IT Log Diagnosis via Event Change Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IT operations management tools face challenges in efficiently diagnosing and debugging IT logs due to the vast volume and non-standardized nature of log data, often requiring manual analysis and preconfigured windows that do not account for dynamic changes in the environment, leading to overinclusive and time-consuming log data analysis.
Innovation Solution
A computer-implemented method that identifies regions of interest in IT logs by computing event change scores and overall scores based on metrics-based and change-based events, dynamically determining the optimal regions to analyze without relying on raw metrics or advanced monitoring tools, thereby reducing the volume of data to be processed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis of IT logs is performed, then diagnostic accuracy can be maintained, but time consumption and labor effort increase significantly
Solution Approach 1:
The patent segments the log data into multiple time windows and identifies specific regions of interest within those windows. By dividing the continuous log stream into discrete time-based segments and filtering for significant changes, the system reduces the volume of data requiring manual analysis while maintaining diagnostic accuracy through focused examination of critical periods.
Solution Approach 2:
The patent extracts and isolates specific regions of interest from the broader log data. By computing change scores and identifying windows where changes exceed thresholds, the system extracts only the most relevant portions of logs for manual analysis, separating signal from noise and eliminating unnecessary data from the analysis pipeline.
2Stability of the object's composition
If preconfigured time windows are used for log analysis, then analysis consistency is maintained, but adaptability to dynamic environmental changes is reduced
Solution Approach 1:
The patent implements dynamic time window configuration where the analysis automatically adapts to changing environmental conditions. Instead of using fixed preconfigured windows, the system computes change scores continuously and adjusts the analysis focus based on detected anomalies and environmental dynamics, allowing the time window strategy to evolve with the system state.
Solution Approach 2:
The patent changes the parameter of time window selection from static to dynamic based on computed change scores. By monitoring event frequency and change magnitude, the system adjusts which time windows are analyzed based on actual system behavior patterns, transforming the analysis approach to match current operational conditions rather than relying on predetermined configurations.
3Reliability
If all log data is analyzed to ensure comprehensive coverage, then diagnostic completeness is improved, but processing volume and complexity increase
Solution Approach 1:
The patent applies local quality by focusing analysis on specific regions of interest rather than treating all log data uniformly. By identifying windows with significant changes and prioritizing those for manual analysis, the system concentrates resources on the most diagnostic portions of the data, improving processing efficiency while maintaining comprehensive coverage through targeted sampling.
Solution Approach 2:
The patent performs preliminary computation of change scores and identification of potential regions of interest before manual analysis begins. By pre-processing the log data to rank and filter windows based on change magnitude and frequency, the system prepares a prioritized list for analysis, reducing the complexity of subsequent processing by eliminating obvious non-critical data upfront.
Data Source
AI summary
A method, system, and computer program product for diagnosing IT logs based on events are configured to: receive a notification of an incident associated with an application; obtain data defining a set of events related to the application for a predefined range of time; create a timeseries of each type of event in the set of events; compute an event change score for each respective type of event for windows of the range of time based the timeseries of the respective type of event; compute an overall score for each of the windows based on the respective event change scores of the respective event types for each of the windows; and identify respective ones of the windows as a region of interest based on the overall score of the respective ones of the windows exceeding a threshold.