Patent Application
20180091359
In some examples, log messages may be collected from source components of computer systems. The source components may include, for example, hardware and/or software components, such as web services, enterprise applications, storage systems, servers, etc.
Some examples are described with respect to the following figures:
The following terminology is understood to mean the following when recited by the specification or the claims. The singular forms “a,” “an,” and “the” mean “one or more.” The terms “including” and “having” are intended to have the same inclusive meaning as the term “comprising.”
A “topology” of a computer system may be the way that components of the computer system are related, i.e. “topologically linked”. In some examples, issues or malfunctions in a first component may be the cause of issues or malfunctions in a second component that is topologically linked to the first component. In other examples, issues or malfunctions in topologically linked components are common effects of the same issues or malfunctions. Therefore, generating a topology model representing the topology of a computer system may be helpful for IT management of that computer system. However, tracking changes in the topology of a computer system in the topology model may be difficult due to frequent and major changes in the topology.
As discussed earlier, log messages may be collected from the source components of computer systems. A “log message” is a textual message. In some examples, log messages may include human-readable text. In some examples, log messages may indicate events, such as errors, occurring in a computing system. Log messages may, for example, be stored in log files. Log messages may be generated by, stored on, and collected from source components of a computer system such as a computer network, and may be used in system development for debugging and understanding the behavior of a system. These log messages may store a large amount of information describing the behavior of systems. For example, systems may generate thousands or millions of log messages per second.
Accordingly, the present disclosure provides examples in which log messages may be used to generate topology models of computer systems. Because log messages may, for example, already be collected for various purposes other than for generating topology models, little additional computational overhead may be expended in using the log messages to generate topology models. In some examples, a topology model may be generated based on a simultaneous appearances of instances of a parameter in log messages from multiple source components. For example, if the same parameter appears in simultaneous log messages from different source components, then it may be inferred that these source components may be topologically linked, particularly if the parameter rarely appears in log messages from source components in the computer system.
As used herein, “simultaneous” means that two events both occur within a time period (e.g. predetermined time period) relative to each other (e.g. within less than 10 seconds of each other). The time of each log message or event may be determined by a timestamp. A timestamp may be part of the log message or event in a pre-determined position (e.g. the start of the message) that includes the time (e.g. second, minute, hour, day, month, year, or a combination thereof, etc.) when the log message or event occurred or was created. In some examples, the timestamp may be corrected for time zone or daylight saving time so as to be able to compare timestamps across different time zones.
The system 100 may include topology generation systems, including an offline system 112 and an online system 114. In some examples, the system 100 may include one of the offline system 112 and online system 114, and not the other.
The offline system 112 may be suited to operate on a set of collected messages. It may be operated periodically each time an additional threshold number of log messages have been collected. The offline system 112 may include a log message processor 116, parameter filter 120, parameter stream generator 118, log message database 122, parameter database 123, simultaneous parameter counter 124, linkage score estimator 126, linkage score normalizer 128, and topology estimator 129.
The online system 114 may be suited to operate dynamically while log messages are being collected. The online system 114 may include a log message processor 130, parameter stream generator 132, parameter filter 134, FIFO (first-in-first-out) buffer handler 136, simultaneous parameter FIFO buffers 138 (i.e. P-FIFOπ buffers), parameter count FIFO buffers 140 (i.e. C-FIFOπ buffers), simultaneous event FIFO buffer 141 (i.e. S-FIFO buffer), linkage score estimator 142, and topology estimator 143.
Each of the offline system 112 and the online system 114 may support direct user interaction. For example, the offline system 112 and the online system 114 may respectively include user input devices 144 and 145, such as a keyboard, touchpad, buttons, keypad, dials, mouse, track-ball, card reader, or other input devices. Additionally, the offline system 112 and the online system 114 may respectively include output devices 146 and 147 such as a liquid crystal display (LCD), video monitor, touch screen display, a light-emitting diode (LED), or other output devices. The output devices may be responsive to instructions to display a visualization including textual and/or graphical data including representations of log messages, parameters, FIFO buffers, linkage scores, eventual estimated topology and any other data generated during any part of the processes described herein.
