Log File Recommender

A computer implemented method identifies a root cause of a problem. A number of processor units uses a machine learning model to predict a set of initial log files for review to identify the root cause of the problem. The number of processor units displays the set of initial log files predicted by the machine learning model on a graphical user interface. The number of processor units predicts a set of next log files for review to identify the root cause of the problem using the machine learning model and user behavior data related to the graphical user interface in response to a user input to the graphical user interface. The number of processor units displays a recommendation to review the set of next log files predicted by the machine learning model on the graphical user interface.

BACKGROUND

The disclosure relates generally to an improved computer system and more specifically to recommending log files for review in response to an application or computer system issue.

Log files are tools used to troubleshoot application and computer issues. These log files provide insight into the behavior of an application by recording events, errors, warnings, and other information. Analysis of these log files can be performed to aid in identifying the root causes of issues and to identify actions to resolve those issues. Log files can be used for error identification, debugging, performance analysis, auditing compliance, and other purposes.

Often times, the analysis of log files performed to identify causes for problems and resolve reported problems involves multiple log files. Analysis of one log file can provide parameters or information that can be used to search for other log files that may be of interest for analysis in identifying the root cause of the problem. For example, analyzing one log file may reveal information that references other log files or components that can be connected to other components that generate log files. These log files for other components can sometimes be identified using the current log file. For example, a log file may include error messages or unique identifiers that can be used to search for other log files.

This type of information is not always present. In some cases, analysis of log files does not provide information that can be used to easily identify another log file for review. In this case, knowledge about the system, dependencies with other systems, and common issues between systems can be used to determine related log files for review. Further, past experience with similar issues can be used to determine which log files to review that can provide information about the current issue.

SUMMARY

According to one illustrative embodiment, a computer implemented method identifies a root cause of a problem. A number of processor units uses a machine learning model to predict a set of initial log files for review to identify the root cause of the problem. The number of processor units displays the set of initial log files predicted by the machine learning model on a graphical user interface. The number of processor units predicts a set of next log files for review to identify the root cause of the problem using the machine learning model and user behavior data related to the graphical user interface in response to a user input to the graphical user interface. The number of processor units displays a recommendation to review the set of next log files predicted by the machine learning model on the graphical user interface. According to other illustrative embodiments, a computer system, and a computer program product for identifying a root cause of a problem are provided.

DETAILED DESCRIPTION

The illustrative embodiments recognize and take into account a number of different considerations as described herein. The illustrative embodiments recognize and take into account that a problem description can be received for an issue in a system and that a user identifies a log file to review based on the problem description. The selection of the log file is made from various log files that can be present within a computer system.

The computer system can have multiple hardware architectures and appointments. Further, different components and configurations are present in the computer system. These different components can generate log files. These different components include, for example, an operating system, a Web server, a database, an application server, a network device, a virtual platform, an application, a microservice, a security service, and other types of components that run in the computer system. With these different components, hundreds or thousands of log files may be present that are relevant to different problems.

Currently, subject matter experts (SMEs) use their experience to information in the computer system to determine a root cause of the problem. In other words, the subject matter experts can determine which log files to review based on their experience. Analyzing and navigating through the numerous log files requires many years of experience. Newer engineers can require extensive training time to be able analyze and navigate log files. When subject matter experts train newer engineers, their ability to have time to analyze and troubleshoot problems is limited.

Identifying log files to analyze can be complex. A common transaction ID to connect log entries between files components may not be present. Further, different components can have different file structures. Additionally, a file's relevance identifying the root cause for a particular problem can vary from case to case. The subject matter experts decide which files to check based on the analysis of a profile based on experience. A generally applicable process is not available with current log techniques for analyzing log files to troubleshoot problems.

Thus, illustrative embodiments provide a computer implemented method, apparatus, a computer system, and a computer program product for identifying a root cause of the problem. In one illustrative example, a computer implemented method is used to identify the root cause of a problem. A number of processor units uses a machine learning model to predict a set of initial log files for review to identify the root cause of the problem. The number of processor units displays the set of initial log files predicted by the machine learning model on a graphical user interface. The number of processor units predicts a set of next log files for review to identify the root cause of the problem using the machine learning model and user behavior data related to the graphical user interface in response to a user input to the graphical user interface. The number of processor units displays a recommendation to review the set of next log files predicted by the machine learning model on the graphical user interface.

