US 11,797,501 B2
Methods and systems for aggregating and querying log messages
Chandrashekhar Jha, Bangalore (IN); Navya Sree Tirunagari, Bangalore (IN); Yash Bhatnagar, Bangalore (IN); and Ritesh Jha, Bangalore (IN)
Assigned to VMware, Inc., Palo Alto, CA (US)
Filed by VMWARE, INC., Palo Alto, CA (US)
Filed on Feb. 12, 2021, as Appl. No. 17/174,378.
Claims priority of application No. 202041055577 (IN), filed on Dec. 21, 2020.
Prior Publication US 2022/0197879 A1, Jun. 23, 2022
Int. Cl. G06F 16/21 (2019.01); G06F 16/23 (2019.01); G06F 16/242 (2019.01); G06F 16/25 (2019.01); G06F 11/34 (2006.01); G06F 11/07 (2006.01); G06F 16/2458 (2019.01)
CPC G06F 16/217 (2019.01) [G06F 11/079 (2013.01); G06F 11/3419 (2013.01); G06F 16/2358 (2019.01); G06F 16/244 (2019.01); G06F 16/2477 (2019.01); G06F 16/256 (2019.01)] 18 Claims
OG exemplary drawing
 
1. A computer-implemented method stored in one or more data-storage devices and executed using one or more processors of a computer system for aggregating and querying log messages generated by event sources in a distributed computing system, the method comprising:
determining event types of log messages generated by event sources of the distributed computing system;
aggregating the event types into aggregated records for a shortest time unit and storing the aggregated records in an aggregated records database, each aggregated record corresponding to one of the event types;
retrieving the aggregated records from the aggregated records database, aggregating the aggregated records of each even type for longer time units than the shortest time unit, and storing the aggregated records for longer time units in the aggregated records database; and
in response to receiving a query regarding occurrences of an event type in a query time interval via an interface,
splitting the query time interval into subintervals with time lengths that range from the shortest time unit to a longest time unit that lie within the query time interval, and
determining a total event count of occurrences of the event type in the query time interval based on the aggregated records with the same event type and time stamps in the subintervals, where in the total event count is a sum of event counts of the event type in the subintervals of the query time interval.