In some examples, components of the offline system 112 (log message processor 116, parameter filter 120, parameter stream generator 118, simultaneous parameter counter 124, linkage score estimator 126, linkage score normalizer 128, and topology estimator 129) and the online system 114 (log message processor 130, parameter stream generator 132, parameter filter 134, FIFO (first-in-first-out) buffer handler 136, P-FIFOπ buffers 138, C-FIFOπ buffers 140, S-FIFO buffer 141, linkage score estimator 142, and topology estimator 143) may each be implemented as a computing system including a processor, a memory such as non-transitory computer readable medium coupled to the processor, and instructions such as software and/or firmware stored in the non-transitory computer-readable storage medium. The instructions may be executable by the processor to perform processes defined herein. In some examples, the components of the offline system 112 and the online system 114 mentioned above may include hardware features to perform processes described herein, such as a logical circuit, application specific integrated circuit, etc. In some examples, multiple components may be implemented using the same computing system features or hardware.
Each of the log message database 122, parameter database 123, P-FIFOπ buffers 138, C-FIFOπ buffers 140, and S-FIFO buffer 141 may be implemented as a memory such as non-transitory computer readable medium storing data.
In some examples, the offline system 112 may receive a log message stream including log messages 148 from source components in a computer system such as the network 102. Table 1 illustrates eight example log messages 148 collected from the network 102, although any number of log messages 148 may be collected. For example, thousands or millions of log messages 148 may be collected.
In this example, the log messages 148 may each include a timestamp 150 representing a time when the log message 148 was generated, and a message 154 including a description of an event associated with the source component such as an error. The message 154 may include text that is not variable relative to other similar messages representing similar events. However, at least part of message 154 may additionally include variable parameters such as, for example, varying textual (e.g. numerical) metrics. Additionally, the timestamp 150 may include variable time parameters. In some examples, each log message 148 may be associated with a source component ID which may be collected along with the log message 148. A source component ID may represent a source component from which the log message 148 was generated. The timestamps 150 may include times that are synchronized across different sources.
As shown, the collected log messages 148 may be in a raw format, in which the portions (e.g. timestamps 150 and messages 154, and parameters therein) of the log messages 148 may not be parsed or tokenized.
In some examples, the log message database 122 may store the log messages 148 (e.g. as in Table 1). When additional log messages 148 are received by the offline system 112, they may be stored in the log message database 122.
In some examples, the log message processor 116 may generate a log message template for each of the log messages 148 and classify the log messages 148 with associated log message templates. Additionally, the log message processor 116 may, for each of the log messages 148 (such as those in Table 1), determine that each of the substrings of the log message 148 is represented by tokens. A substring that is “tokenized” is associated with a semantic token, which is a character that categorizes the substring as a type of variable parameter. Therefore, each of the substrings may be associated with a semantic token that categorizes the substring. For example, the substrings of the log messages 148 may be represented by the set of log message templates shown in Table 2, which shows the date token <D>, the time token <T>, the number token <#>, and the parameter token <P>. Each of these semantic tokens may represent variable parameters, which are variable strings taking different values in different log messages 148 represented by the same log message template. That is, a parameter may be designated as a variable parameter based on a threshold amount of variation of the parameter across at least some of the log messages 148 (e.g. log messages 148 represented by a particular log message template). Fixed parameters may be represented by the fixed, identical substring in the log message template. The log message processor 116 may be implemented using techniques described in U.S. Pat. No. 8,209,567 filed on Jan. 28, 2010 and titled “Message Clustering Of System Event Logs” or in International Publication No. WO2016/093839 filed on Dec. 11, 2014 and titled “STRUCTURING OF SEMI-STRUCTURED LOG MESSAGES”. Each of these references are hereby incorporated herein in their entireties.
In the example of the eight log messages 148 in Table 1, the log message processor 116 may generate the four log message templates shown in Table 2, each having a template ID. In particular, the first log message template of Table 2 corresponds to the second, fifth, and sixth log messages 148 in Table 1, the second log message template of Table 2 corresponds to the first and seventh log messages 148 in Table 1, the third log message template of Table 2 corresponds to the third and eighth log messages 148 in Table 1, and the fourth log message template of Table 2 corresponds to the fourth log message 148 in Table 1.
In some examples, the parameter stream generator 118 may generate a parameter stream, which may include, for each log message 148, a row including the source component ID for the log message 148, the timestamp 150 of the log message 148, the template ID of the log message template corresponding to the log message 148, and the variable parameters in the message 154 of the log message 148. The parameter stream generator 118 may order the parameter stream according the time of the timestamp (e.g. from earliest to latest).
