Log Message Knowledge Graph for System Diagnosis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex computing systems, such as mainframes, face challenges in interpreting log messages due to their technical nature and unstructured text data, making it difficult for system administrators to determine correlations and causality among messages, which is time-consuming and prone to errors.
Innovation Solution
Integration of documentation knowledge with log mining data using a knowledge fusion engine that combines outputs from documentation knowledge mining and log pattern mining components, employing natural language processing and text analysis to build message graphs and enhance log analytics with contextual information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual review of log messages is performed by system administrators, then contextual understanding and accurate diagnosis can be achieved, but time consumption and human error increase significantly
Solution Approach 1:
The system performs preliminary actions by pre-processing log messages, extracting entities, relationships, and attributes before actual diagnosis is needed. The knowledge graph is built in advance with message correlations, entities, and attributes structured and stored, so when a diagnosis is needed, the system can quickly query pre-computed relationships rather than manually analyzing raw logs each time
Solution Approach 2:
The patent introduces a knowledge graph as an intermediary between raw log messages and system administrators. This knowledge graph structures unstructured log data into entities, relationships, and attributes, making the information machine-processable and easily queryable. The intermediary automatically extracts and organizes message correlations, eliminating the need for manual review while preserving diagnostic accuracy
2Productivity
If automated log analysis tools are used, then time consumption is reduced, but the ability to understand contextual relationships and causality among messages deteriorates
Solution Approach 1:
The system performs preliminary action by pre-extracting entities, relationships, and attributes from log messages and storing them in a structured knowledge graph. This includes identifying message correlations, causal relationships, and contextual attributes before actual analysis is needed, enabling fast automated querying without losing contextual information
Solution Approach 2:
The patent transforms unstructured log message parameters into structured parameters within the knowledge graph framework. By converting raw message text into standardized entities, relationships, and attributes with defined schemas, the system enables automated processing while preserving the semantic meaning and contextual relationships of the original data
3Measurement precision
If detailed documentation and explanations are provided for each log message, then diagnostic accuracy improves, but data complexity and processing difficulty increase
Solution Approach 1:
The patent segments detailed log message documentation into distinct structured components: entities (what the message is about), relationships (how messages connect), and attributes (specific properties). This segmentation transforms complex unstructured documentation into modular, machine-processable units that can be independently stored, queried, and analyzed in the knowledge graph
Data Source
AI summary
Aspects of the invention include computer systems, computer-implemented methods, and computer program products configured to integrate documentation knowledge with log mining data. A non-limiting example computer-implemented method includes determining a message-message relationship based on log message documentation and building a first subgraph based on the message-message relationship. The method further includes receiving a first message log entry having a message identifier and message field data. A second message log entry is correlated with the first message log entry based on at least one of the message identifier and the message field data. A second subgraph is built that includes the first message log entry and the second message log entry. The method includes building a graph that includes the first subgraph and the second subgraph.