Patent Description:
Some example embodiments of the present disclosure are illustrated by way of example and not limitation in the figures of the accompanying drawings, in which like reference numbers indicate similar elements.

Example methods and systems for implementing a dynamic intelligent log analysis tool are disclosed. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of example embodiments. It will be evident, however, to one skilled in the art that the present embodiments can be practiced without these specific details.

Current log management tools are centrally hosted on a server, thereby requiring users to transfer the log files to the server via network calls in order for log analysis to begin. As a result, current log management tools are a drain on electronic resources, such as network bandwidth. Furthermore, the log analysis process is slowed down due to this reliance on communication with the server, since connectivity problems and the large size of the log files cause delays in the transmission and processing of the data in the log files. Additionally, the transmission of log files to a server raises data protection and privacy problems due to the resulting exposure of the data of the log files. In addition to the issues discussed above, other technical problems may arise as well.

The implementation of the features disclosed herein involves a non-generic, unconventional, and non-routine operation or combination of operations. By applying one or more of the solutions disclosed herein, some technical effects of the system and method of the present disclosure are to provide a computer system that is specially-configured to implement a dynamic intelligent log analysis tool. The log analysis tool analyzes data from the log files and may identify and highlight anomalous or rarer log entries that describe a probable root cause of a software-related malfunction. Additionally, the log analysis tool may be implemented on the client-side rather than on the server-side, thereby removing the reliance on network calls and transferring of huge files of private data. As a result, the log analysis tool of the present disclosure improves the effectiveness, efficiency, and data security of computer-based log analysis.

The computer system obtains a log file comprising a plurality of log entries, with each log entry in the plurality of log entries comprising a corresponding error message, and identifies a set of unique words from the error messages of the plurality of log entries. For each error message in the error messages of the plurality of log entries, the computer system computes a corresponding term-frequency vector based on a corresponding frequency of occurrence for each unique word of the set of unique words in the error message, compute a corresponding similarity measure between the error message and every other error message of the plurality of log entries, and compute a corresponding score based on a sum of the corresponding similarity measures between the error message and every other error message of the plurality of log entries. The computer system then displays an indication of one or more of the error messages of the plurality of log entries on a computing device based on the corresponding scores for the one or more of the error messages of the plurality of log entries. In some example embodiments, the computer system comprises a client-side software tool running on the computing device.

The methods or embodiments disclosed herein may be implemented as a computer system having one or more modules (e.g., hardware modules or software modules). Such modules may be executed by one or more hardware processors of the computer system. In some example embodiments, a non-transitory machine-readable storage device can store a set of instructions that, when executed by at least one processor, causes the at least one processor to perform the operations and method steps discussed within the present disclosure.

Other features and benefits of the subject matter described herein will be apparent from the description and drawings, and from the claims.

<FIG> is an example network diagram illustrating a system <NUM>. A platform (e.g., machines and software), in the example form of an enterprise application platform <NUM>, provides server-side functionality, via a network <NUM> (e.g., the Internet) to one or more clients. <FIG> illustrates, for example, a client machine <NUM> with programmatic client <NUM> (e.g., a browser), a small device client machine <NUM> with a small device web client <NUM> (e.g., a browser without a script engine), and a client/server machine <NUM> with a programmatic client <NUM>.

Turning specifically to the enterprise application platform <NUM>, web servers <NUM> and Application Program Interface (API) servers <NUM> can be coupled to, and provide web and programmatic interfaces to, application servers <NUM>. The application servers <NUM> can be, in turn, coupled to one or more database servers <NUM> that facilitate access to one or more databases <NUM>. The web servers <NUM>, API servers <NUM>, application servers <NUM>, and database servers <NUM> can host cross-functional services <NUM>. The cross-functional services <NUM> can include relational database modules to provide support services for access to the database(s) <NUM>, which includes a user interface library <NUM>. The application servers <NUM> can further host domain applications <NUM>. The web servers <NUM> and the API servers <NUM> may be combined.

The cross-functional services <NUM> provide services to users and processes that utilize the enterprise application platform <NUM>. For instance, the cross-functional services <NUM> can provide portal services (e.g., web services), database services, and connectivity to the domain applications <NUM> for users that operate the client machine <NUM>, the client/server machine <NUM>, and the small device client machine <NUM>. In addition, the cross-functional services <NUM> can provide an environment for delivering enhancements to existing applications and for integrating third-party and legacy applications with existing cross-functional services <NUM> and domain applications <NUM>. In some example embodiments, the system <NUM> comprises a client-server system that employs a client-server architecture, as shown in <FIG>. However, the embodiments of the present disclosure are, of course, not limited to a client-server architecture, and could equally well find application in a distributed, or peer-to-peer, architecture system.

