Micro Focus Lcc

Entit Software LLC

Fernando Vizer

Eli Revach

Pavel Danichev

Amitai Shlomo Shtossel

Ron Maurer

Yair Horovitz

Eran Samuni

Noam Fraenkel

Nurit Peres

Lioz Medina

Alon Sade

Ofra Pavlovitz

Keren Gattegno

Eran Bentziony

In examples, a system adaptively orders a set of regular expressions based on frequencies that respective regular expressions of the set of regular expressions match a set of messages, the adaptive ordering to produce an adaptively ordered set of regular expressions. The system determines, for a first message of the set of messages, whether a plurality of regular expressions of the adaptively ordered set of regular expressions match the first message. The system constructs a bi-directional graph representing the plurality of regular expressions that match the first message, and classifies a second message based on the adaptively ordered set of regular expressions and the bi-directional graph.

Ordering regular expressions

A plurality of log messages may be clustered into a plurality of clusters. For each of the plurality of log messages, the log message may be partitioned into a series of substrings. At least two of the plurality of clusters may be selected. For each one of the at least two selected clusters, a parsing rule may be generated corresponding to a plurality of substrings each of which are at a given location of a respective one of the log messages of the plurality of log messages in the one of the selected cluster.

Generating parsing rules for log messages

In some examples, time-series datasets received from a system may be temporally aligned. In some examples, one of the time-series datasets may be deduplicated. In some examples, whether an anomaly has occurred in the system may be determined based on a non-deduplicated time-series dataset of the time-series datasets.

Alignment and deduplication of time-series datasets

In examples, an apparatus comprises: a memory, and a processor coupled to the memory. The processor to: adaptively order an ordered set of regular expressions based on training messages to produce a set of adaptively ordered regular expressions having an adaptive order, determine a first of the adaptively ordered regular expressions that matches an additional message, and determine whether a second of the adaptively ordered regular expressions matches the additional message. Responsive to determining that the second of the other of the adaptively ordered regular expressions matches the additional message, the processor to: classify the additional message with the first regular expression if the first regular expression has a higher priority in the adaptive order; and classify the additional message with the second regular expression if the second regular expression has a higher priority in the adaptive order.

Examples relate to purging storage partitions of a database. The examples disclosed herein identify a first partition of a database to be purged and identify a data entry in the first storage partition, where the data entry is to be copied. Examples herein copy an updated version of the data entry to a future storage partition of the database and purge the first storage partition. A dummy data entry is created in a second storage partition of the database, where the dummy data entry identifies the future storage partition.

Purging storage partitions of databases

According to an example, aggregation based event identification may include aggregating each of a plurality of source events by an event type of event types that represent dusters of the source events and/or a host of a source event of the source events to generate a reduced number of the source events. Aggregation based event identification may further include analyzing a characteristic for each of the reduced number of the source events, and assigning, based on the analysis of the characteristic for each of the reduced number of the source events, a characteristic weight to each of the reduced number of the source events. Further, aggregation based event identification may include aggregating the characteristic weights for each of the reduced number of the source events to determine an aggregated event issue weight for each of the reduced number of the source events.

Aggregation based event identification

A non-transitory, computer readable storage device includes software that, while being executed by a processor, causes the processor to choose, based on user activity, a plurality of candidate parameters to be monitored from a plurality of event messages. Further, the processor executes the software to estimate a level of similarity between the chosen plurality of candidate parameters by computing a similarity score for at least two of the chosen candidate parameters. Still further, the processor executes the software to determine a plurality of parameters from the chosen candidate parameters if the similarity score for the plurality of parameters is greater than a threshold.

Parameter suggestion based on user activity

Event-time pairs are received for a current time slot. Each event-time pair denotes the occurrence of an event at a system by an event type as well as an occurrence time. For each different event type, a property value for the time slot is computed for each different property of a number of different properties, from the event-time pairs having the different event type. For each different property, a time-decaying histogram of identified property values of the different property is updated using the property value computed for the different property for the current time slot. An anomaly score for each identified property value within the time-decaying histogram of each different property is computed to detect occurrence of an anomaly within the system.

Growing community of inventors

Yehud, Israel

Fernando Vizer