Methods of clustering computational event logs

摘要

Method of determining a metric distance in computational event messages 4, such as Syslog events, for clustering event log 2, e.g. error log. A first character of a first message and a second character of a second message are compared to a set of characters, for example hexadecimal characters. If both characters are comprised in the set, a predefined metric distance is output, e.g. zero. The method operates in a pseudo-metric space where MAC addresses, IP addresses, and process IDs which are unnecessary for clustering and have hexadecimal characters, do not affect the clustering of events. Also some misspelt words will not have metric distances. Also described are: a method of calculating distance between words in different event messages; and a method of defining an area (e.g. a metric ball) in a metric space for clustering event messages. Characters or words in different messages can be sequentially aligned for comparison.