<FIG> is a block diagram illustrating a log analysis system <NUM>. In some embodiments, the log analysis system <NUM> comprises an analysis module <NUM> and an interface module <NUM>. The analysis module <NUM> and the interface module <NUM> can reside on a computer system, or other machine, having a memory and at least one processor (not shown), such as a computing device <NUM>. The computing device <NUM> may comprise any of the machines <NUM>, <NUM>, or <NUM> of <FIG>. However, other types of computing devices are also within the scope of the present disclosure.

In some example embodiments, one or more of the analysis module <NUM> and the interface module <NUM> are configured to provide a variety of user interface functionality, such as generating user interfaces, interactively presenting user interfaces to the user, receiving information from the user (e.g., interactions with user interfaces), and so on. Presenting information to the user can include causing presentation of information to the user (e.g., communicating information to a device with instructions to present the information to the user). Information may be presented using a variety of means including visually displaying information and using other device outputs (e.g., audio, tactile, and so forth). Similarly, information may be received via a variety of means including alphanumeric input or other device input. In some example embodiments, one or more of the analysis module <NUM> and the interface module <NUM> are configured to receive user input. For example, one or more of the analysis module <NUM> and the interface module <NUM> can present one or more graphical user interface (GUI) elements (e.g., drop-down menu, selectable buttons, text field) with which a user can submit input. In some example embodiments, one or more of the analysis module <NUM> and the interface module <NUM> are configured to perform various communication functions to facilitate the functionality described herein, such as by communicating with a computing device (e.g., the small device client machine <NUM>, the client machine <NUM>, or the client/server machine <NUM>) via the network <NUM> using a wired or wireless connection.

In some example embodiments, the analysis module <NUM> is configured to obtain one or more log files, with each log file comprising a plurality of log entries. For example, the interface module <NUM> may display one or more user interface elements that the user may interact with to upload the log file(s), such as a field for entering a file name, a selectable element for browsing files to select for upload, and a selectable element for triggering an upload of any files selected by the user to the analysis module. Once the files are uploaded the user can also choose to select/deselect certain files which he may not need to be analyzed in current analysis cycle. A log file is a file that records events that occur in an operating system or other software runs.

Each log entry of the log file may comprise a date and time of log activity occurrence, a severity of the log activity, a component or module where the log activity occurred, user information identifying a user associated with the log activity (e.g., a user who was using the computing device during the log activity occurrence), a thread identification of the processing thread where the log activity occurred, a message indicating the nature or type of log activity, and a stack trace, as well as other data. The message comprises an error message that includes a brief description about the log activity.

In some example embodiments, the log analysis system <NUM> may comprise a client-side software tool running on the computing device <NUM>. The computing device <NUM> may comprise the small device client machine <NUM>, the client machine <NUM>, or the client/server machine <NUM> of <FIG>. However, other implementations of the computing device <NUM> are also within the scope of the present disclosure. The computing device <NUM> may comprise software <NUM> and one or more databases <NUM>. The software <NUM> may comprise an operating system. The software <NUM> may additionally or alternatively comprise one or more software applications. The software <NUM> may generate the log files and store them in the database(s) <NUM>, and the user may upload the log files from the database(s) <NUM> to the analysis module <NUM>.

The log files may comprise large text of log data in raw format. Therefore, before analyzing a log file, the analysis module <NUM> may convert the data of the log file into structured form to make it useful for analysis. In some example embodiments, the analysis module <NUM> performs data wrangling on the log file. Data wrangling is a process of structuring, cleaning, and enriching raw data of one form to another format with an aim to make it more suitable and appropriate for the purpose of analysis and processing. <FIG> illustrates example data of a log file <NUM> in raw form. In <FIG>, the log file includes a plurality of log entries <NUM> in raw form.

In some example embodiments, the analysis module <NUM> is configured to split the raw data of the log file into single line log entries using delimiters that specify the boundaries between separate, independent regions of the raw data. <FIG> illustrates example data <NUM> of a log file in semi-structured form. In <FIG>, the raw data of the log file <NUM> in <FIG> has been converted by the analysis module <NUM> into the data <NUM>, which comprises single line log entries. This conversion of the raw data into single line entries in semi-structured form prepares the data for further processing by the analysis module <NUM>.

