Method for characterizing system state using message logs

摘要

A method that enables the run-time behavior of a system to be analyzed is disclosed. By analyzing the totality of the messages in the log or logs system behavior can be better understood. The illustrative embodiment of the present invention detects patterns in message logs, clusters similar messages, and determines system behavior based on the clustering of messages.

主权项

1. A method comprising compiling a first message log based, at least in part, on:
(i) a second message log that comprises a first message A and a second message B, (ii) a dis-similarity distance Δ between the morphology of the first message A and the morphology of the second message B; and characterizing system state based on an incidence of anomalies indicated by the first message log, wherein the first message and the second message regard tracking of actions of at least one of communication nodes and communication links of a telecommunication system, wherein the first message and the second message are stored in a respective memory of the telecommunication system, and wherein the dis-similarity distance is based, at least in part, on: (i) a first dis-similarity distance Δ1 between a first sub-string of the first message S1(A) and a first sub-string of the second message S1(B), (ii) a second dis-similarity distance Δ2 between a second sub-string of the first message S2(A) and a second sub-string of the second message S2(B), (iii) a first weighting W1 of the first dis-similarity distance Δ2, and (iv) a second weighting W2 of the dis-similarity distance Δ2, wherein Δ=f(Δ1, W1, Δ2, W2).