Tibco Software Inc.

Loglogic, Inc.

Jason Michael DeStefano

Thomas Hunt Schabo Grabowski

Tomasz Mariusz Mojsa

Ralph D Jenson

A system can receive raw log data from log-producing devices. The system can parse the raw log data to generate parsed log data, including extracting fields from the raw log data, generating structured query language (SQL) statements from the extracted fields, and inserting the SQL statements in a database. The system can summarize the parsed log data, including identifying one or more SQL statements based on fields of commonality and fields of uniqueness, and creating summarized data that include a new statement condensed from the identified SQL statements. The system can then generate a report based on the summarized data.

Method and apparatus for retrieving and combining summarized log data in a distributed log data processing system

A system and method is disclosed which enables network administrators and the like to quickly analyze the data produced by log-producing devices such as network firewalls and routers. Unlike systems of the prior art, the system disclosed herein automatically parses and summarizes log data before inserting it into one or more databases. This greatly reduces the volume of data stored in the database and permits database queries to be run and reports generated while many types of attempted breaches of network security are still in progress. Database maintenance may also be accomplished automatically by the system to delete or archive old log data.

System and method for parsing, summarizing and reporting log data

A system and method is disclosed for collecting, storing and reporting raw log data from log-producing devices such as firewalls and routers. The log-producing devices may be both local and remote&#x2014;i.e., linked to a raw log server via a LAN and/or a WAN. A log data analyzer at a remote location gathers log data from devices at that remote location into time-defined sets and then sends those sets over a WAN (which may be the Internet) to a raw log server using a first protocol. Local log-producing devices may send their log data to the log data analyzer via a LAN using a second protocol. The log data analyzer forwards the raw log data local devices to an appropriate log data analyzer for parsing, summarizing and storage in one or more databases. The raw log server combines local and remote sets of raw log data for a given time period and stores them in a storage area of raw log data. A central management station is used to query the various databases in the system and to merge database reports into a single report for display.

Growing community of inventors

Sunnyvale, CA, United States of America

Jason Michael DeStefano