any combination of hardware processor 1402, main memory 1404, static memory 1406, or storage device 1416 may constitute a machine-readable medium.

[0141] Specific examples of machine-readable media may include: non-volatile memory, such as semiconductor storage devices (e.g., EPROM or EEPROM) and flash memory devices; disks, such as internal hard disks and removable disks; magneto-optical disks; RAM; and CD-ROM and DVD-ROM disks.

[0142] Although machine-readable medium 1422 is illustrated as a single medium, the term "machine-readable medium" can include a single medium or multiple media (e.g., a centralized or distributed database and / or associated caches and servers) configured to store one or more instructions 1424.

[0143] The apparatus of machine 1400 may be one or more of the following: a hardware processor 1402 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), main memory 1404 and static memory 1406, a sensor 1421, a network interface device 1420, an antenna 1460, a display device 1410, an input device 1412, a UI navigation device 1414, a mass storage device 1416, an instruction set 1424, a signal generation device 1418, and an output controller 1428. The apparatus may be configured to perform one or more of the methods and / or operations disclosed herein. The apparatus may be intended to be used as a component of machine 1400 to perform one or more of the methods and / or operations disclosed herein, and / or to perform a portion thereof. In some embodiments, the apparatus may include pins or other means for receiving power. In some embodiments, the apparatus may include power regulation hardware.

[0144] The term "machine-readable medium" can include any medium capable of storing, encoding, or carrying instructions or data structures used or associated with such instructions for execution by machine 1400 and causing machine 1400 to perform any one or more techniques of this disclosure. Examples of non-limiting machine-readable media can include solid-state memory as well as optical and magnetic media. Specific examples of machine-readable media can include: non-volatile memory such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable hard disks; magneto-optical disks; random access memory (RAM); and CD-ROM and DVD-ROM disks. In some examples, machine-readable media can include non-transient machine-readable media. In some examples, machine-readable media can include machine-readable media that do not transmit signals transiently.

[0145] Commands 1424 can also be transmitted or received on the communication network 1426 via the network interface device 1420 using a transmission medium, utilizing any of a variety of transport protocols (e.g., Frame Relay, Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), etc.). Example communication networks may include local area networks (LANs), wide area networks (WANs), packet data networks (e.g., the Internet), mobile phone networks (e.g., cellular networks), conventional telephone (POTS) networks, and wireless data networks (e.g., IEEE 802.11 series guidelines known as Wi-Fi®, IEEE 802.16 series guidelines known as WiMax®), IEEE 802.15.4 series guidelines, Long Term Evolution (LTE) series guidelines, Universal Mobile Telecommunications System (UMTS) series guidelines, peer-to-peer (P2P) networks, etc.

[0146] In the example, network interface device 1420 may include one or more physical jacks (e.g., Ethernet, coaxial cable, or telephone jacks) or one or more antennas for connection to communication network 1426. In the example, network interface device 1420 may include one or more antennas 1460 for wireless communication using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technologies. In some examples, network interface device 1420 may use multi-user MIMO technology for wireless communication. The term "transmission medium" should be considered to include any intangible medium capable of storing, encoding, or carrying instructions executed by machine 1300, and includes digital or analog communication signals or other intangible media to facilitate communication of such software. In another embodiment (not shown), network interface device 1420 is directly connected / coupled to network 1426.

[0147] As described herein, examples may include or be operable on logic or multiple components, modules, or mechanisms. A module is a tangible entity (e.g., hardware) capable of performing a specified operation and may be configured or arranged in a certain way. In the examples, circuitry (e.g., internally or relative to an external entity such as other circuitry) may be arranged as a module in a specified manner. In the examples, all or part of one or more computer systems (e.g., standalone, client, or server computer systems) or one or more hardware processors may be configured by firmware or software (e.g., instructions, application portions, or applications) to perform the specified operation. In the examples, the software may reside on a machine-readable medium. In the examples, when executed by the underlying hardware of the module, the software causes the hardware to perform the specified operation.

