Alert Logic, Inc.

Pavel S Trakhtman

Eugene Golovinsky

Paul Fisher

Mikhail Govshteyn

Christopher A Church

Anton Lavrik

A log message collection system selects a configured host and fetches a log message. The log message collection system examines the fetched message to identify one or more DLLs necessary to translating the log message and determines whether the necessary DLL(s) have been loaded into a cache. If so, the log message is translated. If the DLLs are not in the cache, the log message collection system fetches from the log message host only the DLLs necessary to translate that fetched message. After the message is translated, the log message collection system fetches the next log message, identifies the necessary DLLs for that log message, and fetches the DLLs necessary to translate that message.

Log message collection employing on-demand loading of message translation libraries

An appliance is co-located on a network with computing devices. Log messages generated by the computing devices are collected by the appliance, filtered based on the content and stored in transmission priority queues based on the content. The appliance packetizes the log messages based on the transmission priority queue and the available bandwidth and compresses the packet. The appliance encrypts the packet, digitally signs the encrypted packet and sends the packet to a first data center over a public network. The first data center stores the packet in reliable storage and performs processing on the data. A copy of the packet is sent to a second data center that stores the copy and performs processing on the copied data. The appliance deletes the packet from its buffer after it has received acknowledgement that the second data center has received the packet.

Log message archiving and processing using a remote internet infrastructure

Methods and systems for normalizing log messages. Some methods include obtaining a freeform log message from one of many disparate programs. The methods can include determining which program originated the message and, based on that, determining a signature which matches the message. Using the signature, a parsing expression may be determined with which to extract information from a portion of the message. The time from obtaining the message to extracting the information can be about the same for all messages and can be about 1/40,000of a second. In some embodiments, a generic signature of the message may be output. A version of the message may be reconstructed based on the generic signature and information. When more than one message signatures matches the reconstructed message, one of the matching signatures can be adjusted. The parsing expression can be the first of an ordered list of expressions which successfully evaluates the log message.

Growing community of inventors

Houston, TX, United States of America

Pavel S Trakhtman