Event-Specific Log File Generation for Anomalous Program Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing log file systems face challenges in efficiently isolating and analyzing anomalous program execution events within computer systems, as they often record all log data, making it difficult to identify relevant information for debugging and troubleshooting.
Innovation Solution
A method that involves buffering log data in memory buffers during thread execution, using an anomalous program event detector to identify anomalies, and a log dependency analyzer to selectively extract relevant log data for writing to an event-specific log file, thereby filtering out irrelevant information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If all log data is recorded in existing log file systems, then complete logging coverage is achieved, but it becomes difficult to identify relevant information for debugging and troubleshooting
Solution Approach 1:
The patent extracts only the relevant log data associated with anomalous events from the complete log data set. The system identifies anomalous events and selectively extracts log entries related to those events, storing them separately in event-specific log files. This extraction principle resolves the contradiction by maintaining complete logging coverage while making relevant information easily identifiable through selective extraction of anomaly-related logs.
Solution Approach 2:
The patent segments the log data into different categories: complete log data and event-specific log data containing only anomalies and related information. By dividing the log storage into segments (complete logs vs. filtered anomaly logs), the system achieves both comprehensive coverage and ease of information identification, as users can access segmented event-specific logs for debugging without wading through irrelevant data.
2Productivity
If event-specific log data is selectively extracted and stored separately, then debugging efficiency is improved, but the system complexity increases
Solution Approach 1:
The system performs preliminary action by pre-identifying and storing event-specific log data in separate files as anomalies occur during execution. Rather than filtering logs after the fact, the system proactively captures and stores relevant log data at the time of anomaly detection, improving debugging efficiency while managing complexity through automated preliminary processing.
Solution Approach 2:
The patent introduces an intermediary component (the event detection and log filtering system) that mediates between the complete log data generation and the final log storage. This intermediary automatically identifies anomalies, filters related log entries, and stores them in event-specific files, thereby improving debugging efficiency while encapsulating the complexity within the intermediary layer rather than exposing it to users.
3Loss of information
If all log data is stored, then no information is lost, but the volume of data to be analyzed increases complexity
Solution Approach 1:
The system applies extraction by removing irrelevant log data from the analysis set and keeping only event-specific log data related to anomalies. This extraction maintains information completeness for debugging purposes while reducing data analysis complexity by eliminating unrelated log entries from the analysis burden.
Solution Approach 2:
The patent segments log data into complete logs (for reference) and event-specific logs (for analysis). This segmentation allows the system to maintain complete logging coverage while reducing analysis complexity, as analysts can focus on segmented event-specific logs containing only relevant information rather than processing entire log files.
Data Source
AI summary
The present disclosure relates to generating an event specific log file for a computer system. The generation comprises storing buffered log data in at least one memory buffer during an execution of one or more threads in real time. The generation further comprises receiving thread execution data. The generation further comprises inputting the thread execution data into an anomalous program event detector module configured to generate an anomalous program event signal in response to detecting an anomalous program execution event. The generation further comprises searching the buffered log data for event specific log data in the at least one memory buffer with a log dependency analyzer module in response to the anomalous program event signal. The method further comprises writing the event specific log data to an event specific log file using a log archive writer module.