Event Log Translator Engine for Cross-OS Field Consolidation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The transition from Microsoft Windows NT, 2000, 2003 to Vista and later operating systems introduces issues with reading and managing event logs, including incompatible file formats, missing data fields, and field structure changes, which complicates log management and compliance across different operating systems.

Innovation Solution

An event log translator engine that reads and translates event log records from both EVT and EVTX formats, reconstituting them into a common set of fields for unified management and reporting, using a combination of engines for field transformation and consolidation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If Microsoft Vista's new event logging functions are used to read pre-Vista EVT files, then the system can manage newer EVTX format logs, but the new functions cannot properly retrieve and format key event log record fields (e.g., Category field and Description field) from pre-Vista EVT files in a reliable and consistent fashion

Engineering Contradiction:

Improveability to manage both EVTX and EVT log formatsVSAvoidreliability of field retrieval from pre-Vista EVT files

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent employs an intermediary translation layer that sits between the EVTX-based event log system and pre-Vista EVT files. This intermediary component translates EVT file structures into EVTX-compatible formats, enabling the new Vista event logging functions to reliably access and format fields from older log files without directly processing them in their native format

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system transforms the structural parameters of EVT files by converting their field organization, data types, and formatting conventions into the EVTX format's parameter structure. This includes mapping Category and Description fields from EVT's structure to EVTX's equivalent fields, ensuring consistent retrieval across both formats

Inventive Principle:

Principle #35Parameter changes

2Reliability

If traditional event log management methods are used on pre-Vista systems, then EVT files can be read reliably, but saved EVT log files cannot be read using traditional function calls when executed on computers running Microsoft Vista

Engineering Contradiction:

Improvereliability of reading EVT files on pre-Vista systemsVSAvoidcompatibility of EVT files with Vista and later operating systems

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary translation of EVT files into EVTX format before they need to be accessed on Vista systems. By pre-converting the log file structure and field organization, the system ensures that when Vista's event logging functions attempt to read these logs, they encounter EVTX-compatible structures rather than attempting to directly access EVT formats

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent creates a copied and transformed version of the EVT log files in EVTX format. Rather than attempting to make Vista systems read EVT files directly, the system generates equivalent EVTX copies with properly mapped fields and structures, allowing traditional Vista functions to read the logs reliably while maintaining the original EVT files for reference

Inventive Principle:

Principle #26Copying

3Productivity

If log records from both EVT and EVTX formats are collected into a central database, then centralized reporting and analysis can be performed, but a common field structure must be established to enable unified management

Engineering Contradiction:

Improveefficiency of centralized log managementVSAvoidcomplexity of field structure unification

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent establishes a universal EVTX-based field structure that can accommodate both original EVTX logs and translated EVT logs. This universal structure serves multiple functions: it natively supports EVTX formats while also providing a standardized target format for EVT translations, enabling unified querying, reporting, and analysis across heterogeneous log sources without requiring separate processing paths

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system standardizes all log records to a common parameter structure based on EVTX specifications. This involves transforming EVT field parameters (Category, Description, Event ID, etc.) into EVTX-equivalent parameters, ensuring that all logs in the central database share the same field schema, data types, and organizational structure, thereby simplifying centralized management

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS8086650B1Method for transforming and consolidating fields in log records from logs generated on different operating systems

Publication Date: 2011.12.27 PROGRESS SOFTWARE CORP

AI summary

An event log translator for reading and translating, when necessary, the event log records from two distinct event log file formats (e.g. EVT and EVTX formats). Moreover, it is a system for consolidating the log records contained in either of the above formats into a common set of fields, which can be displayed to the user of a computer, exported into different formats (e.g. text files, database tables, etc) or consumed by an event log management system.