Event Log Extraction for Faster Root Cause Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In industrial network systems, unskilled users face difficulties in analyzing vast event logs to identify the root cause of events, especially when multiple events are interconnected, leading to time-consuming and often impossible tasks.
Innovation Solution
An information processing device that displays event logs, allows users to designate attention events, and extracts relevant logs based on predetermined rules, facilitating the display of attention and relevant event logs for easy identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If event logs are collected from multiple slave devices in a master-slave control system, then the completeness of event data is improved, but the complexity of analyzing event logs increases
Solution Approach 1:
The patent segments the vast event logs by extracting and displaying only the relevant events related to the user-selected attention event. The extraction part divides the event logs into relevant and irrelevant portions based on predetermined rules, allowing users to focus on segmented, meaningful data rather than overwhelming comprehensive logs.
Solution Approach 2:
The patent introduces an intermediary information processing device that acts as a mediator between the raw event logs and the user. This device automatically extracts relevant events using predetermined rules and presents them in a simplified format, serving as an intermediary that translates complex log data into actionable insights for unskilled users.
2Loss of information
If all event logs are displayed to unskilled users, then the completeness of information is improved, but the ease of operation deteriorates
Solution Approach 1:
The patent extracts only the relevant events from the complete event logs based on predetermined rules and displays them separately. The extraction part identifies and removes irrelevant information, presenting only the essential events related to the attention event, thus maintaining information completeness while improving ease of operation.
Solution Approach 2:
The patent applies local quality by providing different information presentations for different user needs. The display control part shows relevant events with enhanced visibility (different background color, positioning) while keeping the complete event logs available but less prominent, allowing unskilled users to easily access important information without being overwhelmed by all data.
3Measurement precision
If unskilled users manually analyze vast event logs to identify root causes, then the measurement precision of event analysis is improved, but the loss of time increases
Solution Approach 1:
The patent performs preliminary action by automatically extracting relevant events from the complete event logs before presenting them to users. The extraction part pre-processes the data according to predetermined rules, identifying and separating relevant events in advance, so users receive pre-processed, organized information that requires minimal additional analysis time while maintaining accuracy.
Solution Approach 2:
The patent implements feedback by allowing users to select attention events and immediately receiving automatically extracted relevant events as feedback. This feedback mechanism provides users with precisely the information they need based on their selections, enabling rapid iterative analysis without manual searching through vast logs, thus reducing time loss while maintaining measurement precision.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The purpose of the present invention is to enable even an unskilled person to easily identify a related event in a short time from a collected event log. A system management device (1) is provided with: a display control part (32) for causing a display part (14) to display an event log; an identification part (30) for identifying an event of interest log specified by a user through an operation part (11); and an extraction part (31) for extracting a related event log related to an event of interest from an event log database (20). The display control part (32) causes the display part (14) to display the event of interest log and the related event log.