Log file reduction according to problem-space network topology

Embodiments of the invention provide a method, system and computer program product for log file reduction according to problem space topology. A method for log file reduction according to problem space topology can include receiving a fault report for a fault in a solution executing in memory of one or more computers of a computer data processing system. The method further can include extracting references to at least two resources of the computer data processing system from the fault report. The method yet further can include filtering a set of all log files for the computer data processing system to only a subset of log files related to the at least two resources. Finally, the method can include displaying the subset of log files in a log file analyzer.

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention relates to log file analysis for computer troubleshooting and more particularly to log file reduction to facilitate log file analysis.

Description of the Related Art

System fault troubleshooting can be a task range from the simple to the complex. In the most basic computing system, fault troubleshooting can involve only the manual inspection of the state of one or two components of a computer and the operating system of the computer. In more complex network arrangement, however, where multiple computers are coupled to one another over different communicative linkages, each running different applications that in the aggregation provide a computing solution, troubleshooting a solution fault can be a daunting task. Consequently, systems administrators generally rely upon the different operational logs produced by the different computing resources of the solution in order to identify the source or sources of a system fault.

Over a period of time during which different resources of a computing solution are operational, log files can become voluminous depending upon the frequency of logging events. To facilitate the management of log files, log files can be indexed and managed using traditional database technologies. The indexing of log files provides for very fast access to different log entries, and more importantly, permits the keyword searching of the log files. To wit, when troubleshooting a solution fault, help desk personnel oftentimes utilize data provided by the end user to keyword search different log files seeking the pertinent records likely to provide clues as to the cause of the solution fault.

Keyword searching log files to pinpoint the source of a solution fault can be troublesome in the face of many log files each recording volumes of events. In particular, many log file entries and indeed some log files may pertain only to portions of a solution topology not relevant to the fault at hand. Yet, the end user still must process each keyword search result in each log file when keyword searching the various log files of the entire topology. Accordingly, the keyword searching of log files generally is one-dimensional in nature and can result in the most interesting and pertinent logged events being lost in a sea of irrelevant events.

BRIEF SUMMARY OF THE INVENTION

Embodiments of the present invention address deficiencies of the art in respect to log file searching and provide a novel and non-obvious method, system and computer program product for log file reduction according to problem space topology. In an embodiment of the invention, a method for log file reduction according to problem space topology can include receiving a fault report for a fault in a solution executing in memory of one or more computers of a computer data processing system. For example, the fault report can be a message from an end user of the solution. The method further can include extracting references to at least two resources of the computer data processing system from the fault report. The references can include by way of example, computers in the computer data processing system and switches utilized in a computer communications network communicatively coupling together the computers, or applications executing in memory of computers in the computer data processing system. The method yet further can include filtering a set of all log files for the computer data processing system to only a subset of log files related to the at least two resources. Finally, the method can include displaying the subset of log files in a log file analyzer.

In one aspect of the embodiment, the method additionally can include keyword searching the subset of log files. In another aspect of the embodiment, the method can include computing an intermediate resource disposed within a communications pathway between the two resources and including in the subset log files associated with the intermediate resource.

In another embodiment of the invention, a computer data processing system can be configured for log file reduction according to problem space topology. The system can include a client computer with memory and at least one processor and coupled to a computer data processing system of one or more computers communicatively coupled to one another over a computer communications network through one or more switches. The computer data processing system also can host one or more computer programs providing a computing solution to an end user. The system additionally can include log files generated by different resources in the computer data processing system and a log file analyzer executing in memory of the client computer and configured to keyword search log files loaded for analysis in the log file analyzer. Finally, the system can include a log file reduction module coupled to the log file analyzer and executing in the memory of the client computer. The module can include program code enabled to receive a fault report for a fault in the solution, to extract references to at least two resources of the computer data processing system from the fault report, to filter the log files to only a subset of log files related to the at least two resources and to display the subset of log files in the log file analyzer.

