MAXIMIZING THE INFORMATION CONTENT OF SYSTEM LOGS

摘要

In a method for maximizing information content of logs, a log message from an executing software program is received. The log message includes a timestamp, a source code location ID, a session ID, and a log message text. The timestamp, the source code location ID, and the session ID of the log message are stored in a lossless buffer. A hash function value of the session ID is determined. It is determined that the hash function value of the session ID is less than a hash value threshold. The log message text is stored in a session buffer in response to determining that the hash function value of the session ID is less than the hash value threshold, wherein the session buffer contains log message texts of log messages with corresponding hash function values less than the hash value threshold.

主权项

1. A method for maximizing information content of logs, the method comprising the steps of:
one or more processors receiving a first log message from an executing software program, wherein the first log message includes a first timestamp, a first source code location ID, a first session ID, and a first log message text; one or more processors storing the first timestamp, the first source code location ID, and the first session ID of the first log message in a first lossless buffer; one or more processors determining a hash function value of the first session ID; one or more processors determining that the hash function value of the first session ID is less than a hash value threshold; and in response to determining that the hash function value of the first session ID is less than the hash value threshold, one or more processors storing the first log message text in a session buffer, wherein the session buffer contains log message texts of log messages with corresponding hash function values less than the hash value threshold.