Aircraft Log Alert Filtering Using Event Hashing Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current airplane system logs are accessed only reactively when a problem arises, lacking proactive processing and generating nuisance alerts, which inefficiently uses processing resources and storage.
Innovation Solution
An airplane system log processor that automatically processes logs, combines system messages via a rule set to generate alerts, hashes events to differentiate and suppress duplicates, and sets alert thresholds to avoid nuisance alerts, while capturing actionable insights and storing them efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If system logs are accessed reactively only when problems arise, then storage resources are consumed by retaining all log data, but processing efficiency deteriorates due to lack of automated filtering and alert generation
Solution Approach 1:
The system performs preliminary automated processing of log files by scanning, parsing, and analyzing them as they are received, before problems actually occur. This includes generating alerts proactively based on detected conditions, suppressing duplicate alerts, and maintaining alert histories. By performing these actions in advance rather than reactively, the system improves processing efficiency while reducing the need to retain and manually analyze all raw log data, thus conserving processing resources.
2Loss of information
If all system messages are processed and alerts generated for every error event, then operational awareness is improved, but nuisance alerts increase causing information overload
Solution Approach 1:
The system extracts and processes only the most significant error events that meet specific alert criteria, rather than generating alerts for all possible log entries. The alert generation logic selectively identifies meaningful events while filtering out routine or non-critical occurrences. This extraction approach maintains operational awareness of important issues while eliminating nuisance alerts that would otherwise create information overload.
Solution Approach 2:
The system implements feedback mechanisms through alert suppression logic that tracks previously generated alerts and suppresses duplicate or redundant alerts within specified time windows. The alert history is maintained and referenced to prevent generating the same alert repeatedly for persistent conditions. This feedback loop ensures that only new or changed conditions trigger alerts, reducing nuisance alerts while maintaining awareness of ongoing issues.
3Difficulty of detecting and measuring
If comprehensive log analysis is performed to generate detailed alerts, then diagnostic capability is improved, but processing time increases
Solution Approach 1:
The log analysis process is segmented into distinct stages: initial scanning for error events, filtering against alert criteria, grouping related events, generating alerts for significant conditions, and maintaining suppression histories. This segmentation allows the system to process logs efficiently by handling only relevant portions at each stage rather than performing comprehensive analysis on all log data uniformly. Critical diagnostic information is extracted quickly through this structured approach.
Solution Approach 2:
The system applies different processing depths to different portions of log data based on their significance. High-priority error events that meet alert criteria undergo detailed analysis and alert generation, while routine or low-priority events receive minimal processing. This local quality approach ensures that diagnostic capability is applied where most needed while reducing overall processing time by avoiding uniform deep analysis of all log entries.
Data Source
AI summary
Systems, apparatuses, and methods provide for looping through a plurality of airplane system alert types. An alert rule associated with individual airplane system alert types is determined, where the alert rule has an alert threshold associated with a category type. An airplane log datastore is scanned for error events associated with the alert rule. The error events are grouped based at least in part on the category type. A determination is made as to whether a group of error events meets the alert threshold. The group of error events is ignored in response to the alert threshold not being met.