EP4298521A1 - Prédiction d'une survenue imminente d'un dysfonctionnement sur la base d'une analyse de données de journal - Google Patents

Prédiction d'une survenue imminente d'un dysfonctionnement sur la base d'une analyse de données de journal

Info

Publication number
EP4298521A1
EP4298521A1 EP22711907.0A EP22711907A EP4298521A1 EP 4298521 A1 EP4298521 A1 EP 4298521A1 EP 22711907 A EP22711907 A EP 22711907A EP 4298521 A1 EP4298521 A1 EP 4298521A1
Authority
EP
European Patent Office
Prior art keywords
log data
malfunction
combination
servers
features
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
EP22711907.0A
Other languages
German (de)
English (en)
Inventor
Andreas Wilke
Ilya Komarov
Manfred Paeschke
Julia BAUR
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Bundesdruckerei GmbH
Original Assignee
Bundesdruckerei GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Bundesdruckerei GmbH filed Critical Bundesdruckerei GmbH
Publication of EP4298521A1 publication Critical patent/EP4298521A1/fr
Pending legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3466—Performance evaluation by tracing or monitoring
    • G06F11/3476—Data logging
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/004—Error avoidance
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
    • G06F11/0709—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0766—Error or fault reporting or storing
    • G06F11/0778—Dumping, i.e. gathering error/state information after a fault for later diagnosis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0793—Remedial or corrective actions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3452—Performance evaluation by statistical analysis

Definitions

  • the invention relates to a method for analyzing log data, a computer system for analyzing log data and a distributed computer system which comprises a corresponding computer system for analyzing log data as a server.
  • the object of the invention is to create an improved method for predicting and avoiding malfunctions.
  • Embodiments include a method for analyzing log data of a computer system.
  • the procedure includes:
  • logging of log data comprising storing log data in a database, the log data being stored in each case with a time stamp
  • Monitoring the logged log data wherein the monitoring for logging a combination of log data having the stored characteristic feature combination includes predicting an impending occurrence of the malfunction.
  • Embodiments can have the advantage that a combination of one or more characteristic features can be determined based on the statistical analysis, which is characteristic for the occurrence of the malfunction. In other words, it can be determined which features occur before the malfunction that otherwise do not occur and therefore have a high probability of contributing to the causes of the malfunction.
  • statistical methods are used to analyze the log data. For example, additional log data is extracted from other time intervals as reference data, and statistically conspicuous or significant differences are determined between the log data associated with the malfunction and the reference data.
  • an outlier detection is used here in order to find a combination of features that deviates from the reference data Reference data
  • Time intervals with log data are selected which are similar to the log data related in time to the malfunction, but which are not directly related in time to a malfunction.
  • Log data is not directly related in terms of time to a malfunction if no malfunction has occurred during the time interval in which the corresponding log data was logged and within a further predefined time interval thereafter.
  • pattern recognition can be used to select similar log data.
  • a plurality of malfunctions are used for the statistical analysis.
  • the malfunctions used are, for example, identical or similar malfunctions.
  • log data is extracted that was logged within a time interval preceding the malfunction.
  • a plurality of data sets with log data is thus provided, to which pattern recognition can be applied.
  • matches between the data sets with log data are determined.
  • matches are taken into account which are not or only rarely found in reference data records which are not directly related in terms of time to a malfunction.
  • Log data or log data is automatically logged data of all or specific actions of processes on a computer system. For example, all actions that are or could be necessary for later analysis are logged. For example, in addition to the logged action, the corresponding log data includes a time stamp with the date and time of the corresponding action. In log data analysis, the log data from a computer system over a certain period of time is examined according to specific criteria.
  • the log data log errors are runtime errors that impede the functioning of an application, or unexpected program errors. Serious errors that lead to an application being terminated are also referred to as "fatals”. Warnings include, for example, calls to obsolete interfaces, incorrect calls to interfaces, user errors or unfavorable program states.
  • the characteristic combination of features is a characteristic data pattern, such as a characteristic sequence of specific log data.
  • the characteristic feature combination is assigned to the malfunction and used for further monitoring of the logged log data.