[0148] Accordingly, the term "module" should be understood to include tangible entities that are physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., provisionally) configured (e.g., programmed) to operate in a specified manner or perform any part or all of the operations described herein. Considering examples where modules are provisionally configured, each module does not need to be instantiated at any given time. For example, in the case where a module includes a general-purpose hardware processor configured using software, the general-purpose hardware processor can be configured as different modules at different times. The software can accordingly configure the hardware processor, for example, to constitute a specific module at one time instance and different modules at different time instances.

[0149] Some embodiments may be implemented wholly or partially in software and / or firmware. This software and / or firmware may take the form of instructions contained in or on a non-transitory computer-readable storage medium. Those instructions may then be read and executed by one or more processors to enable the performance of the operations described herein. The instructions may be in any suitable form, such as, but not limited to, source code, compiled code, interpreted code, executable code, static code, dynamic code, etc. Such computer-readable medium may include any tangible non-transitory medium for storing information in one or more computer-readable forms, such as, but not limited to, read-only memory (ROM); random access memory (RAM); disk storage media; optical storage media; flash memory, etc.

[0150] As described herein, examples may include or be operable on logic or multiple components, modules, or mechanisms. A module is a tangible entity (e.g., hardware) capable of performing a specified operation and may be configured or arranged in a certain way. In the examples, circuitry (e.g., internally or relative to an external entity such as other circuitry) may be arranged as a module in a specified manner. In the examples, all or part of one or more computer systems (e.g., standalone, client, or server computer systems) or one or more hardware processors may be configured by firmware or software (e.g., instructions, application portions, or applications) to perform the specified operation. In the examples, the software may reside on a machine-readable medium. In the examples, when executed by the underlying hardware of the module, the software causes the hardware to perform the specified operation.

[0151] Example 1 is a method that includes: assigning multiple log messages to a first message block based on criteria; generating a message block vector in a vector space based on the content of the messages assigned to the first message block; determining that the position of the message block vector in the vector space is within a defined volume in the vector space, the defined volume being associated with an action; and executing the action based on the determination.

[0152] In Example 2, the subject of Example 1 may optionally include: generating a message vector for each of a plurality of log messages, wherein the generation of the message block vector is based on each message vector in the message vector.

[0153] In Example 3, any one or more of the topics in Examples 1-2 may optionally include: receiving a first log message; assigning the first log message to a second message block; generating a second message block vector in a vector space based on the assignment and the message assigned to the second message block including the first log message; determining that a second position of the second message block vector in the vector space is not within a defined volume in the vector space; and prohibiting the execution of any remedial action in response to the second determination.

[0154] In Example 4, the subject of Example 3 may optionally include: assigning a second plurality of messages to a second message block based on a second criterion; generating a third message block vector based on the second plurality of messages and a first log message; determining a third position of the third message block vector in the vector space within a second defined volume of the vector space; and selectively performing a second action associated with the second volume in response to the third determination.

[0155] In Example 5, any one or more of the topics in Examples 3-4 may optionally include: stripping information from a first log message, wherein the generation of a second message block vector is based on the stripped log message.

[0156] In Example 6, any one or more of the topics in Examples 1-5 may optionally include: wherein the generation of message block vectors includes: providing the contents of multiple log messages to a machine learning algorithm, and the machine learning algorithm outputting message block vectors.

[0157] In Example 7, the subject of Example 6 may optionally include Word2Vec() or Doc2Vec().

[0158] In Example 8, any one or more of the topics in Examples 1-7 may optionally include: wherein the criteria identify: log messages generated within a time window, or log messages including multiple keywords.

[0159] In Example 9, any one or more of the topics in Examples 1-8 may optionally include: where the remedial action is to restart the computer, upgrade the software of a network device, change the operating parameters of the network device, or comment on a problem report in the problem tracking database.

[0160] In Example 10, the subject of one or more examples from Examples 1-9 may optionally include: a first determination that a first log message does not meet a criterion, and a second determination that the first log message meets a second criterion associated with a second message block, and in response to the first determination and the second determination, associating the first log message with the second message block.

