Patent Application
20080071736
In order that the advantages of the invention will be readily understood, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments of the invention and are not therefore to be considered to be limiting of its scope, the invention will be described and explained with additional specificity and detail through the use of the accompanying drawings, in which:
Many of the functional units described in this specification have been labeled as modules, in order to more particularly emphasize their implementation independence. For example, a module may be implemented as a hardware circuit comprising custom VLSI circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A module may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices or the like.
Modules may also be implemented in software for execution by various types of processors. An identified module of executable code may, for instance, comprise one or more physical or logical blocks of computer instructions which may, for instance, be organized as an object, procedure, or function. Nevertheless, the executables of an identified module need not be physically located together, but may comprise disparate instructions stored in different locations which, when joined logically together, comprise the module and achieve the stated purpose for the module.
Indeed, a module of executable code may be a single instruction, or many instructions, and may even be distributed over several different code segments, among different programs, and across several memory devices. Similarly, operational data may be identified and illustrated herein within modules, and may be embodied in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set, or may be distributed over different locations including over different storage devices, and may exist, at least partially, merely as electronic signals on a system or network.
Reference throughout this specification to “one embodiment,” “an embodiment,” or similar language means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases “in one embodiment,” “in an embodiment,” and similar language throughout this specification may, but do not necessarily, all refer to the same embodiment.
Reference to a computer programmed product may take any form capable of generating a signal, causing a signal to be generated, or causing execution of a program of machine-readable instructions on a digital processing apparatus. A computer programmed product may be embodied by a transmission line, a compact disk, digital-video disk, a magnetic tape, a Bernoulli drive, a magnetic disk, a punch card, flash memory, integrated circuits, or other digital processing apparatus memory device.
Furthermore, the described features, structures, or characteristics of the invention may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided, such as examples of programming, software modules, user selections, network transactions, database queries, database structures, hardware modules, hardware circuits, hardware chips, etc., to provide a thorough understanding of embodiments of the invention. One skilled in the relevant art will recognize, however, that the invention may be practiced without one or more of the specific details, or with other methods, components, materials, and so forth. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the invention.
The search criteria module 104 may be configured to interpret search criteria 106. The search criteria 106 may comprise a log field label, for example “Group name”. In one embodiment, the search criteria 106 may indicate that the records of interest comprise records containing a field with a label equal to the search criteria 106. A log field label may comprise an active resource, for example a resource being accessed or used at the time when a log record is stored. A log field label may comprise an event which caused the log record to be generated. The event may comprise a transaction, an exception condition, a security event, or the like. The log field label identifies the type of resource or event. The value for the log field identifies a specific resource or event involved in the particular log record. A variety of log field labels may be used including a database name, a program name, a transaction name, or a user name. The values in these associated fields are specific instances of those types. In one embodiment, the log field label may comprise a recovery token, wherein an application operating on a system may be configured to set and clear the recovery token at various operating stages of the application.
The log records may be formatted differently than shown in the present examples. The particular resources, events, or other data may vary in certain applications, and field locations and names may vary. The included examples are illustrative and not intended to limit the scope of the invention.
In a further embodiment, the search criteria 106 may also indicate that the records of interest should be sorted according to the field indicated by the search criteria 106. For example, if the search criteria 106 is “Group name,” the search criteria module 104 may interpret the search criteria 106 such that the apparatus 102 will extract records comprising a data field “Group name,” and the apparatus 102 may sort the records according to the values in the “Group name” data field.
In one embodiment, the search criteria 106 may further comprise a partial log field label, multiple log field labels, a log field label with a partial value, and combinations thereof. For example, the search criteria 106 may comprise a log field label “Group*” where * may be a wild card character. In another example, the search criteria 106 may comprise “Group name, Program name.” In another example, the search criteria 106 may comprise “Group name, soft*.” The included fields and information may be adjusted to meet a size limitation on data records that may be imposed by the system in question.
The log map module 108 may be configured to interpret a log record description 110, which may be a data map. The log record description 110 may comprise at least one log record type, a set of log field labels corresponding to each log record type, and a set of log field label locations corresponding to each of the set of log field labels. The log record description 110 may be a file comprising a set of log record types, a set of log field labels corresponding to each of the set of log record types, and a set of data field locations corresponding to each of the set of log field labels.