  • subsequently logged log data is checked to see whether the characteristic combination of features occurs, for example in the form of a characteristic sequence of certain log data. If an occurrence of the characteristic combination of features is detected, this can be used as a trigger for predicting an imminent occurrence of the malfunction.
  • an occurrence of a characteristic part of the combination of features can be used as a trigger for predicting the imminent occurrence of the malfunction.
  • the beginning of the sequence can be used as a trigger in order to be able to predict as early as possible the occurrence of the malfunction.
  • the time interval preceding the malfunction whose logged log data is used to determine the characteristic combination of features, is varied. For example, a time interval immediately preceding the malfunction is used first. This time interval can then, for example, be lengthened or shortened and/or moved back in time by the functional disorder until a characteristic combination of features is found which has a sufficient difference, for example sufficient statistical significance.
  • Embodiments may have the advantage of enabling effective prediction of a malfunction occurrence.
  • a malfunction is understood here to mean a disruption in the intended operation of a computer system.
  • Intended operation is the operation for which the computer system is technically designed and which it achieves under normal conditions.
  • Operating parameters that describe the intended operation or regular operation of the computer system include, for example, performance parameters such as instructions per cycle, instructions per second, floating point operations per second, data transfer rate, data throughput, response time, response rate, frames per second, processor clock, latency or access time.
  • the operating parameters include available software and hardware as well as physical condition parameters such as temperatures of components.
  • Malfunction can take very different forms depending on the complexity of the system and include for example Malfunction, such as software or hardware errors, as well as deviations from the intended operating parameters.
  • the malfunction is an error event.
  • the malfunction involves exceeding or falling below a predefined threshold value.
  • the predefined threshold value defines a minimum value for a line parameter, which should at least be met during regular operation of the computer system.
  • the predefined threshold value defines a maximum value for a load or capacity utilization of the computer system or individual components of the computer system, which should not be exceeded during regular operation of the computer system.
  • the predefined threshold value defines a maximum value for the temperature of the computer system or individual components of the computer system, which should not be exceeded during regular operation of the computer system.
  • the computer system itself performs the log data analysis.
  • the computer system itself monitors the log data.
  • the database is a database of the computer system. Embodiments may have the advantage that the computer system itself logs the log data, analyzes it and performs log data monitoring using the analysis results.
  • an analysis computer system i.e. another computer system, performs the log data analysis.
  • the computer system is a server of a distributed computer system that includes a plurality of servers.
  • one of the servers, acting as an analysis computer system carries out the log data analysis for one, several and/or all individual computer systems or servers of the distributed computer system.
  • the database is a database of the computer system.
  • the log data can be logged in the database, for example, locally on the individual servers by the corresponding servers, with the analysis computer system having access to the locally stored data.
  • the log data can be logged in one or more central databases to which both the computer system or server logging the computer and the analysis computer system have access.
  • the database is a database of the analysis computer system.
  • the computer system itself monitors the log data.
  • the analysis computer system sends the assignment to the computer system.
  • Embodiments can have the advantage that the monitoring can be done locally. This can, for example, enable a timely local prediction of the upcoming malfunction. If necessary, timely local countermeasures can also be initiated in order to prevent or mitigate the malfunction and/or to prevent or mitigate adverse consequences of the malfunction.
  • the log data can also be monitored by the analysis computer system or independently by the individual servers.
  • the computer system executing the analysis needs access to the log data to be analyzed.
  • This access can include, for example, access to the database in which the log data is stored.
  • the computer system sends the extracted log data and/or other logged log data to the analysis computer system for log data analysis.
  • the analysis computer system monitors the log data of the computer system.
  • the computer system sends the log data to the analysis computer system, for example.
  • the computer system executing the monitoring needs access to the log data to be monitored.
  • This access can include, for example, access to the database in which the log data is stored in the course of logging.
  • the log data to be monitored is sent to the analysis computer system.
  • Embodiments may have the advantage that a specifically configured analysis computer system can be used to perform the log data analysis.
  • a distributed computer system which comprises a plurality of individual computer systems, such as servers
  • one of the servers can, for example, perform log data analysis for the distributed computer system as an analysis computer system.
  • the analysis computer system can use log data from several or all servers in the system for log data analysis. This can have the advantage, for example, that a statistical analysis is made possible across a number of servers.
  • characteristic combinations of features across multiple servers can be taken into account and used to predict an imminent malfunction.