[0161] Example 11 is a non-transient computer-readable storage medium including instructions that, when executed, configure hardware processing circuitry to perform operations including: assigning multiple log messages to a first message block based on criteria; generating a message block vector in a vector space based on the content of the messages assigned to the first message block; determining that the position of the message block vector in the vector space is within a defined volume in the vector space, the defined volume being associated with an action; and performing the action based on the determination.

[0162] In Example 12, the subject of Example 11 may optionally include: the operation further includes: for each of the multiple log messages, generating a message vector, wherein the generation of the message block vector is based on each message vector in the message vector.

[0163] In Example 13, the subject of any one or more of Examples 11-12 may optionally include: the operation further includes: receiving a first log message; and assigning the first log message to a second message block; based on the assignment, generating a second message block vector in a vector space based on the message assigned to the second message block including the first log message; second determining that a second position of the second message block vector in the vector space is not within a defined volume of the vector space; and in response to the second determination, prohibiting the execution of any remedial action.

[0164] In Example 14, the subject of Example 13 may optionally include: the operation further includes: assigning a second plurality of messages to a second message block based on a second criterion; and generating a third message block vector based on the second plurality of messages and a first log message; third determining that a third position of the third message block vector in the vector space is within a second defined volume of the vector space; and selectively performing a second action associated with the second volume in response to the third determination.

[0165] In Example 15, any one or more of the topics in Examples 13-14 may optionally include: the operation further includes: stripping information from the first log message, wherein the generation of the second message block vector is based on the stripped log message.

[0166] In Example 16, any one or more of the topics in Examples 11-15 may optionally include: wherein the generation of the message block vector includes: providing the contents of multiple log messages to a machine learning algorithm, and the machine learning algorithm outputting the message block vector.

[0167] In Example 17, the subject of Example 16 may optionally include Word2Vec() or Doc2Vec().

[0168] In Example 18, the subject of one or more examples from Examples 11-17 may optionally include: wherein the criterion identifies: log messages generated within a time window, or log messages including multiple keywords.

[0169] In Example 19, any one or more of the topics in Examples 11-18 may optionally include: performing remedial actions such as restarting a computer, upgrading the software of a network device, changing the operating parameters of a network device, or commenting on a problem report in a problem tracking database.

[0170] In Example 20, the subject of one or more examples in Examples 11-19 may optionally include: the operation further includes: first determining that the first log message does not meet the criteria, and second determining that the first log message meets the second criteria associated with the second message block, and associating the first log message with the second message block in response to the first determination and the second determination.

[0171] Example 21 is an apparatus comprising: a module for assigning a plurality of log messages to a first message block based on criteria; a module for generating a message block vector in a vector space based on the content of the messages assigned to the first message block; a module for determining the position of the message block vector in the vector space within a defined volume in the vector space, the defined volume being associated with an action; and a module for performing the action based on the determination.

[0172] In Example 22, the subject of Example 21 may optionally include a module for generating a message vector for each of a plurality of log messages, wherein the generation of the message block vector is based on each message vector in the message vector.

[0173] In Example 23, the subject of any one or more of Examples 21-22 may optionally include: a module for receiving a first log message; a module for assigning the first log message to a second message block; a module for generating a second message block vector in a vector space based on the assignment and the message assigned to the second message block including the first log message; a module for second determination that a second position of the second message block vector in the vector space is not within a defined volume in the vector space; and a module for prohibiting any remedial action in response to the second determination.

[0174] In Example 24, the subject of Example 23 may optionally include: a module for assigning a second plurality of messages to a second message block based on a second criterion; a module for generating a third message block vector based on the second plurality of messages and a first log message; a module for thirdly determining that a third position of the third message block vector in the vector space is within a second defined volume in the vector space; and a module for selectively performing a second action associated with the second volume in response to the third determination.

[0175] In Example 25, any one or more of the topics in Examples 23-24 may optionally include a module for stripping information from a first log message, wherein the module for generating a second message block vector is configured to generate a log message based on the stripped information.