As used herein, a “set of” when used with reference items means one or more items. For example, a set of initial log files is one or more of initial log files.

With reference now toFIG.2, a block diagram of a log analysis environment is depicted in accordance with an illustrative embodiment. In this illustrative example, log environment200includes components that can be implemented in hardware such as the hardware shown in computing environment100inFIG.1.

In this illustrative example, log analysis system202in log environment200can operate to assist user203in identifying root cause204of problem205. Log analysis system202comprises computer system212and log file predictor214. Log file predictor214is located in computer system212.

As used herein, “a number of” when used with reference to items, means one or more items. For example, “a number of operations” is one or more operations.

As depicted, computer system212includes a number of processor units216that are capable of executing program instructions218implementing processes in the illustrative examples. In other words, program instructions218are computer readable program instructions.

As used herein, a processor unit in the number of processor units216is a hardware device and is comprised of hardware circuits such as those on an integrated circuit that respond to and process instructions and program code that operate a computer. A processor unit can be implemented using processor set110inFIG.1. When the number of processor units216executes program instructions218for a process, the number of processor units216can be one or more processor units that are in the same computer or in different computers. In other words, the process can be distributed between processor units216on the same or different computers in computer system212.

Further, the number of processor units216can be of the same type or different type of processor units. For example, the number of processor units216can be selected from at least one of a single core processor, a dual-core processor, a multi-processor core, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), or some other type of processor unit.

In this illustrative example, log file predictor214operates to assist user203in identifying root cause204for problem205. Log file predictor214uses machine learning model208to predict a set of initial log files210for review to identify root cause204of problem205.

Log file predictor214displays the set of initial log files210predicted by machine learning model208on graphical user interface220. Other information can also be displayed on graphical user interface220in addition to the set of initial log files210. For example, at least one of an input field for a search query, a search result, keywords highlighted from a search of a log file, a set of related customer cases, or a problem description for the problem can be displayed on graphical user interface220.

In this illustrative example, user behavior221for user203with respect to graphical user interface220can be identified from the display of this information on graphical user interface220. This user behavior identified from interaction or viewing graphical user interface220forms user behavior data228.

In this illustrative example, graphical user interface220is displayed on display system219in human machine interface (HMI)217. Human machine interface217also includes input system223. Display system219is a physical hardware system and includes one or more display devices on which graphical user interface220can be displayed. The display devices can include at least one of a light emitting diode (LED) display, an organic light emitting diode (OLED) display, a computer monitor, a projector, a flat panel display, a heads-up display (HUD), a head-mounted display (HMD), smart glasses, augmented reality glasses, or some other suitable device that can output information for the visual presentation of information.

User203is a person that can interact with graphical user interface220through user input224generated by input system223for computer system212. Input system223is a physical hardware system and can be selected from at least one of a mouse, a keyboard, a touch pad, a trackball, a touchscreen, a stylus, a motion sensing input device, a gesture detection device, a data glove, a cyber glove a haptic feedback device, or some other suitable type of input device.

Log file predictor214predicts a set of next log files226for review to identify root cause204of problem205using machine learning model208and user behavior data228related to graphical user interface220in response to a user input224to graphical user interface220. Machine learning model208takes a number of different forms. For example, machine learning model208can be selected in a group comprising a transformer machine learning model, a Bidirectional Encoder Representations from Transformers (BERT) machine learning model, a neural network work, a recurrent neural network, and other suitable types of machine learning models.

In this illustrative example, user behavior data228can be at least one of explicit data225or implicit data227. Explicit data225can be data based on user behavior221that generates user input224. For example, explicit data can be a selection of a log file, a rejection of the log file, or other suitable user input with respect to log files. Implicit data227can be based on information displayed or presented to the user on graphical user interface220. For example, implicit data227can be in the form of keywords and log files in graphical user interface220. Implicit data227can also be based on user input224in some examples. For example, implicit data227can comprise searches performed by user203in graphical user interface220. In the illustrative example, user behavior data228can be selected from at least one of explicit data225, implicit data227, sequences of log files viewed by a user, a selection of a log file for review, the removal of a log file for consideration, a search query, a set of keywords displayed on the graphical user interface, a portion of the log file reviewed, an amount of time spent on a log file, or other behavior by user203with respect to graphical user interface220.

In this example, log file predictor214displays recommendation230to review the set of next log files226predicted by machine learning model208on graphical user interface220. Initially in one illustrative example, the sequences of log files viewed by user203are zero or no log files. In other words, a log file has not yet been recommended because user203has not selected a log file.