Table 3 shows an example parameter stream corresponding to the log messages 148 of Table 1 and the log message templates of Table 2.
In some examples, the parameter stream generator 118 may then also separate variable parameters in messages 154 of log messages 148 such that they are provided with their own rows in the parameter stream. Thus, in each row, a respective variable parameter in a message 154 is associated with the source component ID for the log message 148 containing the variable parameter, the timestamp 150 of the log message 148 containing the variable parameter, and the template ID of the log message template corresponding to the log message 148 containing the variable parameter. If a log message 148 has multiple variable parameters in its message 154, then there may be multiple corresponding rows; one for each of the variable parameters in the message 154. The parameter stream generator 118 may continue to order the parameter stream according the time of the timestamp (e.g. from earliest to latest).
Table 4 shows an example parameter stream in which variable parameters have been separated into their own rows in the parameter stream. The example of Table 4 includes parameters from log messages 148 collected from multiple source components: BDG1, BGD2, and BGD3,
In some examples, the parameter filter 120 may filter a variable parameter or multiple variable parameters from the parameter stream. As will be discussed, parameters may be later used to determine topological linkages between source components. However, different source components may include identical variable parameters even when there is no topological linkage between these source components.
For example, different, unlinked source components may generate log messages 148 at the same time, and therefore may include simultaneous and identical timestamps (e.g. ‘01:47 am’). Therefore, the parameter filter 120 may filter the parameter stream to remove variable parameters comprising timestamps.
In addition, the parameter filter 120 may filter the parameter stream to remove variable parameters that include fewer than a predetermined threshold number of characters (e.g. digits) in length (e.g. less than three digits, or less than four characters). This may be performed because of a relatively higher probability, for shorter variable parameters relative to longer variable parameters, of identical variable parameters generated simultaneously by unlinked source components due to randomness or coincidence.
Table 5 shows an example parameter stream in which variable parameters have been separated into their own rows in the parameter stream, and are filtered by the parameter filter 120. In particular, the parameter stream of Table 5 is a filtered version of the unfiltered parameter stream of Table 4, where variable parameters that are timestamps and variable parameters with fewer than four characters have been removed,
In some examples, the parameter database 123 may store the filtered parameter stream (e.g. as in Table 5). When additional log messages 148 are received by the offline system 112 and stored in the log message database 124, the filtered parameter stream stored in the parameter database 123 may be updated with variable parameters using the log message processor 116, the parameter stream generator 118, and the parameter filter 120. In some examples, the parameter database 123 may store other types of data, such as the unfiltered parameter stream (e.g. as in Table 3 or 4), and the log message templates (e.g. as in Table 2).
In some examples, the simultaneous parameter counter 124 may, for each unique parameter in each pair of source components, identify (e.g. determine) the number of simultaneous parameters in the filtered parameter stream (stored in the log message database 122 or generated based on other data stored in the log message database 122, for example the unfiltered parameter stream, log message templates, and/or log messages 148).
As discussed earlier, a simultaneous parameter (SP) is a parameter (e.g. a variable parameter as shown in the example parameter stream of Table 5) that appears in two log messages from two source components within a particular time period (e.g. predetermined time period) such that they are within less than a threshold (e.g. predetermined) time period Δt relative to each other (e.g. as reflected in the timestamps of the two log messages). For example, simultaneous parameters may be drawn from log messages that contain timestamps representing times (e.g. including second, minute, hour, day, month, year, or a combination thereof, etc.) that are less than a threshold time period Δt different from each other. Topologically linked source components may be predicted to generate more simultaneous parameters than expected by chance. Accordingly, the number of simultaneous parameters of parameter π between sources components i and j may be designated by SPi,jπ. It is understood herein that SPi,jπ and SPj,iπ refer to the same simultaneous parameter variable, such that SPi,jπ is always equal to SPi,jπ (and so if one is given a particular value the other is given the same value, or if one is incremented then the other is incremented).
In some examples, the linkage score estimator 126 may, for each pair of source components, determine a score representing a topological linkage between the pair of source components. In some examples, for a given pair of source components i and j, the score may be given by:
Scorei,j=ΣπWi,jπ(SPi,jπ) (1)
This score is a weighted sum of each SPi,jπ, where the sum is over unique parameters π (e.g. variable parameters such as those from Table 5). Put another way, for a given pair of source components i and j, there may be a different SPi,jπ for each unique parameter, and these simultaneous parameters may be summed in the weighted sum.
