Patent Application
20170364565
The present invention generally relates to the management of information contained within a log, and more particularly to managing information contained within a log to display the logged information in segmented groups relating to time context indexing.
In accordance with an embodiment, a method for displaying log records is provided. The method includes providing a plurality of log records wherein a respective log record has a time stamp identifying the time of an occurrence of a computer system event. The method also includes providing a display index correlating a respective time threshold between consecutive log records with respective display line spacing for facilitating the display of consecutive log records utilizing a display. The method further includes accessing a plurality of consecutive log records from a log file and evaluating the gap in time of an occurrence between consecutive log records and comparing the respective gap in time with a respective time threshold of the display index to determine respective display line spacing for displaying consecutive log records. A display displays the plurality of log consecutive log records in segmented groups with each group separated by a display line spacing corresponding to a respective time threshold between consecutive records as identified by the display index.
In another embodiment of the invention, a system for displaying log records is provided. The system includes a log file stored in memory containing a plurality of log records associated with the operation of a computer system. Each log record includes a time stamp identifying the time of occurrence of a computer event. The system further includes a display index correlating a respective time threshold between consecutive log records with respective display line spacing for facilitating the display of consecutive log records utilizing a display. The system also includes a processor determining the time of an occurrence of a computer system event associated with a respective log record and evaluating the gap in the time of an occurrence between consecutive log records and comparing the respective gap in time with the respective time threshold of the display index to determine a respective display line spacing for displaying consecutive log records. A display displays the plurality of log records in segmented groups with each group separated by a display line corresponding to a respective time threshold between consecutive records.
In accordance with a further embodiment, a computer program product for displaying log records in a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method is provided. The method includes providing a plurality of log records wherein a respective log record has a time stamp identifying the time of an occurrence of a computer system event. The method also includes providing a display index correlating a respective time threshold between consecutive log records with respective display line spacing for facilitating the display of consecutive log records utilizing a graphical user interface. The plurality of consecutive log records are accessed from the log file and determining the time of an occurrence of a computer system event associated with a respective log record is determined by the processing circuit and the gap in the time of an occurrence between consecutive log records is evaluated and compared with the respective gap in time with the respective time threshold of the display index to determine a respective display line spacing for displaying consecutive log records. The plurality of log records is displayed by a display in segmented groups with each group separated by a display line corresponding to a respective time threshold between consecutive log records.
The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other features, and advantages of the invention are apparent from the following detailed description taken in conjunction with the accompanying drawings in which:
The operation of computer systems incorporates the creation of log records for various purposes. A log file consists of log records which record computer activity. Logs records are append-only, totally-ordered sequence of records ordered by time. The log records are appended to the end of the log and assigned a unique consecutive log entry number. The log records have a specific purpose in recording what happens in the computer system and when. The log records are written by the operating system or other control program for such purposes as recording incoming dialogs, error and status messages and certain transaction details. The operational processing of certain routines may also be recorded to evaluate their processing times. Additionally, when debugging or trouble shooting the operation of a computer system, log records enable operators to evaluate the operation of the computer system to investigate the occurrence of abnormalities in the system's performance.
With the complexity of computer systems, the multitude of transactions processed has resulted in log files becoming increasingly large and in many cases unwelding. For instance, in certain systems, a maximum log file size may be set at 2 terabytes per log file and numerous log files may exist. Consequently, the presentation of the log file records for review by an operator should be done in a manner which enables the operator to easily discern the information contained in the log records.
Embodiments of the present disclosure present a novel log management system utilizing time context indexing. In exemplary embodiments, the log records are manipulated for being displayed in an easily readable format.
Referring to
Thus, as configured in
In exemplary embodiments, a log management system is provided that utilizes log files which contain a plurality of log records associated with the operation of a computer system. Each log record includes a time stamp identifying the time of occurrence of a computer event. A display index correlating a respective time threshold between consecutive log records with respective display line spacing is utilized for facilitating the display of consecutive log records in association with a display. The time of an occurrence of a computer system event associated with a respective log record is determined and the respective gap in time between consecutive log records is determined and compared with the respective time threshold of the display index to determine respective display line spacing for displaying consecutive log records. The plurality of log records is displayed by a display in segmented groups with each group separated by a display line corresponding to a respective time threshold between consecutive log records.
As shown in
Referring now to
To facilitate in the clarity of presenting the log for review by an operator, the log records are presented in a segmented manner for distinguishing operational activities which occur in a related timeframe. The timestamp of each log record is evaluated at block 340 to determine the time of occurrence of a computer system event as denoted by a respective log record and the time gap between consecutive log records is determined to evaluate if the log records occurred in a related timeframe. A display index is utilized at block 350 to determine the formatting of the visual representation of the log. The log records are displayed consecutively by the display at block 360 based on the formatting criteria defined by the display index and may be displayed in segmented groups based on the related timeframe of occurrence.
Referring now to
As shown in
In an illustrative example, the advantage of the embodiment as shown enables programmers and operators to debug software easily. From the segmented log records shown in
The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.
The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.
Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object-oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.
Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.
These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.
