US 12,093,230 B1
Semantic deduplication of event logs
Kourosh Lashgari, Sammamish, WA (US)
Assigned to Oracle International Corporation, Redwood Shores, CA (US)
Filed by Oracle International Corporation, Redwood Shores, CA (US)
Filed on Aug. 14, 2023, as Appl. No. 18/449,402.
Int. Cl. G06F 16/00 (2019.01); G06F 16/215 (2019.01); G06F 16/2455 (2019.01)
CPC G06F 16/215 (2019.01) [G06F 16/24568 (2019.01)] 20 Claims
OG exemplary drawing
 
1. One or more non-transitory computer readable media comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:
receiving an event stream, the event stream comprising a first event record and a second event record;
determining that the first event record does not meet one or more similarity criteria in relation to any of a plurality of representative records in an event log, each particular representative record of the plurality of representative records (a) representing a corresponding set of one or more event records and (b) being associated with a numerical value indicating a number of the event records, in the set of one or more event records, that are represented by the particular representative record;
responsive at least to determining that the first event record does not meet the one or more similarity criteria in relation to any of the plurality of representative records: adding a new representative record, to the plurality of representative records, that is based on the first event record;
determining that the second event record meets the one or more similarity criteria in relation to a first representative record of the plurality of representative records, wherein at least a portion of the second event record differs from at least a portion of the first representative record; and
responsive to determining that the second event record meets the one or more similarity criteria in relation to the first representative record:
incrementing the numerical value, associated with the first representative record in the event log, that indicates the number of event records that are represented by the first representative record;
generating log data that (a) comprises the incremented numerical value associated with the first representative record and (b) does not include the second event record; and
updating the event log based on the log data to generate an updated event log that does not include the second event record.