Log predictor file214can use machine learning model208to predict and display a set of initial log files210. This display of the set of initial files226can be made to provide a starting point to provide log files that may be selected for review.

In this illustrative example, user behavior221may be to select one of the set of initial log files or to select a different log file. The different log file can be obtained from a search or other source. As user203selects log files for review, those log files are added to the sequence of log files that are input with other user behavior data228to determine the next log file to recommend based on selection.

Turning next toFIG.3, an illustration of training a machine learning model is depicted in accordance with an illustrative embodiment. In the illustrative examples, the same reference numeral may be used in more than one figure. This reuse of a reference numeral in different figures represents the same element in the different figures.

In this illustrative example, log file predictor214trains machine learning model208to predict the set of initial log files210and the set of next log files226to create trained machine learning model300using training dataset302. The initial set of log files210are predicted using the problem description.

In this illustrative example, the training can be performed using training dataset302. Training dataset302comprises log file name sequences304used in determining root cause204of problem205and problem descriptions306for problem305.

In this example, a log file name sequence in log file name sequences304is a sequence of log filenames in in the order that the log files were reviewed or analyzed to determine root cause204of problem205for a particular problem description and problem descriptions306. Log file name sequences304can be historical sequences of long filenames followed by users such as subject matter experts used to determine root cause204for problem205. In other words, the same type of problem may be analyzed by multiple subject matter experts for the same type of problem205. These log file name sequences and their problem descriptions are used to create training dataset302.

A problem description can be, for example, “the replication engine has stopped working in the database”. Another problem description can be “incorrect data replicated in the tables”.

In one illustrative example, this training of machine learning model208can be performed in multiple stages or phases. Further, log file predictor214can start training with a pretrained version of machine learning model208.

Log file predictor214can train machine learning model208to predict masked log file names310in log file name sequences304. In this example, a masked log file name in a log file name sequence is a log file name that is hidden. The masked log file name can be anywhere in the log file name sequence. Machine learning model208is trained to predict the name of the masked log file name based on the log file names in the other portions of the log file name sequence that are not masked. In these examples only a single log file name is masked in the log file name sequence.

In this example, log file predictor214trains machine learning model208to predict next log file names312in log file name sequences304in response to training machine learning model208to predict masked log file names310in the log file name sequences304. In this example, this phase of training is performed using training dataset302comprising log file name sequences304, user behavior data332, and correlations334between the user behavior data332and log file name sequences304. In this example, log file name sequences304is a type of user behavior data and can be correlated to other user behavior data in user behavior data332.

Additionally, after using machine learning model208to predict the next log file names312in response to user behavior221, additional training of machine learning model208can be performed based on user behavior data228collected for user behavior221. For example, log file predictor214can retrain machine learning model208using reinforcement learning340and training dataset342comprising user behavior data228relating to user behavior221with respect to graphical user interface220.

In one illustrative example, one or more solutions are present that overcome a problem with determining the root cause of the problem. As a result, one or more solutions can provide an ability to more quickly and efficiently determine the root cause of the problem. With the use of log analysis system202in the different illustrative examples, less experienced users than subject matter experts can perform root cause analysis more efficiently even with less experience.

In the illustrative examples, a log analysis system202with graphical user interface220provides a tool to users to identify a sequence of log files to review in determining the root cause of the problem. In the illustrative examples, this prediction of the next file in the sequence of log files is based on user behavior data that includes both explicit data and implicit data. In this manner, problem resolution can be accelerated using this system.

Computer system212can be configured to perform at least one of the steps, operations, or actions described in the different illustrative examples using software, hardware, firmware, or a combination thereof. As a result, computer system212operates as a special purpose computer system in which log file predictor214in computer system212enables predicting a next log file to review in determining root cause204of problem205. Log file predictor214transforms computer system212into a special purpose computer system as compared to currently available general computer systems that do not have log file predictor214.

In the illustrative example, the use of log file predictor214in computer system212integrates processes into a practical application for a method identifying a root cause of the problem in a computer system such as computer system212. In one illustrative example, log file predictor214in computer system212is directed to a practical application of processes integrated into log file predictor214in computer system212that suggests log files for review in identifying the root cause of the problem. In this illustrative example, log file predictor214in computer system212uses a machine learning model to predict a set of initial files based on the problem description of the problem. Additionally, log file predictor214recommends a next log file for review based on user behavior such as the selection of a log file review.