The log record type may comprise a metadata identifier for a category of log records, wherein the category of log records may comprise identical log field labels and log field label locations. The log record type may be known as a log record class, or similar concept, and an individual log record may be known as an instance of the log record type. The set of log records may comprise a set of database management system log records.
The set of log field labels corresponding to each log record type may comprise a list of log field labels associated with a log record type. For example, a log record type of “Payroll record” may comprise a list of log field labels such as “Employee number,” “Gross pay,” “Federal income tax withholding,” and so forth. In an alternative embodiment, the set of log field labels corresponding to each log record type may comprise a list of log field labels, with a list of associated log record types corresponding to each log field label. For example, one member of the set of log field labels may be “Employee number,” and the list of associated log record types may comprise “HR record,” “Payroll record,” “Vacation request,” and “Incident record.” Many organizations of the set of log field labels corresponding to each log record type are possible, and all are contemplated within the scope am of the present invention.
The set of log field label locations corresponding to each of the set of log field labels may comprise a data position associated with a log record type wherein a given log field label can be located. For example, the log field label “Employee number” may be found beginning at the 6th byte of the log record type “Incident record,” and may extend for 4 bytes. The set of log field label locations may be expressed as a set of length and offset values, they may be relative to the end or the beginning of a log record, and they may comprise information to calculate the location at run-time due to variable-length data fields which may occur in some database systems. In one embodiment, the set of log field label locations corresponding to each of the set of log field labels may comprise a field number. For example, the data field “Employee number” may comprise the second field of the log record type “Incident record.”
The record extraction module 112 may be configured to extract a plurality of log records 115 from a non-homogeneous set of log records 114 according to the search criteria 106 and the log record description 110. In one embodiment, the record extraction module 112 may be configured to extract log records 115 having a data field with a label equivalent to the search criteria 106 according to the log record description 110. For example, if the search criteria 106 is “Group name,” the record extraction module 112 may be configured to identify all log record types comprising a data field “Group name” according to the log record description 110, and the record extraction module 112 may be further configured to extract all log records 115 from the set of log records 114 of the identified log record types. The record extraction module 112 may be a tool such as DFSERA10, or a similar record selection and extraction tool.
In a further example, the search criteria 106 may be “Group*,” and the record extraction module 112 may be configured to identify all log record types comprising a log field label that begins with “Group.” In a further example, the search criteria 106 may be “Group name, Program name,” wherein the record extraction module 112 may be configured to identify all log record types comprising a log field label “Group name” and a log field label “Program name.” It is within the skill of one in the art to build various logic around the search criteria 106 to allow multiple search criteria 106 to be combined in an AND, OR, NOR, NOT, XOR, etc. fashion for various embodiments of the invention.
In a further example, the search criteria 106 may be “Group name, soft*,” wherein the record extraction module 112 may be configured to identify all log record types comprising a log field label “Group name,” and to extract all log records from the set of log records 114 comprising one of the identified log record types and a value in the log field labeled “Group name” beginning with “soft.” In the example, the record extraction module 112 will extract a log record of a type having a log field label “Group name” and a group name of “Software development,” but may not extract a log record of a type having a log field label “Group name” and a group name of “Human resources.” Various features to allow multiple search criteria 106 to be marked as log field labels and values, as well as allowing search logic are within the skill of one in the art and contemplated within the scope of the invention.
The intermediate information module 116 may be configured to generate a sort handle 117 configured to allow a sorting utility to sort the extracted log records according to the sort handle 117. For example, the intermediate information module 116 may be configured to add a data field to the beginning of each of the extracted records 115, wherein the data field comprises the data values corresponding to the log field labeled according to the search criteria 106. Where the search criteria 106 identifies multiple data fields, the intermediate information module 116 may be configured to insert multiple data fields at the beginning of the extracted records 115, to concatenate information from the multiple data fields and insert the concatenated information into a single inserted data field, or use similar methods to enable sorting the extracted records 115 according to the search criteria 106. The intermediate information module 116 may be further configured to append the sort handle 117 to the extracted records 115, for example as the first data field in the extracted records 115. The sort handle 117 may also be appended at the end of the extracted records 115, or at a known location (e.g. beginning with the 12th bit) within the extracted records 115.