[0176] In Example 26, the subject of one or more of the examples in Examples 21-25 may optionally include: wherein the module for generating message block vectors is configured to provide the contents of multiple log messages to a machine learning algorithm, and the machine learning algorithm outputs message block vectors.

[0177] In Example 27, the subject of Example 26 may optionally include Word2Vec() or Doc2Vec().

[0178] In Example 28, the subject of one or more examples from Examples 21-27 may optionally include: wherein the criterion identifier is: a log message generated within a time window, or a log message including multiple keywords.

[0179] In Example 29, the subject of one or more of the examples 21-28 may optionally include a module for performing remedial actions configured to restart a computer, upgrade the software of a network device, change the operating parameters of a network device, or comment on a problem report in a problem tracking database.

[0180] In Example 30, the subject of one or more examples in Examples 21-29 may optionally include: a module for first determining that a first log message does not meet the criteria, a module for second determining that a first log message meets the second criteria associated with a second message block, and a module for associating the first log message with the second message block in response to the first log message meeting the second criteria.

[0181] Example 31 is a system comprising: hardware processing circuitry; one or more hardware memories storing instructions that, when executed, configure the hardware processing circuitry to perform operations including: assigning a plurality of log messages to a first message block based on criteria; generating a message block vector in a vector space based on the content of the messages assigned to the first message block; determining that the position of the message block vector in the vector space is within a defined volume in the vector space, the defined volume being associated with an action; and performing the action based on the determination.

[0182] In Example 32, the subject of Example 31 may optionally include: generating a message vector for each of a plurality of log messages, wherein the generation of the message block vector is based on each message vector in the message vector.

[0183] In Example 33, the subject of any one or more of Examples 31-32 may optionally include: receiving a first log message; assigning the first log message to a second message block; based on the assignment, generating a second message block vector in a vector space based on the message assigned to the second message block including the first log message; second determining that a second position of the second message block vector in the vector space is not within a defined volume of the vector space; and prohibiting the execution of any remedial action in response to the second determination.

[0184] In Example 34, the subject of Example 33 may optionally include: assigning a second plurality of messages to a second message block based on a second criterion; generating a third message block vector based on the second plurality of messages and a first log message; third determining that a third position of the third message block vector in the vector space is within a second defined volume of the vector space; and selectively performing a second action associated with the second volume in response to the third determination.

[0185] In Example 35, the subject of one or more of the examples in Examples 33-34 may optionally include: stripping information from a first log message, wherein the generation of a second message block vector is based on the stripped log message.

[0186] In Example 36, the subject of one or more examples in Examples 31-35 may optionally include: wherein the generation of message block vectors includes: providing the contents of multiple log messages to a machine learning algorithm, and the machine learning algorithm outputting message block vectors.

[0187] In Example 37, the subject of Example 36 may optionally include Word2Vec() or Doc2Vec().

[0188] In Example 38, the subject of one or more of the examples in Examples 31-37 may optionally include: wherein the criterion identifies: log messages generated within a time window, or log messages including multiple keywords.

[0189] In Example 39, the topics of any one or more of Examples 31-38 may optionally include: where the remedial action is to restart the computer, upgrade the software of the network device, change the operating parameters of the network device, or comment on a problem report in the problem tracking database.

[0190] In Example 40, the subject of any one or more of Examples 31-39 may optionally include: a first determination that a first log message does not meet a criterion, and a second determination that the first log message meets a second criterion associated with a second message, and in response to the first determination and the second determination, associating the first log message with a second message block.

[0191] Various embodiments may be implemented wholly or partially in software and / or firmware. This software and / or firmware may take the form of instructions contained in or on a non-transitory computer-readable storage medium. Those instructions may then be read and executed by one or more processors to enable the performance of the operations described herein. The instructions may be in any suitable form, such as, but not limited to, source code, compiled code, interpreted code, executable code, static code, dynamic code, etc. Such computer-readable medium may include any tangible non-transitory medium for storing information in one or more computer-readable forms, such as, but not limited to, read-only memory (ROM); random access memory (RAM); disk storage media; optical storage media; flash memory, etc.