Further, although the illustrative examples of focused on describing training with respect to names of log files and user behavior data, other information can also be used in training machine learning model208to predict the next log file for review based on the sequence of log files already reviewed. For example, the content of the log files can also be included in the training datasets used to train machine learning model208. In other words, the log entries in the log files can be used to train machine learning model208in addition to log file name sequences and user behavior data.

For example, one or more users in addition to user203can review log files in analyzing problems using human machine interfaces in addition to human machine interface217. As another example, machine learning model208is trained for a specific application in this example. For example, the application can be a database, a backend database, a data replication engine, high-availability service, and other applications that can generate or use logs. One or more machine learning models in addition to machine learning model208can be trained to predict the next log file from sequences of log files for other types of patterns. Further, machine learning model208can be trained for an application in a specific domain. Each domain is a specific environment such as a software development, production, testing, cloud, and other types of environments.

With reference next toFIG.4, a flow diagram of a process for creating and using a machine learning model to recommend log files for review is depicted in accordance with an illustrative embodiment. In this illustrative example, flow diagram400can be implemented in log analysis system202inFIG.2. As depicted, data flow400has four sections. These sections are training402, inference404, data collection406, and retraining408.

As depicted, training402begins with language model401being trained to predict masked log file names in sequences of log file names in block412. In this block, this training is considered a fine-tuning of language model401. In this example, language model401is a type of machine learning model that is designed to understand human language.

In this example, this language model can be pretrained to understand human language prior to training in block412. For example, language model401can be trained on a database of text and learn statistical patterns and structures in language. Pretraining can be performed to teach language model401to predict missing words in sentences. This type of training enables the machine learning model to learn basic concepts of natural language such as which words tend to appear together. This pretrained model can also be referred to as a foundation model.

This pretrained model can then be further trained to perform a specific task. In this example, the specific task is predicting a next log file from a sequence of log files and a problem description.

Additional training is performed in block414in which language model401is trained to use additional inputs to predict the next log file name in a sequence of log file names. In block414, the training is considered a second fine-tuning of language model401. This fine-tuning can also be referred to as conditioning of language model401.

In block414, the additional inputs are user behavior data that can be collected from monitoring user behavior with respect to a graphical user interface. The prediction of the next file name in a sequence of filenames can be performed from a given set of filenames. This type of prediction involves multiclass classification. Language model401is then deployed for use in block416.

In block416, language model401can predict a set of initial log files for review based on a problem description. In other words, language model401predicts the set of log file names corresponding to log files as recommendations for review.

Further, language model401can predict a next log file to recommend for review based on the current sequence of log files reviewed by user. In other words, the current sequence of log files reviewed by the user is input into language model401. In turn, language model401outputs a prediction of the next log file that should be reviewed based on the sequence of log files input into language model401.

Next in inference404, the machine learning model is used to analyze a problem to determine a root cause. In inference404, a set of initial log files is predicted from a problem description input into language model401in block420. The initial log files are displayed on a graphical user interface in block422. In this example, the user views the files displayed on the graphical user interface in block424.

User input is generated in block428. This user input can be a selection of one of the initial log files displayed in block422, a log file selected from a search, a recommended log file, or other types of user input with respect to log files.

A next log file is predicted in response to the user input from the problem description and user behavior data in block426. This prediction can be made using user behavior data407collected through data collection in block406. In this example, the user behavior data407is collected in data collection by in block406in flow diagram400. User behavior data407can be explicit or implicit data.

Explicit data can be based on user input with respect to log files. This user input can be the selection of an initial log file, a selection of the recommended log file, or the selection of a log file from a search. This explicit user input can also be the deletion or clearing of a log file displayed in the graphical user interface.

In this example, implicit data can be other data based on information displayed to the user in the graphical user interface. For example, the display of information in the graphical user interface is considered implicit feedback because this display of information does not allow a direct conclusion as to whether the user found the recommended log file helpful.

In one example, the collected data in data collection406includes the sequence of log files that the user has looked at442, explicit feedback444, search queries made by the user446, and keywords that are visible448. Other information can also be used in addition to these examples. The other information used to make this prediction includes other behavior data relating to user behavior with respect to the graphical user interface.