Next, the analysis module <NUM> may divide the semi-structured data <NUM> into tokens to enable accurate analysis on the log file. In natural language processing, tokenization refers to breaking text into sentences and words. In some example embodiments, tokenization is performed by the analysis module <NUM> to extract various information from the log entries regarding details of the log entries, such as a date and time of log activity occurrence, a severity of the log activity, a component or module where the log activity occurred, user information identifying a user associated with the log activity, a thread identification of the processing thread where the log activity occurred, and a message indicating the nature or type of log activity. By applying suitable delimitators, the analysis module <NUM> ensures that segments of each log entry are carefully inserted in appropriate fields to form semi-structured data. <FIG> illustrates example data <NUM>, <NUM>, and <NUM> extracted from a log file. In <FIG>, the data <NUM>, <NUM>, and <NUM> has been extracted from the single line log entries of the data <NUM> of <FIG>. As seen in <FIG>, the analysis module <NUM> may extract error messages from the data <NUM> and remove any numbers or special characters from the error messages that may not be useful in natural language processing. For example, in <FIG>, the analysis module <NUM> has extracted the error message "set password in login#\r" and stored this raw form of the error message in one field (e.g., in the field labeled "NonGrpError" in <FIG>), as well as storing an edited version of the error message in another field (e.g., in the field labeled "Error" in <FIG>). The edited version in <FIG> reads "set password in login \r" and was generated by the analysis module <NUM> by removing the "#" character from the raw form of the error message.

In some example embodiments, the analysis module <NUM> is configured to filter out data from the extracted data based on one or more filter criteria specified by the user. For example, the analysis module <NUM> may filter out any log entries that do not satisfy the user-specified filter criteria. Examples of filter criteria include, but are not limited to, a user-specified component from which the corresponding error message of the log entry originated, a user-specified date range within which the log entry was recorded in the log file, a user-specified time range within which the log entry was recorded in the log file, one or more users-specified keywords included in the log entry, a user-specified severity level, a user-specified thread that was used to perform a task when the log entry was recorded in the log file, and a user-specified identification of another user included in the log entry. Other types of filter criteria are also within the scope of the present disclosure.

Each log file may contain thousands of log entries that are often the same except or having occurred at different time periods. In some example embodiments, in order to make the analysis of the log entries faster and more efficient, the analysis module <NUM> may group all similar semi-structured log entries together. For example, the analysis module <NUM> may group all log entries having the same error together. <FIG> illustrates an example of data extracted from a log file being grouped together. In <FIG>, the analysis module <NUM> has grouped together the data <NUM> and <NUM> from <FIG> into a group <NUM> based on the log entries of the data <NUM> and <NUM> having the same error "set password in login \r" and has put the data <NUM> from <FIG> in a group <NUM>, with the group <NUM> having two entries and the group <NUM> having only a single entry.

After dividing the log entries into groups as discussed above, the analysis module <NUM> identifies a set of unique words from the groups of log entries. The analysis module <NUM> may identify the set of words from the error messages of the groups of log entries. In one example, the following table comprises the error messages from which the set of words is identified.

The analysis module <NUM> may generate a set of all unique words from the error messages of the log entries using a bag-of-words model on the error fields of the grouped plurality of log entries. A bag-of-words model is a simplifying representation in which a text is represented as the multiset of its words, disregarding grammar and even word order, but keeping multiplicity.

The analysis module <NUM> is configured to, for each error message in the error messages of the plurality of log entries, compute a corresponding term-frequency vector based on a corresponding frequency of occurrence for each unique word of the set of unique words in the error message. For the example error messages "Error <NUM>" and "Error <NUM>" in the table above, the following term-frequency table is shown below for each error message:.

Using the example term-frequency table above, the analysis module <NUM> may generate the following term-frequency vectors for the error messages:.

The analysis module <NUM> is configured to, for each error message in the error messages of the plurality of log entries, compute a corresponding similarity measure between the term-frequency vectors of the error message and every other error message of the plurality of log entries. For example, the analysis module <NUM> may compute a corresponding cosine similarity between the term-frequency vectors of the error message and every other error message of the plurality of log entries. A cosine similarity is a measure of similarity between two non-zero vectors of an inner product space, and it is defined to equal the cosine of the angle between them, which is also the same as the inner product of the same vectors normalized to both have length <NUM>. Other similarity measures are also within the scope of the present disclosure.