A higher SPi,jπ may be more likely when the source components i and j are topologically related. However, when a parameter π appears very often in log messages 148 of many source components, a high SPi,jπ may not necessarily indicate a topological linkage. For example, parameters such as ‘start’ or ‘stop’ may occur often in many log messages 148, and as a result may be more likely to occur simultaneously in unlinked source components. In the example parameter stream of Table 5, the parameters ‘NeoView’ and ‘Titanium’ occur often, and therefore may be more likely to occur simultaneously in unlinked source components. Conversely, if a parameter IT appears very few times in a large number of log messages 148 generated by a large number of source components, then SPi,jπ=1 may be a strong indication of a topological linkage between source components i and j. In the example parameter stream of Table 5, the parameter ‘0760afe0-078f-40f8-a9aa-68023ddfc81a’ occurs rarely, and therefore may be less likely to occur simultaneously in unlinked source components. Although the parameter stream of Table 5 includes a small number of parameters, in reality there may be a much larger number of available statistics on the parameter stream, and therefore the above discussion of the frequency of various parameters may be based on a much larger set of parameters.
Accordingly, the weights in equation 1 may be selected in a way to give lower weights to simultaneous parameters for which the parameter appears often in the parameter stream, and higher weights to simultaneous parameters for which the parameters appears rarely in the parameter stream. For example, the weights may be proportional to the rareness of the parameter in the parameter stream.
As discussed earlier, a simultaneous parameter (SP) is a parameter that appears in log messages 148 from two source components i and j within a threshold time period Δt relative to each other. Therefore, v=ΔT/Δt may represent the number of such threshold periods of time Δt within the time period ΔT for which statistics are used.
Then, p=2/v represents the probability that, when a parameter π appears once in time period ΔT of the timeline 202 for source component i (e.g. as designated by 206 in
{circumflex over (n)}
i,j
π
=p·n
j
π
·n
j
π (2)
Accordingly, each linkage score may be determined by using the simultaneous parameter count above the number that would be expected based on the random noise as reflected by equation 2, and by weighting the simultaneous parameter counts inversely proportionally to the expected number of simultaneous parameter counts due to random noise. In this way, the linkage score is calibrated such that the linkage score having above a threshold value (e.g. above zero) indicates that a number of simultaneous parameters of the parameters in the parameter stream are not due to random noise.
Therefore, turning back to
While equation 3 may appear linear in simultaneous parameter counts, it is not, due to the soft threshold function where X+=X for X>0 and otherwise X+=0.
In some examples, the linkage score normalizer 128 may normalize the different determined Scorei,j values (representing different sets of source components i and j) relative to each other such that the Scorei,j values can be used together to infer a global topology of the source components of the network 102 as a whole or a local topology of a number (e.g. more than two) of the source components in the network 102.
In some examples, each Scorei,j may be normalized by dividing by the sum of Scorei,j values involving the same source component i as the Scorei,j being normalized, and dividing by the sum of Scorei,j values involving the same source component j as the Scorei,j being normalized. The resulting normalized score may be given by:
In other examples, each Scorei,j may be normalized by dividing by the root mean square (RMS) of Scorei,j values involving the same source component i as the Scorei,j being normalized, and dividing by the root mean square (RMS) of Scorei,j values involving the same source component j as the Scorei,j being normalized. The resulting normalized score may be given by:
The techniques represented by equations 4 and 5 may be suitable for determining a local or global topology involving each of the source components of the network 102.
In some examples, each of the foregoing normalization techniques may reduce errors in linkage determination resulting from scores involving certain source components having much higher scores due to those source components being significantly more active than other source components, causing higher scores that are not necessarily more reflective of topological linkages than some scores with lower values.
In some examples, the foregoing normalization techniques may amplify some low scores involving some source components that have exhibit little activity. To the extent these scores are positive, their simultaneous parameter counts may not indicate topological linkages involving such a source component, and instead include noise. However, because noisy scores may be small, and these low activity components may be flagged according to a low score activity level. For example, an score activity level for a source component i may be given by summing each of the scores involving the source component i:
Activityi=ΣiScorei,j (6)
Then, any score activity levels for any source components below a threshold (e.g. predetermined threshold) score activity level may be removed, and not used in the normalization determination techniques described earlier (e.g. using equations 4 and 5). Instead, the scores involving source components having high score activity levels may be used in the normalization determination techniques. In some examples, as described by J. Kittler and J. Illingworth in “Minimum Error Thresholding, Pattern Recognition Letters, Vol. 19(1), 41-47, 1986, which is hereby incorporated by reference herein in its entirety, low score activity levels may be identified by modeling the determined score activity levels as a collection as two Gaussian distributions, and performing thresholding to separate these distributions. Source components with score activity levels lower than the threshold may likely be those source components having scores representing noise rather than topological linkages, and therefore may not be used in the normalization determination techniques.