In one embodiment, the intermediate information module 116 maybe further configured to generate a sort handle 117 comprising a time stamp corresponding to each of the extracted log records 115. The intermediate information module 116 may be further configured to insert the sort handle 117 as the first and second data fields in the extracted records 115, the first field comprising the data values corresponding to the log field labeled according to the search criteria 106, and the second field comprising the time stamp corresponding to the extracted log record 115. The time stamp field may be located at an offset of 16 bytes from the end of the record 115.
The intermediate information module 116 may be further configured to generate intermediate information 118 which may comprise the extracted records 115 with the sort handle 117 added as a first data field to each of the extracted records 115. The intermediate information 118 may comprise and intermediate file, a data array in memory, or similar components. The intermediate information module 116 may be configured to truncate or otherwise shorten the sort handle 117 such that the records of the intermediate information 118 do not exceed a size limit. In one embodiment, the records of the intermediate information 118 are adjusted such that they do not exceed a length of 32,752 byes. In a further embodiment, the intermediate information module 116 may be configured to edit the records to increment an LL field (a length field) to indicate the new length of the record with the sort handle 117.
The sorting module 120 may be configured to sort the extracted log records 115 according to the search criteria 106. The sorting module 120 may sort the extracted records 115 by utilizing a standard sort utility, for example SYNCSORT or DFSORT, on the sort handle 117. The sorting module 120 may store the sorted extracted records 122. The sorting module 120 may be further configured to sort the extracted log records 115 sequentially according to multiple data fields which may be defined by multiple log field labels according to the search criteria 106.
The record display module 124 may be configured to display the sorted extracted log records 122. Displaying the records 122 may comprise sending the records to a computer 126 for later access, printing the records 122, storing the records 122 in an electronic format, and the like. Displaying the records 122 may comprise sending the records 122 to a software program for further processing, wherein the records 122 may never be directly displayed to a human user. The record display module 124 may be further configured to remove any sort handle(s) 117 from the sorted extracted records 122 before displaying the records 122.
In one embodiment, the intermediate information module 116 may be configured to insert a key length parameter into a control statement file (not shown). The display module 124 may be configured to read the key length parameter and determine the size of the inserted sort handle 117 based on the key length parameter. The display module 124 may be further configured to remove the sort handle(s) 117 based on the key length parameter, and to decrement an LL field to indicate the restored length of each record.
The practitioner 202 may interpret a log record data description, which may be a log record type data mapping file 110, where the log record data description may comprise at least one log record type, a set of log field labels corresponding to each of the at least one log record types, and a set of log field label locations corresponding to each of the set of log field labels. The practitioner 202 may interpret the log record data description by reading a log record type data mapping file 110 from a database management system 210 using the first computer 204. The practitioner 202 may receive a database management system log file 114 by reading the log file 114 from a database management system 210 using the first computer 204.
The practitioner 202 may execute a log manipulation tool 212 comprising modules configured to functionally execute the operations of the log manipulation tool 212. In one embodiment, the modules of the tool 212 may comprise a record extraction module 112, an intermediate information module 116, and a sorting module 120. The record extraction module 112 may be configured to extract a plurality of log records 115 from the database management system log file 114 according to the search criteria 106 and the log record type data mapping file 110. The intermediate information module 116 may be configured to generate a sort handle 117, where the sort handle 117 is configured to allow a sorting utility to sort the extracted log records 115 according to the search criteria 106. The sorting module 120 may be configured to sort the extracted log records 115 according to the search criteria 106, and to provide sorted extracted log records 122. The practitioner 202 may present the sorted extracted log records 122 to the director 206 in an electronic or hard copy format.
The sorting module 120 may be further configured to divide the sorted extracted log records 122 into a plurality of result sets 214, wherein each result set 214 of the sorted extracted log records 122 comprises a unique data result based on the search criteria 106. For example, if the search criteria 106 were “Group name,” then each result set 214 may represent a set of all log records related to each “Group name” within the database management system log file 114. In the example, if six groups are found in the database management system log file 114, with names “Group 1” through “Group 6,” then the sorting module 120 may separate the sorted extracted log records 122 into six result sets 214, with each result set 214 corresponding to one of “Group 1” through “Group 6.” The sorting module 120 may be further configured to insert a delimiter 216 between each result set 214, and the practitioner 202 may present the sorted extracted log records 122 with the inserted delimiters 216.