The analysis module <NUM> is configured to, for each error message in the error messages of the plurality of log entries, compute a corresponding score based on a sum of the corresponding similarity measures between the term-frequency vectors of the error message and every other error message of the plurality of log entries. For example, in a scenario where there are five error messages M1, M2, M3, M4, and M5, and Sxy represents the similarity measure between the term-frequency vectors of error message x and error message y, the sum of the corresponding similarity measures between the term-frequency vectors of error message M1 and every other error message is represented as follows: <MAT>.

The interface module <NUM> may be configured to display a visualization of the log entries, including analytic data regarding the log entries. For example, the interface module <NUM> may display a frequency distribution of the error messages of the log entries in order to provide the user with insight as to the frequency at which each error is occurring. <FIG> illustrates an example graphical user interface (GUI) <NUM> in which a frequency distribution of error messages is displayed. In <FIG>, the GUI <NUM> includes a chart in which a corresponding count <NUM> of occurrences of each type of error is plotted along an X-axis of dates. In the example shown in <FIG>, a stack <NUM> of slices representing the different errors that occurred is displayed for each date of occurrence. Each slice of the stack <NUM> may be configured to, in response to its selection, trigger a display of a user interface element <NUM> that includes details about the corresponding error of the selected slice, such as the type of error, the date on which the error occurred, and the number of times the error occurred on that date.

In some example embodiments, the interface module <NUM> is configured to display a distribution of log entries by components that are present in the log entries. <FIG> illustrates an example GUI <NUM> in which a distribution <NUM> of the plurality of log entries by components present in the plurality of log entries is displayed. In <FIG>, the distribution <NUM> is displayed as a pie chart in which slices <NUM> of the pie chart correspond to the portion of the log entries that are attributable to a particular component. The distribution <NUM> of the plurality of log entries may be organized by other entities as well, such as by users present in the plurality of log entries.

In some example embodiments, the interface module <NUM> is configured to display a GUI in which a user may input one or more filter criteria for use in analyzing the log entries. <FIG> illustrates an example GUI <NUM> in which filter criteria may be input by a user is displayed. For example, the GUI <NUM> may include a field <NUM> in which the user may specify one or more components, a field <NUM> in which the user may specify a date range, field <NUM> and <NUM> in which the user may specify a time range (e.g., a start time and an end time), a field <NUM> in which the user may specific one or more keywords, a field <NUM> in which the user may specify a severity, a field <NUM> in which the user may specify one or more threads, and a field <NUM> in which the user may specify one or more users.

The interface module <NUM> is configured to display an indication of one or more of the error messages of the plurality of log entries on a computing device based on the corresponding scores for the one or more of the error messages of the plurality of log entries. The interface module <NUM> may rank the error messages of the plurality of log entries based on their corresponding scores, and then display the indication of the one or more of the error messages of the plurality of log entries based on the ranking. <FIG> illustrates an example GUI <NUM> in which a ranked list <NUM> of log entries is displayed. The interface module <NUM> may rank the error messages in inverse relationship to their scores, such that the lower the score of an error message, the higher the ranking of the error message, and the higher the score of an error message, the lower the ranking of the error message, since a lower score based on similarity represents a greater probability that the error message is anomalous. The interface module <NUM> may then display the indications of the error messages in descending order of their ranking (e.g., the highest ranking and most anomalous error message being displayed in a topmost position, the second highest ranking error message being displayed in a second position directly under the highest ranking error message, and so on and so forth).

In <FIG>, the interface module <NUM> displays a corresponding selectable user interface element <NUM> in association with each indication of an error messages in the ranked list <NUM>. In some example embodiments, in response to the user selecting a selectable user interface element <NUM>, the analysis module <NUM> removes the corresponding log entry from the ranked list <NUM> and modifies the plurality of log entries to exclude the log entry corresponding to the selected user interface element <NUM>. The analysis module <NUM> may then recalculate the term-frequency vectors, similarity measures, and scores using the modified plurality of log entries. An indication of the excluded log entry <NUM> may be displayed in a field <NUM> of the GUI <NUM> in response to the user selecting the corresponding user interface element <NUM>. If the user wants to recalculate the frequency vectors, similarity measures, and scores without the excluded log entry <NUM>, then the user may select a user interface element <NUM>. If the user wants to include the excluded log entry <NUM> back into the calculation and analysis, then the user may select a user interface element <NUM>.