In one illustrative example, a user input selecting a log file for review can be generated in block428. In response to selecting a log file, the next log file is predicted using the problem description and user behavior data407collected in data collection406. This flow continues until the problem is solved with the process. The flow then ends with problem solved in block430. In this illustrative example, a next log file can be predicted for review if a log file is not selected for review in the user input. Other user input such as scrolling through information displayed on graphical user interface can also be used to predict the next log file for review.

In data collection406, different types of behavior data are collected for use in predicting the next log file name and for use in training the language model401. In this section, the data collected can include sequence of log files that the user looked at442on the graphical user interface, explicit feedback444, search queries made by the user446, keywords that are visible448in the graphical user interface, and other types of data that can be collected with respect to user behavior with respect to the graphical user interface that the user interacts with when analyzing the problem.

In this example, sequence of log files that the user looked at442in behavioral data407are log files that the user has selected to review. These log files can include one or more of the initial log files, log files recommended to user, and log files from searches. Explicit feedback444can be user input selecting files such as initial log files, a recommended next log file, a log file from a search, or other log files that can be selected for review in the graphical user interface. Explicit feedback444can also be user input that removes or clears a log file from consideration.

Search queries made by the user446in behavioral data407includes are searches made by a user to search for log files for information to determine the root cause of the problem. Keywords that are visible448can be, for example, keywords in search results returned from queries and keywords in portions of log files displayed in graphical user interface.

Further training of language model401is performed in retraining408. The additional training in retraining408can be performed in a number of different ways. In this example, retraining408includes reinforcement learning451and collected data retraining453. Reinforcement learning451can be used to improve predictions based on user feedback collected in user behavior data407. Collected data retraining453can be used to reduce issues of data drift. Data drift can occur with version upgrades of components in the application. Further, this type of training can also improve coverage. Initially collected data may not have as many cases as needed or desired level of accuracy. Further, this retraining can improve the overall performance of machine learning models in the form of language models.

For example, the reinforcement learning451can be initiated in block450if the amount of feedback collected from users using the machine learning model since the last retraining is greater than a threshold. Factors for selecting the threshold can include the overhead or cost of frequent retraining and redeployment of the model versus the improvement in predictions occurring from the retraining.

For example, if the system is heavily used by many users producing large amounts of feedback, the threshold may be set to a higher value to reduce the cost of retraining. On the other hand, if the system is used infrequently by a small number of users, a lower threshold is selected to avoid waiting longer periods of time before retraining.

With reinforcement learning451in block452, rewards are assigned to explicit and implicit feedback received from users of the system. Both positive and negative rewards can be assigned to user behavior data407collected in data collection406.

For example, a positive reward can be assigned when a recommended log file is selected for review. A negative reward can be assigned when a recommended log file is not selected for review. In other words, the negative reward results from a user by taking the recommendation made for the next log file for review.

The language model is retrained using reinforcement learning in block454. In this example, the training is performed using the user behavior along with any assignment of rewards. The reinforcement learning is a machine learning algorithm that can be formed in which the language model predicts log files for review in order to maximize the rewards.

In another illustrative example, further training of language model401can be performed using collected data retraining453. This type of retraining can be initiated in response to the number of log file sequences collected since the last retraining is greater than a threshold in block456. With this example, the retraining of language model401is performed in block458using log file sequences and user behavior data407collected in data collection406collected since the last retraining.

Illustration of flow diagram400inFIG.4is an example of one manner in which process and data flow can be implemented in log analysis system202inFIG.2. This illustration is not meant to limit the manner in which log analysis system202can be implemented in other illustrative examples. For example, process flow400predicts the next log file in block426. In other illustrative examples, a set of one or more next files can be predicted. With this example, more than one log file can be predicted and recommended to the user for review. With this example, more than one log file can be recommended when the probability of several log files are above the selected threshold for selecting the next log file that should be reviewed.

Turning now toFIG.5, a graphical user interface for problem analysis is depicted in accordance with an illustrative embodiment. In this illustrative example, graphical user interface500is an example of an implementation graphical user interface220inFIG.2.

In this illustrative example, graphical user interface500is displayed as a graphical tool for use by a user to identify a root cause of the problem. The arrangement and manner in which information is graphically displayed in graphical user interface500provides the user an ability to more easily and quickly identify and select log files for review in determining the root cause of the problem.

In this example, graphical user interface500includes customer problem description section502. The problem description submitted by a customer is displayed in this section of graphical user interface500.