  • the characteristic feature combination comprises characteristic features from extracted combinations of log data from a number of computer systems, such as servers.
  • a characteristic combination of features can, for example, be the result of a statistical analysis of log data from a plurality of servers.
  • correlations between the log data of several servers can be determined and used in the form of the characteristic combination of features to predict imminent malfunctions.
  • Corresponding correlations can be based, for example, on causal relationships between events are based, which occur on different servers.
  • Corresponding correlations can be based, for example, on a causal connection between the malfunction and events occurring on different servers.
  • the malfunction is based on an interaction of the corresponding events.
  • the characteristic combination of features is a characteristic data pattern across multiple servers, such as a characteristic sequence of specific log data that is recorded on different servers.
  • the statistical analysis includes determining one or more statistical parameters.
  • the statistical parameters include a mean value, a variance, a standard deviation, a correlation or a measure of connection and/or a frequency, such as an absolute or relative frequency.
  • the arithmetic, the geometric and the quadratic mean can be calculated as the mean value, which represents a characteristic value for the central tendency of a distribution.
  • the variance or its square root, the standard deviation is a measure of the spread of a distribution or a probability density around its center of gravity.
  • a correlation or a measure of association such as the covariance, provides a measure of the strength and possibly the direction of a relationship between two statistical variables.
  • a warning is issued in response to the prediction of the impending malfunction.
  • the warning can be issued, for example, on the computer system that performs the log data analysis, on the computer system on which the malfunction is imminent, and/or on several or all individual computer systems of a distributed computer system.
  • the warning is generated by the computer system that performs the log data analysis and sent to one or more other computer systems for output.
  • the output can be visual or acoustic, for example, via an output device of a user interface.
  • the warning signal is output visually, for example on a display, or acoustically, for example via a loudspeaker.
  • Embodiments may have the advantage of informing users of the upcoming malfunction. Thus, users can be prevented from being surprised by the occurrence of the malfunction. Rather, they may be enabled to take action to prevent and/or mitigate the dysfunction. The users can adapt to the malfunction and its consequences if necessary.
  • countermeasures to be taken to avoid the malfunction are determined.
  • An assignment of the specific combination of characteristic features to the countermeasures is made stored together with the assignment of the specific combination of characteristic features to the malfunction.
  • the countermeasures are automatically carried out.
  • Embodiments can have the advantage that countermeasures to be carried out automatically can be stored.
  • Automated fault compensation or fault elimination or error compensation or error correction can thus be implemented. For example, data streams can be redirected, instructions diverted or their execution delayed. For example, additional capacities can be added and/or processes can be outsourced. For example, execution of instructions can be blocked. For example, execution of certain instructions can be prioritized while execution of other instructions can be deferred.
  • the assignment of the countermeasures to be executed is stored, for example, by the computer system.
  • Embodiments can have the advantage that the countermeasures to be carried out are stored locally and are therefore also available locally for immediate execution if required.
  • the assignment of the countermeasures to be carried out is stored, for example, by the analysis computer system.
  • the analysis computer system sends the countermeasures to be carried out, for example to those computer systems which are to carry out the corresponding countermeasures to be carried out.
  • Embodiments can be particularly advantageous in the case of a distributed computer system with a plurality of servers, since the analysis computer system can, for example, determine server-specific countermeasures using the countermeasures stored and can send one or more of the servers to be executed.
  • the stored countermeasures include information about which server has to carry out which countermeasures or specify criteria that can be used to determine which server has to carry out which of the countermeasures.
  • countermeasures can be stored for sending and/or receiving servers, with it being possible to specify which of the countermeasures are to be carried out by sending servers and which countermeasures are to be carried out by receiving servers.
  • the countermeasures to be taken are assigned to the malfunction, via which they are indirectly assigned to the specific combination of characteristic features.
  • Embodiments can have the advantage that, for example, different combinations of characteristic features can lead to the same malfunction.
  • the malfunction can, for example, make the same countermeasures necessary in each of these cases. For example, using the impending malfunction, the countermeasures to be taken are identified.
  • the countermeasures to be taken are directly assigned to the specific combination of characteristic features.
  • different combinations of characteristic features can lead to the same malfunction.