In some example embodiments, the interface module <NUM> displays a corresponding user interface element <NUM> for each indication of an error message in the ranked list <NUM>. The interface module <NUM> may be configured to, in response to the user selecting the user interface element <NUM>, display log details of the log entry corresponding to the selected user interface element <NUM>. <FIG> illustrates an example GUI <NUM> in which log details <NUM> of a log entry are displayed. The GUI <NUM> may also include a corresponding date and time for each instance of log details <NUM>. Additionally, the interface module <NUM> may also display a corresponding user interface element <NUM> for each instance of log details <NUM>. The interface module <NUM> may be configured to, in response to the user selecting the user interface element <NUM>, display a stack trace of the log entry corresponding to the selected user interface element <NUM>. <FIG> illustrates an example GUI <NUM> in which a stack trace is displayed. A stack trace is a report of the active stack frames at a certain point in time during the execution of a program. Stack frames may contain subroutine state information, and each stack frame may correspond to a call to a subroutine.

<FIG> is a flowchart illustrating an example method <NUM> of log analysis. The method <NUM> can be performed by processing logic that can comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (e.g., instructions run on a processing device), or a combination thereof. In one example embodiment, one or more of the operations of the method <NUM> are performed by the log analysis system <NUM> of <FIG> or any combination of one or more of its components (e.g., the analysis module <NUM>, the interface module <NUM>).

At operation <NUM>, the log analysis system <NUM> obtains a log file comprising a plurality of log entries. Each log entry in the plurality of log entries comprises a corresponding error message. The log analysis system <NUM> may comprise a client-side software tool running on the computing device. However, other implementations (e.g., server-side) of the log analysis system <NUM> are also within the scope of the present disclosure.

Next, the log analysis system <NUM>, at operation <NUM>, identifies a set of unique words from the error messages of the plurality of log entries. In some example embodiment, the identifying the set of unique words from the error messages of the plurality of log entries comprises selecting the plurality of log entries for use in the identifying the set of unique words based on a determination that each log entry in the plurality of log entries satisfies one or more filter criteria input by a user. The one or more filter criteria may comprise one or more of the following criteria: a user-specified component from which the corresponding error message of the log entry originated; a user-specified date range within which the log entry was recorded in the log file; a user-specified time range within which the log entry was recorded in the log file; one or more users-specified keywords included in the log entry; a user-specified severity level; a user-specified thread that was used to perform a task when the log entry was recorded in the log file; or a user-specified identification of another user included in the log entry.

Then, the log analysis system <NUM>, for each error message in the error messages of the plurality of log entries, computes a corresponding term-frequency vector based on a corresponding frequency of occurrence for each unique word of the set of unique words in the error message, at operation <NUM>. Each unique word in the set of unique words has a corresponding term-frequency vector that is based on how often the unique word occurs in the error message.

At operation <NUM>, the log analysis system <NUM> computes, for each error message in the error messages of the plurality of log entries, a corresponding similarity measure between the term-frequency vectors of the error message and every other error message of the plurality of log entries. For example, the log analysis system <NUM> may compute a corresponding cosine similarity between the error message and every other error message of the plurality of log entries. A cosine similarity is a measure of similarity between two non-zero vectors of an inner product space, and it is defined to equal the cosine of the angle between them, which is also the same as the inner product of the same vectors normalized to both have length <NUM>. Other similarity measures are also within the scope of the present disclosure.

The log analysis system <NUM>, for each error message in the error messages of the plurality of log entries, computes a corresponding score based on a sum of the corresponding similarity measures between the term-frequency vectors of the error message and every other error message of the plurality of log entries, at operation <NUM>. For example, in a scenario where there are five error messages M1, M2, M3, M4, and M5, and Sxy represents the similarity measure between error message x and error message y, the sum of the corresponding similarity measures between error message M1 and every other error message is represented as follows: <MAT>.