The system 200 may comprise an apparatus 102 for criteria-based grouping and searching of database management system log records 114. The apparatus 102 may comprise and/or communicate with the first computer 204. In one embodiment, the first computer 204 comprises a search criteria module 104, a log map module 108, a record extraction module 112, and a record display module 124. The various modules of the apparatus 102 may be computerized or not, and the computers may be distributed or combined. For example, in one embodiment the functions of the search criteria module 104 may be performed manually by the practitioner 202, and the functions of the log map module 108 and record extraction module 112 may be performed by the first computer 204.
The first computer 204 may be a standalone computer used by the practitioner 202, and the log manipulation tool 212 may be a program located on the first computer 204 or in communication with the first computer 204. The first computer 204 may be part of a computer server, and may be on the same computer as the database management system 210.
Therefore, in the embodiment of
Note the difference between the log field label 404 and the actual data value. For example, a log field label 404 may be “Program usage” indicating a log record of a program usage event. The actual data value may be 5 bytes long (408), and offset 406 by 26 bytes when the log record type 402 is a “program request.” Referring to
In one embodiment, the database management system log file 114 may comprise a leading character 602, a log entry identification number 604, a log record type 606, a date stamp 608, and a time stamp 610. The records within the database management system log file 114 need not have the same data fields, or data fields in the same order. In the example of
For clarity in
In the example of
Note that, in one embodiment, the transaction log entries in
The schematic flow chart diagrams herein are generally set forth as logical flow chart diagrams. As such, the depicted order and labeled steps are indicative of one embodiment of the presented method. Other steps and methods may be conceived that are equivalent in function, logic, or effect to one or more steps, or portions thereof, of the illustrated method. Additionally, the format and symbols employed are provided to explain the logical steps of the method and are understood not to limit the scope of the method. Although various arrow types and line types may be employed in the flow chart diagrams, they are understood not to limit the scope of the corresponding method. Indeed, some arrows or other connectors may be used to indicate only the logical flow of the method. For instance, an arrow may indicate a waiting or monitoring period of unspecified duration between enumerated steps of the depicted method. Additionally, the order in which a particular method occurs may or may not strictly adhere to the order of the corresponding steps shown.
A record extraction module 112 may then extract 906 a plurality of log records from a set of database management system log records 114 according to the search criteria 106 and the log record data description 110. An intermediate information module 116 may then generate 908 an intermediate file 117 comprising a sort handle 714 appended to each extracted record 115. The sort handle 714 may comprise data from the data field corresponding to the log field label defined by the search criteria 106 for each extracted log record 115.
A sorting module 120 may then sort 910 the extracted log records 115 according to the search criteria 106. In one embodiment, the search criteria 106 comprises a plurality of log field labels, and the sorting module 120 sorts the extracted log records sequentially according to each of the plurality of log field labels. A record display module 124 may then remove 912 the sort handle 714 from the sorted extracted records 122, and may present 914 the sorted extracted log records 122. Without limitation, the record display module 124 may present 914 the sorted extracted log records 122 to a user, a storage system, and/or a software component.
The log manipulation tool 212 may comprise a record extraction module 112, an intermediate information module 116, and a sorting module 120. The log manipulation tool 212 may be configured to extract a plurality of log records from the database management system log file 114 according to the search criteria 106 and the log record type data mapping file 110. The log manipulation tool 212 may be further configured to generate a sort handle 117 from the extracted records 115 based on the search criteria 106, and to sort the extracted records 115 according to the sort handle 117. The log manipulation tool 212 may be further configured to remove the sort handle 117 from the extracted records 115. The practitioner 202 may then present 1010 the sorted extracted log records 122 to the director 206.
From the foregoing discussion, it is clear that the invention provides a system, method, apparatus for criteria-based grouping and searching of database management system records. The invention also extends the capabilities of criteria-based searching and sorting within database files generally. The invention overcomes previous limitations in the art by allowing a user to search files even where the search criteria occur in different fields with each type of record of the database, and it allows a user to be presented data in a desired format with delimiters if desired.
The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.