  • the malfunction can have different causes in different cases, for example, which are each characterized by a different combination of features.
  • different causes may require different countermeasures, although without the countermeasures, the different causes each result in the same malfunction.
  • Embodiments can have the advantage that the countermeasures to be carried out can be identified on the basis of the specific combination of characteristic features. Different countermeasures to be carried out can be identified for different characteristic feature combinations, although the different characteristic feature combinations are assigned the same malfunction.
  • the countermeasures to be executed comprise program instructions to be executed.
  • the countermeasures to be executed comprise program instructions to be executed by the computer system.
  • the countermeasures to be carried out include, for example, program instructions to be carried out by one or more other computer systems or servers of the distributed computer system.
  • Embodiments can have the advantage that, for example, the stored program instructions are called up and executed for the automatic execution of the countermeasures.
  • These program instructions can provide program routines for automated fault compensation or fault elimination or error compensation or error correction. For example, in the course of executing the corresponding program routines, sources of errors are eliminated and/or dependent processes are stopped.
  • a first tolerance range is assigned to the features of the characteristic feature combination.
  • a logged combination of log data has the stored characteristic feature combination if it has the features according to the characteristic feature combination and these features lie within the assigned first tolerance ranges.
  • Embodiments can have the advantage that possible deviations or fluctuations within the characteristic combination of features can also be taken into account, which nevertheless lead to the same malfunction.
  • a second tolerance range is assigned to the features of the characteristic feature combination. It is assumed that a logged combination of log data has the stored characteristic feature combination if it has a predetermined minimum number of features of the characteristic feature combination and these features are each within the assigned second tolerance ranges.
  • Embodiments can have the advantage that, in the course of monitoring the logged log data, an impending occurrence of the malfunction can also be predicted in the event that the logged log data does not have all the features of the characteristic feature combination, i.e. the deviations or There are fluctuations in the characteristics themselves.
  • the first tolerance range is identical to the second tolerance range for the same feature.
  • the first tolerance ranges are respectively larger than the second tolerance ranges for one or more features. According to embodiments, the first tolerance range is greater than the second tolerance range for the same feature.
  • Embodiments may have the advantage that in the case of detecting fewer characteristic features or indicators in the logged log data, more stringent requirements are set for a positive prediction that a malfunction is imminent than in the case of a greater number of characteristics or indicators for the impending occurrence of the functional disorder. If characteristics or indicators for the impending occurrence of the malfunction are detected, larger tolerance ranges can be selected for these, for example. In other words, given a sufficiently large number of features or indicators, it can be assumed that the interference function is imminent, even if some of the features or indicators deviate more than others.
  • storing the log data includes normalizing the log data.
  • the normalizing satisfies sixth normal form.
  • Embodiments can have the advantage that redundancies can be avoided.
  • Embodiments can have the advantage that a chronological classification of the log data is taken into account.
  • the log data can be stored in the form of relations or equivalent structures.
  • a relation is understood here in the sense of relational database theory as a set of tuples.
  • a tuple is a set of attribute values.
  • An attribute denotes a data type or one or more data associated property.
  • the number of attributes determines the degree, the number of tuples determines the cardinality of a relation.
  • a normalization in particular a normalization of a relational data model, is understood to mean a division of attributes into a plurality of relations according to a normalization rule, so that redundancies are reduced or minimized.
  • a relational data model can be implemented, for example, in table-like data structures in which the relations are implemented in the form of tables, the attributes in the form of table columns and the tuples in the form of table rows.
  • a relational data model can be brought into a normal form, for example, by progressively breaking down the relations of the data schema into simpler relations based on the functional dependencies that apply to the corresponding normal form.
  • 1st normal form INF
  • 2nd normal form 2NF
  • S. normal form SNF
  • Boyce-Codd normal form BCNF
  • 4th normal form 4NF
  • 5th normal form 5NF
  • 6th normal form 6NF
  • the normalization criteria increase from normal form to normal form and include the normalization criteria of the previous normal forms, i.e.
  • a relation is in first normal form if each attribute of the relation has an atomic range and the relation is free of repeating groups.
  • atomic is understood to mean the exclusion of composite, set-valued or nested value ranges for the attributes, i.e. relational attribute value ranges.
