Event Logging Suppression for Diagnostic Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing event logging systems are inefficient in handling repetitive events, which can overwhelm logs and hinder diagnostic efforts by continuously recording the same errors, thereby bogging down systems and making it difficult for administrators to diagnose issues effectively.
Innovation Solution
Implementing a system that intercepts and suppresses repetitive events after a predetermined number of occurrences within a detection period, storing diagnostic information in high-speed memory and summarizing events at the end of a suppression period, and transferring this information to a data store upon a triggering event.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If repetitive events are continuously recorded in logs, then complete event information is preserved, but system load increases and diagnostic efficiency decreases
Solution Approach 1:
The patent extracts repetitive events from the log stream and separates them into a suppression mechanism. When an event is detected as repetitive based on matching criteria (event type, source, target, etc.), it is extracted from further logging processing, thereby eliminating redundant information while preserving unique diagnostic events.
Solution Approach 2:
The patent changes the logging parameter from recording every event instance to recording only unique event patterns. By introducing parameters such as event suppression lists, detection periods, and matching criteria, the system dynamically adjusts what gets logged based on event characteristics, reducing redundancy while maintaining diagnostic completeness.
2Loss of information
If all events are logged without suppression, then no diagnostic information is lost, but log volume overwhelms the system and hinders effective diagnosis
Solution Approach 1:
The patent creates a copy of the event logging mechanism with suppression capabilities. Instead of modifying the core logging function, it introduces an event suppression list that copies event characteristics and compares them against known repetitive patterns, allowing the system to identify and suppress duplicates without losing unique diagnostic information.
Solution Approach 2:
The patent applies different logging quality levels to different event types. Unique events are logged in full detail, while repetitive events are suppressed or summarized. The system dynamically determines the appropriate logging level for each event based on its characteristics and presence in the suppression list, optimizing log quality and volume.
3Productivity
If repetitive event logging is suppressed, then system load is reduced and diagnostic efficiency improves, but risk of losing important recurring error patterns increases
Solution Approach 1:
The patent implements feedback mechanisms where the system continuously monitors suppressed events and provides summaries of suppression statistics. The event suppression list is dynamically updated based on analysis of event patterns, allowing the system to learn from recurring errors and adjust suppression criteria to ensure important patterns are not lost while maintaining efficiency.
Solution Approach 2:
The patent performs preliminary analysis of events before they are logged to determine if they should be suppressed. By pre-evaluating events against the suppression list and matching criteria, the system prevents redundant logging from occurring in the first place, thereby maintaining system efficiency while preserving diagnostic information for unique and important events.
Data Source
AI summary
Events that repeatedly occur during a detection period are intercepted and suppressed before being written to a log. When the same error has been detected a predetermined number of times within the detection period, the event logging for the event is suppressed for a suppression period. At the end of the suppression period an entry is made in the log summarizing the events during the suppression period. Additionally, diagnostic information relating to an application is collected and then stored within a high speed memory. Upon the occurrence of a triggering event, the diagnostic information from the high speed memory is stored within a data store for later use.