[0192] This document describes certain embodiments as including logic or multiple components, modules, or mechanisms. Modules can constitute software modules (e.g., code embodied on a machine-readable medium or in transmitted signals) or hardware modules. A hardware module is a tangible unit capable of performing certain operations and can be configured or arranged in a certain way. In example embodiments, one or more computer systems (e.g., standalone, client, or server computer systems) or one or more hardware modules of a computer system (e.g., processors or groups of processors) can be configured by software (e.g., an application or application portion) to operate to perform some of the operations described herein.

[0193] In various embodiments, the hardware module can be implemented mechanically or electronically. For example, the hardware module may include dedicated circuitry or logic that is permanently configured (e.g., as a dedicated processor, such as a field-programmable gate array (FPGA) or application-specific integrated circuit (ASIC)) to perform certain operations. The hardware module may also include programmable logic or circuitry (e.g., contained within a general-purpose processor or other programmable processor) that is temporarily configured by software to perform certain operations. It will be appreciated that the decision to implement the hardware module mechanically in a dedicated and permanently configured circuit or in a temporarily configured circuit (e.g., configured by software) can be driven by considerations of cost and time.

[0194] Therefore, the term "hardware module" should be understood to include tangible entities that are physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain way and / or perform certain operations described herein. Consider embodiments where hardware modules are temporarily configured (e.g., programmed), where each hardware module does not need to be configured or instantiated at any given time. For example, in cases where hardware modules include general-purpose processors configured using software, the general-purpose processor can be configured as different hardware modules at different times. The software can accordingly configure the processor, for example, to constitute a specific hardware module at one time instance and different hardware modules at different time instances.

[0195] Hardware modules can provide and receive information from other hardware modules. Therefore, the described hardware modules can be considered communication-coupled. When multiple such hardware modules exist simultaneously, communication can be achieved through signal transmission (e.g., through appropriate circuitry and buses connecting the hardware modules). In embodiments where multiple hardware modules are configured or instantiated at different times, such communication between hardware modules can be achieved, for example, by storing and retrieving information in a memory structure accessible to the multiple hardware modules. For example, one hardware module can perform an operation and store the output of that operation in a memory device to which it is communication-coupled. Another hardware module can then access the memory device at a later time to retrieve and process the stored output. Hardware modules can also initiate communication with input or output devices and can operate on resources (e.g., collections of information).

[0196] The various operations of the example methods described herein can be performed, at least in part, by one or more processors (e.g., by software) temporarily or permanently configured to perform the relevant operations. Whether temporarily or permanently configured, such processors can constitute processor-implemented modules that operate to perform one or more operations or functions. In some example embodiments, the modules referred to herein may include processor-implemented modules.

[0197] Similarly, the methods described herein can be implemented at least in part by a processor. For example, at least some operations of a method can be performed by one or more processors or modules implemented by processors. The execution of certain operations can be distributed among one or more processors, not only residing within a single computer but also deployed across multiple computers. In some example embodiments, one or more processors may reside in a single location (e.g., in a home environment, office environment, or server farm), while in other embodiments, the processors may be distributed across multiple locations.

[0198] One or more processors may also operate to support the execution of related operations in a “cloud computing” environment or as “Software as a Service” (SaaS). For example, at least some operations may be executed by a group of computers (as an example of a machine that includes processors) and may be accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., APIs).

[0199] The example embodiments may be implemented as digital electronic circuits, or as computer hardware, firmware or software, or a combination thereof. The example embodiments may be implemented using a computer program product, such as a computer program tangibly embodied in an information carrier, such as a machine-readable medium, to be executed by or to control the operation of a data processing device, such as a programmable processor, a computer, or multiple computers.

[0200] Computer programs can be written in any programming language (including compiled or interpreted languages) and can be deployed in any form, including as standalone programs or as modules, subroutines, or other units suitable for use in a computing environment. Computer programs can be deployed to be executed on one or more computers at a single site, or distributed across multiple sites and interconnected via a communication network.