  • a freedom from repeating groups requires that attributes that contain the same or similar information are outsourced to different relations.
  • a relation is in second normal form if it satisfies the requirements of first normal form and no nonprimary attribute depends functionally on a proper subset of a candidate key.
  • a non-primary attribute is an attribute that is not part of a key candidate. This means that each non-primary attribute depends on all whole keys and not just on a part of a key. Relations in first normal form whose key candidates are not composite but consist of each consist of a single attribute, therefore automatically fulfill the second normal form.
  • a key candidate is understood here to be a minimal set of attributes that uniquely identifies the tuples of a relation.
  • a relation is in third normal form if it satisfies the requirements of second normal form and no non-key attribute transitively depends on a candidate key.
  • An attribute is transitively dependent on a candidate key if the corresponding attribute depends on the corresponding candidate key via another attribute.
  • a relation is in Boyce-Codd normal form if it satisfies the requirements of third normal form and every determinant is a super key.
  • a determinant is understood here as a set of attributes on which other attributes are functionally dependent. A determinant thus describes the dependency between attributes of a relation and determines which sets of attributes determine the value of the other attributes.
  • a super key is a set of attributes in a relation that uniquely identify the tuples in that relation. Consequently, the attributes of this set always include different values for pairs of tuples selected.
  • a key candidate is therefore a minimal subset of the attributes of a super key, which enables the tuples to be identified.
  • a relation is in fourth normal form if it satisfies the requirements of Boyce-Codd normal form and has no non-trivial multi-valued dependencies.
  • a relation is in fifth normal form if it satisfies the requirements of fourth normal form and has no multivalued dependencies that are dependent on each other.
  • Fifth normal form is thus given if every non-trivial join dependency is implied by the key candidates.
  • a join dependency is implied by the candidate keys of the source relation if each relation of the set of relations is a super key of the source relation.
  • a relation is in sixth normal form if it satisfies the requirements of fifth normal form and has no nontrivial join dependencies.
  • the database is a multi-model database with a multi-model database management system that uses a plurality of data models to store the log data.
  • the log data is stored in a first document-oriented data model.
  • a document-oriented data model means that the data model does not make any structural specifications for the data to be stored. Rather, the data is stored in documents or data containers in the form in which it was received. In this sense, the data stored in the document-oriented data model is raw data.
  • Raw data means that the data is stored in the form in which it is received, without any additional data processing by the database management system, in particular no restructuring of the data.
  • Embodiments can have the advantage that the entire information content of the received data can be retained (almost) completely without the assumptions of the database management system being included. This means that the original database can be accessed at any time and taken into account in further processing.
  • the data is normalized and an index is generated.
  • This index is, for example, a content-based multi-level index structure.
  • This index represents a second data model, which has the sixth normal form, for example. In this way, all fields and field contents can be transferred from the first data model to the normalized second data model without redundancy, which example has the form of a multidimensional key/value store (key/value store) or a multidimensional key-value database.
  • the transaction time and validity time of the data records are also stored bitemporally.
  • the transaction time indicates the point in time at which a data object in the database is changed.
  • the validity time specifies a point in time or a period of time in which a data object in the modeled image of the real world has the described state. If both validity and transaction time are relevant, it is called bitemporal.
  • bitemporal For each data record, not only the status of the data record at the last transaction or change is visible, but also its history. In this case one speaks of a bitemporal database, in which both the validity and the transaction time of the data records are taken into account.
  • a key-value data model enables storage, retrieval and management of associative data fields. Values are clearly identified using a key.
  • Embodiments can have the advantage that the log data can be stored in both data models and made available for analysis.
  • the computer system is a first server of a distributed computer system that includes a plurality of servers.
  • Log data is logged on each of the servers.
  • the logged log data is monitored.
  • Embodiments may have the advantage of being able to predict malfunctions on a distributed computing system.
  • the log data can be monitored locally on the individual servers or centrally.
  • the specific combination of characteristic features is assigned to the malfunction by the first server.
  • the specific combination of characteristic features is assigned to the malfunction by the first server.
  • the first server also monitors the log data logged by the servers of the server group. Upon logging a combination of log data, which has the stored combination of characteristic features, an imminent occurrence of the malfunction is predicted.
  • the resulting assignment is forwarded from the first server to a server group.