Initial log files section504is a section in which initial log files506are displayed as recommendations for review by the user. In this example, initial log files506in this section can be predicted based on the problem description in customer problem description section502. Additionally, related customer cases section503includes links that can be selected to display particular customer cases. The selection of one of these links can be used to predict a next log file for recommendation. The selection of a customer case can be considered implicit feedback.

As depicted, log file field508displays a path to the log file displayed in log file section520. A user can input a path to a file that the user wants to view in log file field508. Search field512can be used to search for content in the log file displayed in log file section520. The results of this search are highlighting of keywords in the content displayed in log file section520.

In this example, log file field514displays a path to the log file displayed in log file section522. A user can input the path to the log file that the user wishes to view in log file field514. The result of the input is the display of the log file in log file section522. Search field516is used to search the contents of the log file displayed in log file section522.

In this illustrative example, log entries are displayed in log file section520and log file section522. In this example, two log files can be viewed at the same time in graphical user interface500in log file section520and log file section522. These log files can be scrolled side-by-side in this example. In other illustrative examples, these log file sections can be scrolled in parallel horizontally in which one log file is shown over another log file in graphical user interface500.

Next log file section524includes a next recommended log file for a user to review. This next log file is predicted based on user behavior with respect to graphical user interface500. The user behavior can include a sequence of log files already reviewed by the user using graphical user interface500. If the user has not yet reviewed log files, the behavior can include the interaction of user with respect to various fields in graphical user interface500.

Further, user behavior can implicitly be the content viewed by the user or keywords seen by the user in graphical user interface500. A user can be considered to have viewed content or seen keywords if the content or keywords are visible in graphical user interface500. The content or keywords can be, for example, the log entries displayed in log file section520and in log file section522. Keywords can be, for example, “error”, “null pointer exception”, “replication”, or other keywords that may be relevant to a particular problem.

Other user behavior that can be used to predict the next log file to recommend to the user include whether the user selects or inputs a log file for review or if the user clears or deletes a selection. For example, user input can be an input of a path to a log file in log file field508. In another example, the path to the log file in log file field508can be cleared through the selection of delete control530. Clearing or deleting the path in log file field508results in the log file being displayed in log file section520being cleared.

In a similar fashion, a path to a log file in log file field514can be cleared through the selection of delete control532in log file field514. Clearing the path in log file field514results in the content of the log file being displayed in log file section522being cleared. This type of user input is also collected as user behavior data and can be used with a sequence of log files reviewed by the user so far to predict the next log file or recommendation for review.

Turning toFIG.6, a flowchart of a process for identifying a root cause of a problem is depicted in accordance with an illustrative embodiment. The process inFIG.6can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions that are run by one of more processor units located in one or more hardware devices in one or more computer systems. For example, the process can be implemented in log file predictor214in computer system212inFIG.2.

The process begins by receiving a problem description (step600). The process predicts a set of initial log files for review (step602). The process displays the set of initial log files on a graphical user interface (step604).

The process identifies user behavior data from user activity with respect to the graphical interface (step606). In step606, the user behavior data can be, for example, explicit feedback, implicit feedback, a sequence of log files that the user has looked at, search queries made by the user, keywords that are visible on the graphical user interface, and other types of user behavior. In this example, keywords that are visible in the graphical user interface are a form of implicit feedback regarding user behavior. The visibility of keywords can influence selections made by the user and is an implicit type of feedback in this example. Explicit feedback can be the selection of a log file for review or affirmatively removing a log file from consideration.

The process predicts a next log file using the behavior data (step608). This prediction can be made regardless of whether the user has selected a log file for review. Other user input such as performing search, scrolling through log files already displayed, or other user actions can be used to identify user behavior data that can be used to predict the next log file. In other words, the user input does not need to be the selection of another log file to determine the next log file for review. In predicting the next log file to review, the same log file may be recommended based on the user behavior data when a log file is not selected for review by the user.

The process displays the next log file in the graphical user interface (step610). Depending on the type of user input, the next log file may be the same log file as previously predicted.

A determination is made as to whether the root cause of the problem has been identified by the user (step612). If the root cause of the problem has been identified, the process terminates. Otherwise, the process returns step606.

Turning next toFIG.7, a flowchart of a process for identifying a root cause of a problem is depicted in accordance with an illustrative embodiment. The process inFIG.7can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions that are run by one or more processor units located in one or more hardware devices in one or more computer systems. For example, the process can be implemented in log file predictor214in computer system212inFIG.2.

