Patent ID: 8306945

Claim:
A method for operating a computer system performing a log association method, the method comprising: the computer system obtaining, in one pass, a plurality of log records from at least one input source of unprocessed log records, such that each record is read once from the input source during the one pass, each log record having a plurality of fields, each field having a value; the computer system associating each log record, as obtained in the one pass, having a first common value in a first one or more fields with a first logical group, at least one log record in the first logical group having a second value in a second one or more fields; the computer system associating each log record having the second common value in the second one or more fields and not having the first common value in the first one or more fields with the first logical group; the computer system retaining, in a secondary queue for organizing log records not assigned to a logical group when obtained in the one pass, at least one log record from the plurality of log records when the value of the first one or more fields of the at least one log record is different than the first common value and the value of the second one or more fields of the at least one log record is different than the second common value; the computer system determining that a particular log record associated to the first logical group has a third common value in the second one or more fields; responsive to the determining, the computer system retrieving previously retained log records from the secondary queue; the computer system associating each log record retrieved from the secondary queue with the first logical group if the value of the second one or more fields of the retrieved log record equals the third common value; and using the first logical group to analyze operations of one or more systems associated with the plurality of log records.