In some examples, the topology estimator 129 may, for each pair of source components i and j, predict whether there is a topological linkage between the source components i and j. The prediction may be based on whether the normalized score (e.g. NormScorei,j) for that pair of source components i and j is above a threshold score (e.g. predetermined threshold score). Therefore, the topology estimator 129 may determine a topology including each of the components of the network 102 (or of a subset of the network 102). In some examples, un-normalized score may instead be used to determine the topology.
Turning to the online system 114, the online system 114 may receive log messages 148 from source components in a computer system such as the network 102. The online system 114, like the offline system 112, may receive the example log messages 148 shown in
In some examples, the log message processor 130 may partition each of the log messages 148 into substrings according to a partitioning rule, cluster the log messages 148 into clusters, and generate a log message template for each of the log messages 148 (e.g. as in Table 2). This may be done in a similar way as described earlier relative to log message processor 116.
In some examples, the parameter stream generator 132 may generate a parameter stream (e.g. as in Table 3 and then Table 4). This may be done in a similar way as described earlier relative to parameter stream generator 118.
In some examples, the parameter filter 134 may filter variable parameters from the parameter stream (e.g. of Table 4) and may filter the parameter stream to remove variable parameters that include fewer than a predetermined threshold number of characters. This may be result in, e.g. the filtered parameter stream of Table 5. This may be done in a similar way as described earlier relative to parameter filter 120.
The log message processor 130, parameter stream generator 132, and parameter filter 134 may perform these tasks on the fly as log messages 148 are received, such that filtered parameters are then continuously provided to the FIFO buffer handler 136 for further processing.
The P-FIFOπ buffers 138 may include, for each unique parameter π from the filtered parameter stream, a P-FIFOπ buffer 138 containing any instances of its respective unique parameter it received in the within the time period Δt immediately preceding the current time, where the time period Δt may be a predetermined time period. For each parameter, the P-FIFO buffer 136 should include a timestamp of the log message 148 which contained the parameter, and a source component ID.
In some examples, when a new parameter π is received in the filtered parameter stream from the network 102, the FIFO buffer handler 136 may remove any parameters π older than the time period Δt immediately preceding the current time from the P-FIFOπ buffer 138 corresponding to the received new parameter π. The new parameter π may then be compared with the rest of the parameters π in the P-FIFOπ buffer 138 corresponding to the received new parameter π to update the SPi,jπ count. That is, if the new parameter π is received from a given source component i, then for each j different from i, the corresponding SPi,jπ may be incremented by a number equal to the number of parameters π from source component j contained in the P-FIFOπ buffer 138. The FIFO buffer handler 136 may add the received new parameter to the P-FIFOπ buffer 138.
In some examples, if a P-FIFOπ buffer 138 does not exist for the received new parameter, then the FIFO buffer handler 136 may create a new P-FIFOπ buffer 138 corresponding to that received new parameter π. On the other hand, the FIFO buffer handler 136 may delete an existing P-FIFOπ buffer 138 when it no longer includes any parameters in the time period Δt immediately preceding the current time.
In some examples, a simultaneous pair event having i, j, π, and t as parameters may be entered to a single S-FIFO, and the tail end of the same S-FIFO may be inspected for simultaneous pairs older than t−ΔT. All those older simultaneous pairs are decremented from their corresponding SPi,jπ(t) state parameters, and consequently flushed from S-FIFO.
