US 11,782,771 B2
Method and subsystem within a distributed log-analytics system that automatically determines and enforces log-retention periods for received log-event messages
Ritesh Jha, Karnataka (IN); Jobin Raju George, Karnataka (IN); Pushkar Patil, Karnataka (IN); Vaidic Joshi, Karnataka (IN); and Nikhil Jaiswal, Karnataka (IN)
Assigned to VMware, Inc., Palo Alto, CA (US)
Filed by VMware, Inc., Palo Alto, CA (US)
Filed on May 20, 2021, as Appl. No. 17/326,169.
Prior Publication US 2022/0374292 A1, Nov. 24, 2022
Int. Cl. G06F 9/54 (2006.01); G06F 16/18 (2019.01); G06F 9/50 (2006.01)
CPC G06F 9/542 (2013.01) [G06F 9/5072 (2013.01); G06F 9/546 (2013.01); G06F 16/1805 (2019.01)] 20 Claims
OG exemplary drawing
 
1. An improved log/event-message system, within a distributed computer system, that collects log/event messages from log/event-message sources within the distributed computer system, stores the collected log event messages, and provides query-based access to the stored log/event-messages, the log/event-message system comprising:
one or more message collectors, incorporated within one or more computer systems, each having one or more processors and one or more memories, which each receives log/event messages, processes the received log/event messages, and transmits the processed log/event messages to one or more message-ingestion-and-processing subsystems;
the one or more message-ingestion-and-processing subsystems, incorporated within one or more computer systems, each having one or more processors and one or more memories, which each receives processed log/event messages from one or more of the one or more message collectors, processes the received processed log/event messages, and forwards processed log/event messages to a log-database subsystem;
the log-database subsystem that receives processed log/event messages from one or more of the one or more message-ingestion-and-processing subsystems, automatically assigns retention periods to the received processed log/event messages, and manages storage of the received processed log/event messages for their assigned retention periods; and
a log/event-message query subsystem that retrieves processed log/event messages from the log-database subsystem.