[0201] In the example embodiments, the operations can be performed by one or more programmable processors that execute computer programs to perform functions by manipulating input data and generating output. The method operations can also be performed by dedicated logic circuitry (e.g., an FPGA or ASIC), and the apparatus of the example embodiments can be implemented as dedicated logic circuitry (e.g., an FPGA or ASIC).

[0202] Computing systems may include clients and servers. Clients and servers are typically geographically isolated and usually interact via a communication network. The client-server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. In embodiments of deploying programmable computing systems, it will be recognized that both hardware and software architectures are worth considering. Specifically, it will be recognized that the choice of implementing certain functionality in permanently configured hardware (e.g., ASIC), in temporarily configured hardware (e.g., a combination of software and a programmable processor), or in a combination of permanently configured and / or temporarily configured hardware may be a design choice.

[0203] Although embodiments of the present disclosure have been described with reference to specific example examples, it will be apparent that various modifications and changes can be made to these embodiments without departing from the broader scope of the subject matter. Therefore, the specification and drawings should be considered illustrative rather than restrictive. The drawings, which form a part thereof, illustrate specific embodiments in which the subject matter can be practiced by way of illustration rather than limitation. The illustrated embodiments have been described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments may be used and derived therefrom, such that structural and logical substitutions and changes can be made without departing from the scope of the present disclosure. Therefore, this detailed description should not be construed in a limiting sense, and the scope of the various embodiments is defined only by the appended claims and the full scope of their equivalents.

[0204] For convenience only, these embodiments of the subject matter of this invention may be referred to herein individually and / or in whole by the word "invention," and are not intended to automatically limit the scope of this application to any single invention or inventive concept—if multiple are actually disclosed. Therefore, although specific embodiments have been illustrated and described herein, it should be understood that any arrangement devised to achieve the same purpose may replace the specific embodiments shown. This disclosure is intended to cover any and all modifications or variations of the various embodiments. Combinations of the above embodiments, as well as other embodiments not specifically described herein, will be apparent to those skilled in the art upon review of the foregoing description.

[0205] All publications, patents, and patent documents cited in this document are incorporated herein by reference in their entirety, as if they were incorporated individually by reference. In the event of any inconsistency between the usage in this document and those documents incorporated by reference, the usage in the incorporated reference shall be considered supplementary to this document; in the case of irreconcilable inconsistencies, the usage in this document shall prevail.

[0206] In this document, as is common in patent documents, the words “a” or “an” are used to include one or more, unrelated to any other instance or use of “at least one” or “one or more.” In this document, the term “or” is used to refer to non-exclusivity, such that “A or B” includes: “A but not B,” “B but not A,” and “A and B,” unless otherwise stated. In the appended claims, the terms “comprising” and “wherein” are used as concise English equivalents to the corresponding terms “including” and “in which.” Furthermore, in the appended claims, the terms “comprising” and “including” are open-ended; that is, a system, apparatus, article, or process that includes elements other than those listed after this term in the claim is still considered to be within the scope of the claim.

Claims

1. A method comprising: Log messages received from one of multiple access point (AP) devices are grouped together with associated log message blocks by one or more processors. The one or more processors generate message vectors based on the log messages; The one or more processors update the message block vector associated with the relevant log message block based on the message vector; The one or more processors determine the updated message block vector within a multidimensional volume in the vector space associated with anomalies in the wireless network. as well as The one or more processors automatically invoke remedial actions associated with the multidimensional volume, wherein the remedial actions include automatically reconfiguring at least one of the plurality of AP devices.

2. The method of claim 1, wherein the related log message block comprises a plurality of historical log messages related based on at least one of the following: the arrival time of each historical log message, the generation time of each historical log message, the content of each historical log message, or a component that generates each historical log message.

3. The method according to claim 1, wherein grouping the log message with related log message blocks further includes grouping the log message with related log message blocks based on the content of the log message.

