Log Record Association via Logical Units of Work
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing log record management systems lack efficient organization and correlation of log records across multiple files, making it difficult for administrators to diagnose issues due to cryptic content and large volumes of data, with no effective means to juxtapose related records for comparison or trend analysis.
Innovation Solution
The method involves creating Logical Units of Work (LUOW) by processing log records through primary and secondary queues, using filters to reduce processing, and associating records based on primary and secondary association values, allowing for logical grouping and correlation of log records into organized units for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If log records are stored chronologically in separate log files, then the complete operational history is preserved, but it becomes difficult to associate related records and diagnose problems efficiently
Solution Approach 1:
The patent segments log records into Logical Units of Work (LUOW) by grouping related records together based on association values. Each LUOW represents a discrete unit of work with all its related log records organized together, making it easier to diagnose problems while preserving the complete operational history across multiple segmented units.
Solution Approach 2:
The patent introduces association values (primary and secondary) as intermediaries that link log records across different files. These association values act as mediators that enable the system to correlate records from multiple chronological log files without losing the complete operational history, thereby resolving the contradiction between preserving history and enabling efficient diagnosis.
2Loss of information
If all log records are processed and analyzed, then comprehensive diagnostic information is obtained, but the processing time and computational resources increase significantly
Solution Approach 1:
The patent segments the large volume of log records into smaller Logical Units of Work based on association values. This segmentation allows administrators to focus processing on specific LUOWs related to particular problems rather than processing all records, thereby reducing processing time while maintaining comprehensive diagnostic information for the relevant units.
Solution Approach 2:
The patent extracts and groups only the necessary related records into LUOWs using association values. By extracting only the records that belong together logically, the system reduces the amount of data that needs to be processed while ensuring that all necessary diagnostic information for each unit of work is captured.
3Difficulty of detecting and measuring
If log records from multiple files are correlated and associated, then problem diagnosis capability is improved, but the system complexity and processing overhead increase
Solution Approach 1:
The patent segments correlated records into Logical Units of Work that can be independently managed and analyzed. This segmentation simplifies the complexity by providing clear boundaries between different units of work, making it easier to track and diagnose problems without being overwhelmed by the interconnectedness of all records.
Solution Approach 2:
The patent performs preliminary association of log records into LUOWs using association values before actual problem diagnosis. This preliminary organization reduces the processing overhead during diagnosis, as records are already grouped and ready for analysis, thereby improving problem detection capability without proportionally increasing system complexity.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
A method, system and medium for organizing and associating log records into logically related groups is described. One or more input sources from, possibly, different systems/subsystems are input to a log correlation method. As the log records are processed the fields are interrogated to determine which log records are related to each other. As further log records are processed more information about previously unidentifiable relationships is determined. After this later information is known, log records that could previously not be associated with any other log records are added to the existing association. The system engineer is therefore presented with the pertinent information for monitoring, administrating and diagnosing system activities.