The process begins by using a machine learning model to predict a set of initial log files for review to identify the root cause of the problem (step700). In step700, the machine learning model is trained to predict the set of initial log files based on the problem description. In this example, the set of initial log files is one or more log files.

Further the process displays the set of initial log files predicted by the machine learning model on a graphical user interface (step702). In step702, other information can be displayed in addition to the set of initial log files in the graphical user interface. For example, at least one of an input field for a search query, a search result, keywords highlighted from a search of a log file, a set of related customer cases, or a problem description for the problem can be displayed on the graphical user interface.

The process predicts a set of next log files for review to identify the root cause of the problem using the machine learning model and user behavior data related to the graphical user interface in response to a user input to the graphical user interface (step704). In step704, the set of files is one or more log files. In some cases, the prediction of log file names may result in more than one log file name having a sufficiently high probability of being the correct log file to review in determining the root cause of the problem. In this example, the user input initiates a collection of user behavior data. The user input itself can also be user behavior data. For example, the user input can be to selection of a log file, remove, clear, or delete log file displayed in the graphical user interface, perform a search, or other types of user inputs. Further, the user input can be a user action with contents of a file such as keywords or scrolling to other portions of the file.

The process displays a recommendation to review the set of next log files predicted by the machine learning model on the graphical user interface (step706). The process terminates thereafter.

With reference now toFIG.8, a flowchart of a process for training a machine learning model is depicted in accordance with an illustrative embodiment. The process inFIG.8can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions that are run by one of more processor units located in one or more hardware devices in one or more computer systems. For example, the process can be implemented in log file predictor214in computer system212inFIG.3. In this example, the machine learning model can be a transformer machine learning model such as a Bidirectional Encoder Representations from Transformers (BERT) machine learning model.

The process trains the machine learning model to predict the set of next log files, wherein a training dataset comprising sequences of log file names used in determining the root cause of the problem and problem descriptions for the problem is used to train the machine learning model (step800). The process terminates thereafter.

InFIG.9, a flowchart of a process for training a machine learning model is depicted in accordance with an illustrative embodiment. The process inFIG.9is an example of an implementation for step800inFIG.8.

The process trains the machine learning model to predict masked log file names in log file name sequences (step900). In step900, a masked log file name in a log file name sequence is a log file name that is hidden.

The process trains the machine learning model to the predict next log file names in log file name sequences in response to training the machine learning model to predict masked log file names in the log file name sequences using a training dataset comprising user behavior data and correlations between the user input data and log file name sequences (step902). The process terminates thereafter.

With reference toFIG.10, a flowchart of a process for retraining a machine learning model is depicted in accordance with an illustrative embodiment. The process in this figure is an example of an additional step that can be performed in steps inFIG.9. This step can be performed after the initial training of the machine learning model.

The process retrains the machine learning model using reinforcement learning and a training dataset comprising user behavior data collected from user behavior with respect to the graphical user interface (step1000). The process terminates thereafter. In step1000, the retraining can be used to collect log file sequences and user behavior data. The retraining can also be performed using reinforcement learning.

Turning now toFIG.11, a block diagram of a data processing system is depicted in accordance with an illustrative embodiment. Data processing system1100can be used to implement computers and computing devices in computing environment100inFIG.1. Data processing system1100can also be used to implement computer system212inFIG.2. In this illustrative example, data processing system1100includes communications framework1102, which provides communications between processor unit1104, memory1106, persistent storage1108, communications unit1110, input/output (I/O) unit1112, and display1114. In this example, communications framework1102takes the form of a bus system.

Processor unit1104serves to execute instructions for software that can be loaded into memory1106. Processor unit1104includes one or more processors. For example, processor unit1104can be selected from at least one of a multicore processor, a central processing unit (CPU), a graphics processing unit (GPU), a physics processing unit (PPU), a digital signal processor (DSP), a network processor, or some other suitable type of processor. Further, processor unit1104can be implemented using one or more heterogeneous processor systems in which a main processor is present with secondary processors on a single chip. As another illustrative example, processor unit1104can be a symmetric multi-processor system containing multiple processors of the same type on a single chip.

Memory1106and persistent storage1108are examples of storage devices1116. A storage device is any piece of hardware that is capable of storing information, such as, for example, without limitation, at least one of data, program instructions in functional form, or other suitable information either on a temporary basis, a permanent basis, or both on a temporary basis and a permanent basis. Storage devices1116may also be referred to as computer readable storage devices in these illustrative examples. Memory1106, in these examples, can be, for example, a random-access memory or any other suitable volatile or non-volatile storage device. Persistent storage1108may take various forms, depending on the particular implementation.