4. The method according to claim 1, wherein grouping the log message with related log message blocks further includes grouping the log message with related log message blocks based on either the arrival time of the log message or the generation time of the log message.

5. The method of claim 1, wherein automatically invoking the remedial action comprises at least one of the following: automatically invoking a restart of a specific radio in at least one of the plurality of AP devices or automatically invoking an increase in the AP transmission power level of at least one of the plurality of AP devices.

6. The method of claim 1, wherein the message vector comprises N dimensions and the message block vector comprises N dimensions.

7. The method of claim 1, wherein the message vector comprises N dimensions, and wherein the value of each dimension is generated based on one or more features of the log message.

8. The method of claim 7, wherein the one or more features of the log message include the frequency of the log message, the relative position of the log message within a message block, the timing between the log message and a preceding log message, one or more fields of the log message, or the log message as a whole.

9. The method according to claim 1, wherein the log message is a first log message, the message vector is a first message vector, the related log message block is a first related message block, the message block vector is a first message block vector, and the multidimensional volume is a first multidimensional volume, the method further comprising: The second log message received by the one or more processors from one of the plurality of access point AP devices is grouped together with a second related log message block; The one or more processors generate a second message vector based on the second log message; The one or more processors update the second message block vector associated with the second related log message block based on the second message vector; as well as The one or more processors determine that the updated second message block vector is located within a second multidimensional volume in the vector space, associated with the nominal operation of the wireless network.

10. A system comprising: Multiple access point (AP) devices; as well as A network management system includes at least one processor, said at least one processor being configured to: Log messages received from one of the multiple AP devices are grouped together with related log message blocks; Generate a message vector based on the log message; Update the message block vector associated with the relevant log message block based on the message vector; The updated message block vector is determined to be within a first multidimensional volume associated with anomalies in the wireless network, among multiple multidimensional volumes; as well as Automatically invoke remedial actions associated with the first multidimensional volume, wherein the remedial actions include automatically reconfiguring at least one of the plurality of AP devices.

11. The system of claim 10, wherein the associated log message block comprises a plurality of historical log messages associated with at least one of the following: the arrival time of each historical log message, the generation time of each historical log message, the content of each historical log message, or a component that generates each historical log message.

12. The system of claim 10, wherein the processor is further configured to group the log message together with the associated log message block based on the content of the log message.

13. The system of claim 10, wherein the processor is further configured to group the log message with the associated log message block based on either the arrival time of the log message or the generation time of the log message.

14. The system of claim 10 further includes a memory storing associations between a plurality of multidimensional volumes and a plurality of remedial actions, wherein each of the plurality of multidimensional volumes is associated with either a nominal operation of the wireless network or an anomalous condition of the wireless network.

15. The system of claim 14, wherein each of the plurality of multidimensional volumes associated with the anomalous condition is further associated with at least one of the plurality of remedial actions.

16. The system of claim 10, wherein, in order to automatically invoke the remedial action, the processor is further configured to automatically invoke a restart of a specific radio in at least one of the plurality of AP devices, or to automatically invoke an increase in the AP transmission power level of at least one of the plurality of AP devices.

17. The system of claim 10, wherein the message vector comprises N dimensions and the message block vector comprises N dimensions.

18. The system of claim 10, wherein the message vector comprises N dimensions, and wherein the value of each dimension is generated based on one or more features of the log message.

19. The system of claim 18, wherein the one or more features of the log message include the frequency of the log message, the relative position of the log message within a message block, the timing between the log message and a preceding log message, one or more fields of the log message, or the log message as a whole.

20. A non-transient computer-readable storage medium, comprising instructions that, when executed, configure hardware processing circuitry to: Log messages received from one of the multiple AP devices are grouped together with related log message blocks; Generate a message vector based on the log message; Update the message block vector associated with the relevant log message block based on the message vector; Determine that the updated message block vector is within the first multidimensional volume of a plurality of multidimensional volumes; as well as Automatically invoke remedial actions associated with the first multidimensional volume, wherein the remedial actions include automatically reconfiguring at least one of the plurality of AP devices.

Images