METHOD AND SYSTEM FOR CLUSTERING AND PRIORITIZING EVENT MESSAGES

摘要

The current document is directed to methods and systems for processing, classifying, and efficiently storing large volumes of event messages generated in modern computing systems. In a disclosed implementation, received event messages are assigned to clusters based on metrics computed for the event messages. In addition, a significance value is determined for each received event message. When the significance value exceeds a threshold value, one or more actions are taken, including marking an event record corresponding to the event message, storing an event record corresponding to the event message in a significant-event log, and generating a notice or alarm.

主权项

1. An event-message clustering system comprising:
one or more processors; one or more memories; and computer instructions, stored in one or more of the one or more memories that, when executed by one or more of the one or more processors, control the event-message clustering system to
receive event messages, andprocess each of the received event messages by
determining a cluster to which to assign the event message,extracting data values from the event message,computing a significance value for the event message,generating an event record corresponding to the event message that includes the extracted data values, andstoring the event record within, or associated with, the selected cluster in a physical data-storage device.