| 摘要 |
The current document is directed to methods and systems that process, classify, efficiently store, and display large volumes of event messages generated in modern computing systems. In a disclosed implementation, received event messages are assigned to event-message clusters based on non-parameter tokens identified within the event messages. A parsing function is generated for each cluster that is used to extract data from incoming event messages and to prepare event records from event messages that more efficiently and accessible store event information. The parsing functions also provide an alternative basis for assignment of event messages to clusters. Event types associated with the clusters are used for gathering information from various information sources with which to automatically annotate event messages displayed to system administrators, maintenance personnel, and other users of event messages. |
| 主权项 |
1. A system that displays accumulated events, the system comprising:
one or more processors; one or more memories; one or more data-storage devices; a display device; and computer instructions, stored in one or more of the one or more memories that, when executed by one or more of the one or more processors, control the accumulated-event display system to
accumulate events in one or more of the one or more memories and one or more data-storage devices;determine a set of event types, each accumulated event belonging to one of the event types;display, on the display screen, active representations of event types to which the accumulated events belong; andin response to an input directed to a particular displayed active representation of an event type,
accessing stored descriptions of information entities associated with event types to select one or more of the stored descriptions of information entities associated with the event type represented by the particular displayed representation, anddisplaying, on the display screen, an active representation of each of the one or more selected descriptions of information entities, an input to each of which invokes display of a corresponding information entity. |