In some examples, the linkage score estimator 142 may, for each pair of source components, determine a score representing a topological linkage between the pair of source components. In some examples, for a given pair of source components i and j, the score may be given by:
RecentScorei,j(t)=Σπ(wi,jπ(t)·SPi,jπ(t)−1 (7)
Therefore, equation 7 is a temporal extension of equation 2. The weights wi,jπ(t) may be a function of parameter counts:
The parameter counts niπ(t) may be given by sums over different counters in the C-FIFOπ buffer 140 (i.e. parameter count buffer) corresponding to the parameter π:
n
i
π(t)=Σk=1KCFIFOkπ(t) (9)
Each of the C-FIFOπ buffers 140 stores, for its respective parameter π, parameter counts over a time period ΔT which is longer than the time period Δt. Every ΔT/K the FIFO buffer handler 136 may, for each of the C-FIFOπ buffers 140, start a new counter at the top of the C-FIFOπ buffer 140 and the oldest counter at the bottom of the C-FIFOπ buffer 140 may be removed from the C-FIFOπ buffer 140. Whenever a new parameter π is received, the FIFO buffer handler 136 may increment the top counter of C-FIFOπ buffer 140 corresponding to the new parameter π (e.g. before handling the corresponding P-FIFOπ buffer 138). A parameter count niπ(t) may be incremented in addition to incrementing the most recent counter at the top of the corresponding P-FIFOπ buffer 138 upon receipt of new log messages 148 containing new parameters π. The same parameter count niπ(t) may be decremented by removing the count of the oldest counter from the parameter count niπ(t) when that oldest counter is removed, namely, when the time of that counter is older than the ΔT immediately preceding the current time.
In some examples, if a C-FIFOπ buffer 140 does not exist for the received new parameter, then the FIFO buffer handler 136 may create a new C-FIFOπ buffer 140 corresponding to that received new parameter. On the other hand, the FIFO buffer handler 136 may delete an existing C-FIFOπ buffer 140 when its niπ(t)=0.
In some examples, the topology estimator 143 may (at any given time), for each pair of source components i and j, predict whether there is a topological linkage between the source components i and j. The prediction may be based on whether the linkage score (e.g. RecentScorei,j(t)) for that pair of source components i and j is above a threshold score (e.g. predetermined threshold score). Therefore, the topology estimator 143 may determine a topology including each of the components of the network 102 (or of a subset of the network 102).
At 302, the offline system 112 may receive log messages 148 from source components of the network 102. Any processes previously described as implemented in receiving the log messages 148 may be implemented at 302.
At 304, the log message processor 116 may generate a log message template for each of the log messages 148 (e.g. as in Table 2). Any processes previously described as implemented by the log message processor 116 may be implemented at 304.
At 306, the parameter stream generator 118 may generate a parameter stream (e.g. as in Table 3 and then Table 4). Any processes previously described as implemented by the parameter stream generator 118 may be implemented at 306.
At 308, the parameter filter 120 may filter variable parameters from the parameter stream (e.g. of Table 4) and may filter the parameter stream to remove variable parameters that include fewer than a predetermined threshold number of characters. This may result in, e.g. the filtered parameter stream of Table 5. Any processes previously described as implemented by the parameter filter 120 may be implemented at 308.
At 310, the simultaneous parameter counter 124 may, for each unique parameter in each pair of source components, determine the number of simultaneous parameters in the filtered parameter stream (stored in the log message database 122 or generated based on other data stored in the log message database 122, for example the unfiltered parameter stream, log message templates, and/or log messages 148). Any processes previously described as implemented by the simultaneous parameter counter 124 may be implemented at 310.
At 312, the linkage score estimator 126 may, for each pair of source components, determine a linkage score representing a topological linkage between the pair of source components. Any processes previously described as implemented by the linkage score estimator 126 may be implemented at 312.
At 314, the linkage score normalizer 128 may normalize the different determined linkage scores (representing different sets of source components) relative to each other such that the linkage scores can be used together to infer a global topology of the source components of the network 102 as a whole or a local topology of a number (e.g. more than two) of the source components in the network 102. Any processes previously described as implemented by the linkage score normalizer 128 may be implemented at 314.
At 316, the topology estimator 129 may, for each pair of source components, predict whether there is a topological linkage between the source components. The prediction may be based on whether the normalized linkage score for that pair of source components i and j is above a threshold score (e.g. predetermined threshold score). Therefore, the topology estimator 129 may determine a topology including each of the components of the network 102 (or of a subset of the network 102). Any processes previously described as implemented by the topology estimator 129 may be implemented at 316.
In some examples, the method 300 may return to 302 such that additional log messages 148 may be received, the method 300 may then be performed using the additional log messages 148.
At 402, the online system 114 may receive log messages 148 from source components of the network 102. Any processes previously described as implemented in receiving the log messages 148 may be implemented at 402.