  • the server group includes one or more other servers of the plurality of servers.
  • the servers of the server group each store the forwarded assignment.
  • Monitoring is done locally on the servers in the server group.
  • the monitoring of log data by the servers of the server group includes a prediction of an impending occurrence of the malfunction by the corresponding server in each case after a combination of log data which has the stored characteristic feature combination is logged.
  • the server group includes all servers of the computer system in addition to the first server.
  • log data logged by the servers of the server group are extracted within the time interval preceding the malfunction.
  • the characteristic feature combination is determined by the first server using the extracted combination of log data of the server group and using a statistical analysis across the servers of the server group.
  • the assignment of the specific characteristic feature combination to the Malfunction is propagated to the servers of the server group.
  • the servers of the server group each store the forwarded assignment.
  • the monitoring of log data by the servers of the server group includes a prediction of an impending occurrence of the malfunction by the corresponding server in each case after a combination of log data which has the stored characteristic feature combination is logged.
  • the log data analysis is additionally performed using log data from the first server.
  • one or more first identifiers are also determined, which features include one or more servers on which the malfunction occurs, with an assignment of the specific characteristic feature combination to the identifier being stored together with the assignment of the specific characteristic feature combination to the malfunction .
  • Embodiments can have the advantage that, in addition to the characteristic combination of features, identifiers can be determined, based on which the servers of the distributed system on which the malfunction occurs can be determined.
  • the identifiers can be features of the feature combination, for example, which can be used to determine the corresponding server. For example, using the identifiers, those servers can be identified as servers on which the disruption function is imminent, which have a specific feature of the feature combination, i.e. on which specific log data has been logged.
  • the first identifiers are assigned to the malfunction, via which they are indirectly assigned to the specific combination of characteristic features.
  • Embodiments can have the advantage that, for example, different combinations of characteristic features can lead to the same malfunction.
  • the malfunction can occur with one or more servers that have the same characteristics or are identified by the same identifiers.
  • the first identifiers are assigned directly to the specific combination of characteristics.
  • Embodiments can have the advantage that, for example, different combinations of characteristic features can lead to the same malfunction.
  • the malfunction can, for example, have different causes in different cases, each of which is caused by a different combinations of features are characterized. Different causes can lead, for example, to the fact that the malfunction occurs in one or more servers, which have different characteristics depending on the respective cause.
  • one or more servers which are experiencing the malfunction are determined using the identifiers and an alert is issued for the specific servers, respectively.
  • the servers are determined centrally and the alerts are sent to the appropriate servers for delivery.
  • countermeasures to be taken to avoid the malfunction are determined for one or more servers.
  • One or more second identifiers are determined, which include features of the corresponding server on which the countermeasures are to be carried out, with an assignment of the specific characteristic feature combination to the countermeasures and the second identifier being stored together with the assignment of the specific characteristic feature combination to the malfunction becomes.
  • the countermeasures are automatically executed on the servers identified by the second identifiers.
  • Embodiments can have the advantage that additional identifiers can be determined, based on which the servers of the distributed system can be determined on which the countermeasures against the malfunction are to be executed. These servers, which at least partially cause the malfunction or contribute to it, differ, for example, from the servers on which the malfunction to be prevented is imminent. For example, the second identifiers therefore differ from the first identifiers.
  • the identifiers can be features of the feature combination, for example, which can be used to determine the corresponding servers on which the countermeasures are to be carried out. For example, the identifiers can be used to identify those servers that have a specific feature of the feature combination, i.e. on which specific log data was logged.
  • the countermeasures to be taken and second identifiers are assigned to the malfunction, via which they are indirectly assigned to the specific combination of characteristic features.
  • Embodiments can have the advantage that, for example, different characteristics Combinations of features can lead to the same dysfunction. However, in each of these cases, the malfunction can occur, for example, in one or more servers that have the same characteristics.
  • the countermeasures to be taken and identifiers are assigned directly to the specific combination of characteristic features.
  • Embodiments can have the advantage that, for example, different combinations of characteristic features can lead to the same malfunction.
  • the malfunction can, for example, have different causes in different cases, which are each characterized by a different combination of features. Different causes can lead, for example, to the fact that the malfunction occurs in one or more servers, which have different characteristics depending on the respective cause.
