Log Data Filterability via Correlation Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current endpoint management systems face difficulties in correlating and filtering log data effectively, making troubleshooting time-consuming due to the lack of association between user-specific and event-specific logs.
Innovation Solution
A method and system that generate and filter log data by identifying pairs with user or event log chain identifiers, updating the database with corresponding user information or action types, and displaying filtered data to facilitate easier error identification and resolution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If log data is stored without correlation identifiers, then storage simplicity is maintained, but troubleshooting time increases significantly
Solution Approach 1:
The patent applies preliminary action by embedding correlation identifiers (user IDs, event log chain IDs) into log data at the time of log generation and storage, rather than adding them during troubleshooting. This preliminary enrichment of log data with identifying information enables fast filtering and correlation during issue resolution, significantly reducing troubleshooting time without requiring complex post-processing operations.
2Ease of operation
If log data includes detailed user information and action types, then filterability improves, but data storage requirements increase
Solution Approach 1:
The patent extracts and stores only the essential filtering attributes (user ID, event log chain ID, action type) from the complete log data structure. By selectively extracting only the most critical identifying fields needed for filtering and correlation, the system achieves high filterability while minimizing the additional storage overhead that would result from storing all possible log attributes.
3Measurement precision
If error logs are correlated with user and event information, then issue identification accuracy improves, but processing complexity increases
Solution Approach 1:
The patent introduces event log chain IDs as intermediary correlation identifiers that link related log entries across different users, devices, and time periods. These chain IDs act as mediators that enable accurate error log correlation without requiring complex multi-dimensional matching algorithms. The intermediary identifiers simplify the correlation process by providing direct references between related events, thereby improving identification accuracy while keeping processing complexity manageable.
Data Source
AI summary
A method and system includes generating event logs, storing in a database log data comprising the generated event logs, identifying a first set of log data by searching the log data for a first log data type, the first log data type having a data structure that includes a generic identifier and a specific data, identifying pairs of generic identifiers and associated specific data in the first set of log data, for each generic identifier of the identified pairs identifying a second set of log data that include the generic identifier but not the specific data, wherein identifying the second set of log data is performed by searching the log data for event logs that include the generic identifier, and updating log data stored in the database by adding, for each of the event logs of the identified second set of log data, the specific data associated with the generic identifier.