For example, persistent storage1108may contain one or more components or devices. For example, persistent storage1108can be a hard drive, a solid-state drive (SSD), a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage1108also can be removable. For example, a removable hard drive can be used for persistent storage1108.

Communications unit1110, in these illustrative examples, provides for communications with other data processing systems or devices. In these illustrative examples, communications unit1110is a network interface card.

Input/output unit1112allows for input and output of data with other devices that can be connected to data processing system1100. For example, input/output unit1112may provide a connection for user input through at least one of a keyboard, a mouse, or some other suitable input device. Further, input/output unit1112may send output to a printer. Display1114provides a mechanism to display information to a user.

Instructions for at least one of the operating system, applications, or programs can be located in storage devices1116, which are in communication with processor unit1104through communications framework1102. The processes of the different embodiments can be performed by processor unit1104using computer-implemented instructions, which may be located in a memory, such as memory1106.

These instructions are referred to as program instructions, computer usable program instructions, or computer readable program instructions that can be read and executed by a processor in processor unit1104. The program instructions in the different embodiments can be embodied on different physical or computer readable storage media, such as memory1106or persistent storage1108.

Program instructions1118are located in a functional form on computer readable media1120that is selectively removable and can be loaded onto or transferred to data processing system1100for execution by processor unit1104. Program instructions1118and computer readable media1120form computer program product1122in these illustrative examples. In the illustrative example, computer readable media1120is computer readable storage media1124.

Computer readable storage media1124is a physical or tangible storage device used to store program instructions1118rather than a medium that propagates or transmits program instructions1118. Computer readable storage media1124, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

Alternatively, program instructions1118can be transferred to data processing system1100using a computer readable signal media. The computer readable signal media are signals and can be, for example, a propagated data signal containing program instructions1118. For example, the computer readable signal media can be at least one of an electromagnetic signal, an optical signal, or any other suitable type of signal. These signals can be transmitted over connections, such as wireless connections, optical fiber cable, coaxial cable, a wire, or any other suitable type of connection.

Further, as used herein, “computer readable media1120” can be singular or plural. For example, program instructions1118can be located in computer readable media1120in the form of a single storage device or system. In another example, program instructions1118can be located in computer readable media1120that is distributed in multiple data processing systems. In other words, some instructions in program instructions1118can be located in one data processing system while other instructions in program instructions1118can be located in one data processing system. For example, a portion of program instructions1118can be located in computer readable media1120in a server computer while another portion of program instructions1118can be located in computer readable media1120located in a set of client computers.

The different components illustrated for data processing system1100are not meant to provide architectural limitations to the manner in which different embodiments can be implemented. In some illustrative examples, one or more of the components may be incorporated in or otherwise form a portion of, another component. For example, memory1106, or portions thereof, may be incorporated in processor unit1104in some illustrative examples. The different illustrative embodiments can be implemented in a data processing system including components in addition to or in place of those illustrated for data processing system1100. Other components shown inFIG.11can be varied from the illustrative examples shown. The different embodiments can be implemented using any hardware device or system capable of running program instructions1118.

Thus, illustrative embodiments provide a computer implemented method, computer system, and computer program product for recommending a log file for review as part of process to find a root cause for a problem. In one illustrative example, a computer implemented method identifies a root cause of a problem. A number of processor units uses a machine learning model to predict a set of initial log files for review to identify the root cause of the problem. The number of processor units displays the set of initial log files predicted by the machine learning model on a graphical user interface. The number of processor units predicts a set of next log files for review to identify the root cause of the problem using the machine learning model and user behavior data related to the graphical user interface in response to a user input to the graphical user interface. The number of processor units displays a recommendation to review the set of next log files predicted by the machine learning model on the graphical user interface.

With the use of the log analysis system in the different illustrative examples, less experienced users than subject matter experts can perform root cause analysis more efficiently even with less experience. In the illustrative examples, a log analysis system with a graphical user interface provides a tool to users to identify a sequence of log files to review in determining the root cause of the problem. In the illustrative examples, this prediction of the next file in the sequence of log files is based on user behavior data that includes both explicit data and implicit data. In this manner, problem resolution can be accelerated using this system.