At 404, the log message processor 130 may generate a log message template for each of the log messages 148 (e.g. as in Table 2). Any processes previously described as implemented by the log message processor 130 may be implemented at 404.
At 406, the parameter stream generator 132 may generate a parameter stream (e.g. as in Table 3 and then Table 4). Any processes previously described as implemented by the parameter stream generator 132 may be implemented at 406.
At 408, the parameter filter 134 may filter variable parameters from the parameter stream (e.g. of Table 4) and may filter the parameter stream to remove variable parameters that include fewer than a predetermined threshold number of characters. This may result in, e.g. the filtered parameter stream of Table 5. Any processes previously described as implemented by the parameter filter 134 may be implemented at 408.
At 410, when a new parameter π is received in the filtered parameter stream from the network 102, the FIFO buffer handler 136 may remove any parameters older than the time period Δt immediately preceding the current time from the P-FIFOπ buffer 138 corresponding to the received new parameter. The new parameter may then be compared with the rest of the parameters in the P-FIFOπ buffer 138 corresponding to the received new parameter π to update the simultaneous parameter count. That is, if the new parameter is received from a given source component i, then for each j, the corresponding simultaneous parameter count SPi,jπ may be incremented by a number equal to the number of parameters from source component j contained in the P-FIFOπ buffer 138. The FIFO buffer handler 136 may add the received new parameter to the P-FIFOπ buffer 138. Any processes previously described as implemented by the FIFO buffer handler 136 and P-FIFOπ buffer 138 may be implemented at 410.
At 411, a simultaneous pair event having i, j, π, and t as parameters may be entered to a single S-FIFO, and the tail end of the same S-FIFO may be inspected for simultaneous pairs older than t−ΔT. All those older simultaneous pairs are decremented from their corresponding SPi,jπ(t) state parameters, and consequently flushed from S-FIFO. Any processes previously described as implemented by the FIFO buffer handler 136 and P-FIFOπ buffer 138 may be implemented at 411.
At 412, the FIFO buffer handler 136 may count parameter counts using sums over different counters in the C-FIFO′ buffer 140 (i.e. parameter count buffer) corresponding to each parameter. Any processes previously described as implemented by the FIFO buffer handler 136 and C-FIFOπ buffer 140 may be implemented at 412.
At 414, the linkage score estimator 142 may, for each pair of source components, determine a linkage score representing a topological linkage between the pair of source components. Any processes previously described as implemented by the linkage score estimator 142 may be implemented at 414.
At 416, the topology estimator 143 may, for each pair of source components, predict whether there is a topological linkage between the source components. The prediction may be based on whether the normalized linkage score for that pair of source components i and j is above a threshold score (e.g. predetermined threshold score). Therefore, the topology estimator 143 may determine a topology including each of the components of the network 102 (or of a subset of the network 102). Any processes previously described as implemented by the topology estimator 143 may be implemented at 416.
In some examples, the method 400 may return to 402 such that additional log messages 148 may be received, the method 400 may then be performed using the additional log messages 148. Although the method 400 is shown as returning to 402 after 416, in some examples the offline system 112 may continually receive log messages 148 while performing the remainder of its processing; such that its topology predictions may be continually updated based on recently received log messages 418.
Any of the processors discussed herein may comprise a microprocessor, a microcontroller, a programmable gate array, an application specific integrated circuit (ASIC), a computer processor, or the like. Any of the processors may, for example, include multiple cores on a chip, multiple cores across multiple chips, multiple cores across multiple devices, or combinations thereof. In some examples, any of the processors may include at least one integrated circuit (IC), other control logic, other electronic circuits, or combinations thereof. Any of the non-transitory computer-readable storage media described herein may include a single medium or multiple media. The non-transitory computer readable storage medium may comprise any electronic, magnetic, optical, or other physical storage device. For example, the non-transitory computer-readable storage medium may include, for example, random access memory (RAM), static memory, read only memory, an electrically erasable programmable read-only memory (EEPROM), a hard drive, an optical drive, a storage drive, a CD, a DVD, or the like.
All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and/or all of the elements of any method or process so disclosed, may be combined in any combination, except combinations where at least some of such features and/or elements are mutually exclusive.
In the foregoing description, numerous details are set forth to provide an understanding of the subject matter disclosed herein. However, examples may be practiced without some or all of these details. Other examples may include modifications and variations from the details discussed above. It is intended that the appended claims cover such modifications and variations.