  • countermeasures are to be performed on the servers where the malfunction occurs, which is why the second identifiers are identical to the first identifiers. According to embodiments, countermeasures are to be carried out on servers on which no malfunction occurs but which cause or contribute to the malfunction. In this case, the second identifiers differ from the first identifiers, for example.
  • Embodiments further include a computer system having a processor and a memory, the memory storing program instructions. Execution of the program instruction by the processor causes the processor to control the computer system such that the computer system performs a method of analyzing log data.
  • the procedure includes:
  • logging of log data comprising storing log data in a database, the log data being stored in each case with a time stamp
  • monitoring the logged log data includes predicting an imminent occurrence of the malfunction.
  • the computer system is configured to execute any of the previously described embodiments of the method for analyzing log data.
  • the log data is log data from the computer system itself.
  • the log data is log data from another computer system, which the computer system receives or to which the computer system has access and which analyzes the first computer system. For example, the malfunction occurs on the computer system.
  • the malfunction occurs on another computer system that is connected to the computer system. If an imminent occurrence of the malfunction is predicted, the corresponding prediction and/or a warning is sent to the further computer system.
  • Embodiments further include a distributed computing system including a plurality of servers.
  • a first server of the plurality of servers is the computer system of one of the previously described embodiments.
  • Log data is logged on each of the servers and the logged log data is monitored.
  • the computer system is configured to execute any of the previously described embodiments of the method for analyzing log data.
  • the specific characteristic combination of features is assigned to the malfunction by the first server and is forwarded by the first server to a server group with one or more other servers from the plurality of servers.
  • the servers of the server group each store the forwarded assignment.
  • the monitoring of log data by the servers of the server group includes, in each case upon logging of a combination of log data which has the stored characteristic combination of features, by the corresponding server predicting an impending occurrence of the malfunction.
  • the specific characteristic feature combination is assigned to the malfunction, as is the monitoring of log data Servers of the server group by the first server.
  • a combination of log data, which has the stored characteristic feature combination is logged by the first server, an impending occurrence of the malfunction is predicted. For example, the prediction is sent to the servers that are about to experience the malfunction.
  • log data logged by the servers of the server group are extracted within the time interval preceding the malfunction.
  • the characteristic feature combination is determined by the first server using the extracted combination of log data from the server group.
  • the characteristic feature combination is determined using a statistical analysis across the servers of the server group.
  • the allocation of the specific characteristic combination of features to the malfunction is forwarded to the server of the server group.
  • the servers of the server group each store the forwarded assignment.
  • the monitoring of log data by the servers of the server group includes a prediction of an impending occurrence of the malfunction by the corresponding server in each case after a combination of log data which has the stored characteristic feature combination is logged.
  • log data logged by the servers of the server group within the time interval preceding the malfunction is extracted, for example from the first server.
  • the first server determines the characteristic feature combination using the extracted combination of server group log data.
  • the characteristic feature combination is determined using a statistical analysis across the servers of the server group.
  • the allocation of the specific combination of characteristic features to the malfunction is stored by the first server.
  • the monitoring of log data of the servers of the server group by the first server comprises in each case a logging of a combination of log data, which has the stored characteristic feature combination, by the corresponding server predicting an impending occurrence of the malfunction.
  • the first server has access to the log data logged by the servers in the server group.
  • the log data is stored in databases to which the first server has access and/or is sent from the servers in the server group to the first server.
  • a “database” is understood here as a stored amount of data. The amount of data can be structured, for example according to a structure specified for the database.
  • a “database management system” or data management software can be provided for managing the data in the database will.
  • a “database management system” is understood here to mean data management software running on a computer system for storing and retrieving data in a database.
  • the database management system specifies the structure to be used for storing the data.
  • the data can be stored in different forms or using different structures
  • the data will be stored in data sets each consisting of a number of data fields.
  • a "processor” is understood here and in the following to mean a logic circuit that is used to execute program instructions.
  • the logic circuit can be implemented on one or more discrete components, in particular on a chip.
  • a processor includes, for example, an arithmetic unit, a control unit, registers and Data lines for communication with other components.
  • a “processor” is understood to mean a microprocessor or a microprocessor system made up of a number of processor cores and/or a number of microprocessors.