DETAILED DESCRIPTION OF THE INVENTION

Embodiments of the invention provide for log file reduction according to problem space topology. In accordance with an embodiment of the invention, a report of a solution fault can be received and at least two resources of a computing topology for a computing system providing the solution can be determined from the report. A subset of a set of logs for the computing system can be mapped to the two resources and only the subset of the logs can be presented in a user interface for review of logged events associated with the solution fault. Optionally, a third resource in communication with both of the two resources can be identified and logs for the third resource also can be presented in the user interface. In this way, the number of logs presented for review and keyword searching in order to troubleshoot the solution fault can be reduced according to the topology pertaining specifically to the solution fault as expressed in the report of the solution fault.

In further illustration,FIG. 1is a pictorial illustration of a process for log file reduction according to problem space topology. As shown inFIG. 1, an end user110can provide a fault report140in respect to a solution fault for a solution provided by a computer data processing system120. The solution can include one or more computer programs which execute in one or more computers coupled to one another over one or more computer communications networks interconnected to one another through switching resources including routers. The solution further can include one or more data storage resources, such as one or more database management systems.

Different log files130for different resources of the computer data processing system120can be produced during the operation of the computer data processing system120including a duration of time when a fault has occurred in respect to the solution which resulted in the fault report140. The fault report140itself can include a formalized report of the occurrence of a report, or a message transmitted to the end user110specifying a nature of the fault. In any case, a resource list150can be extracted from the fault report140. For example, references to different resources of the computer data processing system120within the fault report140can be extracted from the fault report140and aggregated into a resource list150of at least two resources determined to be relevant to the fault report140.

Optionally, one or more resources of the computer data processing system120that are disposed between a communicative pathway between the resources of the resource list150can be included in the aggregation of relevant resources. Thereafter, log file reduction logic160can apply a filter170to the log files130to generate a subset180of the logs130related only to the relevant resources of the resource list150. The subset180of the logs130in turn can be provided to the end user110so that the end user110can conduct keyword searching against a reduced set of the logs130relevant to the resources of the computer data processing system120associated with the fault report140.

In yet further illustration,FIG. 2schematically depicts a computer data processing system configured for log file reduction according to problem space topology. The system can include one or more computers210, each with memory and at least one processor supporting the operation of one or more computer programs in an operating system or virtual machine. The computer programs can include data processing applications, database management applications managing data in one or more coupled databases260, or even an application server250acting as a container to other computer programs. The computers210can be coupled to one another over a computer communications network220by way of one or more switches270, including, for example, intelligent switches or routers.

A client230can be coupled to the computer data processing system over the computer communications network220. The client230can include a log file analysis application240configured to keyword search loaded log files280provided by the computer data processing system. Importantly, however, a log file reduction module300can be coupled to the log file analysis application240and configured upon execution in the memory of the client230to reduce the log files280to a subset for keyword searching in the log file analysis application240based upon references to one or more resources of the computer data processing system within a fault report for a fault of the computer data processing system. In this regard, the resources can include not only the computers210, but also the applications executing therein, the switches270, the application servers250and the databases260.

In even yet further illustration of the operation of the log file reduction module300,FIG. 3is a flow chart illustrating a process for log file reduction according to problem space topology. Beginning in block310, a fault report can be received for a fault in the operation of a computing solution executing within a computer data processing system. For example, the fault can be a run-time error in operation, a hardware failure, a failure of computer interroperations or a failure of communications, to name only a few examples. The fault report can be a message transmitted by an end user including reference not only to the nature of the fault, but also the message can enumerate one or more resources associated with the fault.

In block320, two or more resources referenced within the fault report can be extracted from the fault report and in block330, one or more resources can be computed as being disposed in a communications pathway between the two or more resources referenced in the fault report. Thereafter, in block340the log files for the computer data processing system can be filtered into a subset of log files including only those log files affiliated with the two or more resources of the fault report and the computed intermediate resources. Finally, in block350the subset of log files can be presented in a user interface and can be subjected to keyword searching.