At operation <NUM>, the log analysis system <NUM> displays an indication of one or more of the error messages of the plurality of log entries on a computing device based on the corresponding scores for the one or more of the error messages of the plurality of log entries. In some example embodiments, the log analysis system <NUM> ranks the error messages of the plurality of log entries based on their corresponding scores, and then displays the indication of the one or more of the error messages of the plurality of log entries based on the ranking. For example, the log analysis system <NUM> may rank the error messages in inverse relationship to their scores, such that the lower the score of an error message, the higher the ranking of the error message, and the higher the score of an error message, the lower the ranking of the error message, since a lower score based on similarity represents a greater probability that the error message is anomalous. The log analysis system <NUM> may then display the indications of the error messages in descending order of their ranking (e.g., the highest ranking and most anomalous error message being displayed in a topmost position, the second highest ranking error message being displayed in a second position directly under the highest ranking error message, and so on and so forth).

Then, at operation <NUM>, the log analysis system <NUM> may receive, from the computing device, a user selection of a selectable user interface element displayed in association with the corresponding indication of one of the one or more of the error messages of the plurality of log entries. For example, the user may select the corresponding selectable user interface element <NUM>, and then select the selectable user interface element <NUM>, as discussed above with respect to <FIG>.

Next, the log analysis system <NUM>, in response to the receiving the user selection, may modify the plurality of log entries to exclude the log entry corresponding to the indication of the one of the one or more of the error messages for which the associated selectable user interface element was selected via the user selection, at operation <NUM>. The method <NUM> may then repeat the analysis, returning to operation <NUM>, where the log analysis system <NUM> identifies a set of unique words from error messages of the modified plurality of log entries that no longer includes the log entry corresponding to the indication of the one of the one or more of the error messages for which the associated selectable user interface element was selected.

It is contemplated that any of the other features described within the present disclosure can be incorporated into the method <NUM>.

<FIG> is a flowchart illustrating an example method <NUM> of identifying a set of unique words from error messages of log entries. The method <NUM> can be performed by processing logic that can comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (e.g., instructions run on a processing device), or a combination thereof. In one example embodiment, one or more of the operations of the method <NUM> are performed by the log analysis system <NUM> of <FIG> or any combination of one or more of its components (e.g., the analysis module <NUM>, the interface module <NUM>).

At operation <NUM>, the log analysis system <NUM> may, for each log entry in the plurality of log entries, divide text of the log entry into a plurality of tokens using natural language processing. For example, the log analysis system <NUM> may extract the tokens from the log entries using the techniques discussed above with respect to <FIG>. In some example embodiments, the plurality of tokens comprises an error field.

Next, at operation <NUM>, the log analysis system <NUM> may group the plurality of log entries based on their error fields. For example, the log analysis system <NUM> may divide the plurality of log entries into groups using the techniques discussed above with respect to <FIG>.

The log analysis system <NUM> may then identify the set of unique words using a bag-of-words model on the error fields of the grouped plurality of log entries, at operation <NUM>.

Certain embodiments are described herein as including logic or a number of components, modules, or mechanisms. Modules may constitute either software modules (e.g., code embodied on a machine-readable medium or in a transmission signal) or hardware modules. A hardware module is a tangible unit capable of performing certain operations and may be configured or arranged in a certain manner. In example embodiments, one or more computer systems (e.g., a standalone, client, or server computer system) or one or more hardware modules of a computer system (e.g., a processor or a group of processors) may be configured by software (e.g., an application or application portion) as a hardware module that operates to perform certain operations as described herein.

Similarly, the methods described herein may be at least partially processor-implemented. In some example embodiments, the processor or processors may be located in a single location (e.g., within a home environment, an office environment or as a server farm), while in other embodiments the processors may be distributed across a number of locations.

The one or more processors may also operate to support performance of the relevant operations in a "cloud computing" environment or as a "software as a service" (SaaS). For example, at least some of the operations may be performed by a group of computers (as examples of machines including processors), these operations being accessible via a network (e.g., the network <NUM> of <FIG>) and via one or more appropriate interfaces (e.g., APIs).

Example embodiments may be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations of them. Example embodiments may be implemented using a computer program product, e.g., a computer program tangibly embodied in an information carrier, e.g., in a machine-readable medium for execution by, or to control the operation of, data processing apparatus, e.g., a programmable processor, a computer, or multiple computers.

A computer program can be written in any form of programming language, including compiled or interpreted languages, and it can be deployed in any form, including as a stand-alone program or as a module, subroutine, or other unit suitable for use in a computing environment.

In example embodiments, operations may be performed by one or more programmable processors executing a computer program to perform functions by operating on input data and generating output. Method operations can also be performed by, and apparatus of example embodiments may be implemented as, special purpose logic circuitry (e.g., a FPGA or an ASIC).

<FIG> is a block diagram of a machine in the example form of a computer system <NUM> within which instructions <NUM> for causing the machine to perform any one or more of the methodologies discussed herein may be executed. In alternative embodiments, the machine operates as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the machine may operate in the capacity of a server or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a network router, switch or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while only a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

The example computer system <NUM> includes a processor <NUM> (e.g., a central processing unit (CPU), a graphics processing unit (GPU) or both), a main memory <NUM>, and a static memory <NUM>, which communicate with each other via a bus <NUM>. The computer system <NUM> may further include a graphics or video display unit <NUM> (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system <NUM> also includes an alphanumeric input device <NUM> (e.g., a keyboard), a user interface (UI) navigation (or cursor control) device <NUM> (e.g., a mouse), a storage unit (e.g., a disk drive unit) <NUM>, an audio or signal generation device <NUM> (e.g., a speaker), and a network interface device <NUM>.

The storage unit <NUM> includes a machine-readable medium <NUM> on which is stored one or more sets of data structures and instructions <NUM> (e.g., software) embodying or utilized by any one or more of the methodologies or functions described herein. The instructions <NUM> may also reside, completely or at least partially, within the main memory <NUM> and/or within the processor <NUM> during execution thereof by the computer system <NUM>, the main memory <NUM> and the processor <NUM> also constituting machine-readable media. The instructions <NUM> may also reside, completely or at least partially, within the static memory <NUM>.

While the machine-readable medium <NUM> is shown in an example embodiment to be a single medium, the term "machine-readable medium" may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more instructions <NUM> or data structures. The term "machine-readable medium" shall also be taken to include any tangible medium that is capable of storing, encoding or carrying instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present embodiments, or that is capable of storing, encoding or carrying data structures utilized by or associated with such instructions. The term "machine-readable medium" shall accordingly be taken to include, but not be limited to, solid-state memories, and optical and magnetic media. Specific examples of machine-readable media include non-volatile memory, including by way of example semiconductor memory devices (e.g., Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), and flash memory devices); magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and compact disc-read-only memory (CD-ROM) and digital versatile disc (or digital video disc) read-only memory (DVD-ROM) disks.

The instructions <NUM> may further be transmitted or received over a communications network <NUM> using a transmission medium. The instructions <NUM> may be transmitted using the network interface device <NUM> and any one of a number of well-known transfer protocols (e.g., HTTP). Examples of communication networks include a LAN, a WAN, the Internet, mobile telephone networks, POTS networks, and wireless data networks (e.g., WiFi and WiMAX networks). The term "transmission medium" shall be taken to include any intangible medium capable of storing, encoding, or carrying instructions for execution by the machine, and includes digital or analog communications signals or other intangible media to facilitate communication of such software.

This detailed description is merely intended to teach a person of skill in the art further details for practicing certain aspects of the present teachings and is not intended to limit the scope of the claims. Therefore, combinations of features disclosed above in the detailed description may not be necessary to practice the teachings in the broadest sense, and are instead taught merely to describe particularly representative examples of the present teachings.

Unless specifically stated otherwise, discussions utilizing terms such as "processing" or "computing" or "calculating" or "determining" or "displaying" or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.

Claim 1:
A computer-implemented method performed by a computer system having a memory and at least one hardware processor, the computer-implemented method comprising:
obtaining (<NUM>) a log file (<NUM>) comprising a plurality of log entries (<NUM>), each log entry in the plurality of log entries (<NUM>) comprising a corresponding error message;
identifying (<NUM>) a set of unique words from the error messages of the plurality of log entries;
for each error message in the error messages of the plurality of log entries, computing (<NUM>) a corresponding term-frequency vector based on a corresponding frequency of occurrence for each unique word of the set of unique words in the error message;
for each error message in the error messages of the plurality of log entries, computing (<NUM>) a corresponding similarity measure between the term-frequency vectors of the error message and every other error message of the plurality of log entries;
characterized in that the method further comprises:
for each error message in the error messages of the plurality of log entries, computing (<NUM>) a corresponding score based on a sum of the corresponding similarity measures between the term-frequency vectors of the error message and every other error message of the plurality of log entries; and
displaying (<NUM>) an indication of one or more of the error messages of the plurality of log entries on a computing device based on the corresponding scores for the one or more of the error messages of the plurality of log entries.