  • a "memory” is understood here to mean both volatile and non-volatile electronic memories or digital storage media.
  • non-volatile memory is understood here as an electronic memory for the permanent storage of data, in particular static cryptographic keys, attributes or identifiers.
  • a non-volatile memory can be configured as a non-modifiable memory, which is also known as a read-only memory (ROM ) is referred to, or as changeable memory, which is also referred to as non-volatile memory (NVM).
  • ROM read-only memory
  • NVM non-volatile memory
  • this can be an EEPROM, for example a flash EEPROM, referred to as flash for short.
  • a non-volatile memory is characterized characterized in that the data stored on it are retained even after the power supply has been switched off.
  • An “interface” or “communications interface” is understood here to mean an interface via which data can be received and sent, with the communication interface being able to be configured as contact-based or contactless.
  • a communication interface can, for example, enable communication via a network.
  • a communication interface can, for example, be wireless communication based on a mobile radio standard, Bluetooth, RFID, WiFi and/or Provide NFC standard.
  • a communication interface can provide cable-based communication, for example.
  • Network is understood here to mean any transmission medium with a connection for communication, in particular a local connection or a local network, in particular a local area network (LAN), a private network, in particular an intranet, and a digital private network (Virtual Private Network - VPN).
  • a computer system can have a standard wireless interface for connecting to a WLAN. It can also be a public network, such as the Internet. Depending on the embodiment, this connection can also be established via a mobile network .
  • Figure 1 is a schematic diagram of a computer system for analyzing log data
  • FIG. 2 shows a schematic diagram of a distributed computer system with a server for analyzing log data
  • FIG. 3 shows a schematic diagram of a distributed computer system with a server for analyzing log data
  • Figures 4 shows a schematic diagram of a log data analysis
  • Figure 5 is a flow chart of an exemplary method for analyzing log data
  • FIG. 6 shows a flowchart of an exemplary method for monitoring log data.
  • Figure 1 shows a computer system 100 for analyzing log data 122.
  • the computer system 100 includes a processor 102, a memory 106 and a communication interface 118.
  • the processor 102 is configured to execute program instruction 104 computer system 100 to analyze log -Data 122 to control.
  • the computer system 100 logs log data 122.
  • the log data 122 is stored in a database 120.
  • FIG. Computer system 100 has access to database 122.
  • computer system 100 includes database 120.
  • database 120 is an external or remote database.
  • the logged log data 122 can be log data of the computer system 100 and/or are log data from one or more other computer systems, such as servers.
  • the log data 122 log errors, warnings and information, for example, which are recorded, for example, by an operating system and/or an analysis program of the computer system logging the log data 122 .
  • the log data 122 are each logged with a time stamp.
  • the log data 122 may include data collected using one or more sensors 116 of the computer system 100 to monitor the operation of the computer system 100 . Sensors 116 may be configured to sense temperatures, voltages, or currents, for example.
  • the computer system 100 Upon the occurrence of a malfunction, the computer system 100 extracts from the database 120 those log data which were logged within a time interval ⁇ t preceding the malfunction. The corresponding log data 122 within the time interval ⁇ t is identified, for example, using its timestamp.
  • the computer system 100 determines a characteristic feature combination 112, which comprises one or more characteristic features of the extracted combination of log data.
  • the characteristic feature combination 112 includes, for example, a characteristic combination and/or sequence of specific log data from the extracted combination of log data, which is characteristic of the extracted combination of log data.
  • These characteristic log data form, for example, the characteristic features of the characteristic feature 112. For example, the order or chronological sequence of the characteristic log data can also be characteristic for the extracted combination of log data.
  • the log data of the characteristic combination of features 112 only become characteristic based on their sequence or chronological sequence.
  • the characteristic feature combination 112 is determined, for example, using a statistical analysis.
  • the statistical analysis can be used, for example, to determine which log data or sequence of log data includes the extracted combination of log data that does not appear in the otherwise logged log data. If log data or a sequence of log data deviate in a statistically significant manner from log data that has been logged up to now without a malfunction having occurred, and which is therefore to be expected for the regular operation of computer system 100 , there is a high probability of a connection between the deviating log data or the deviating sequence of log data and the malfunction that occurs.
  • the computer system 100 creates an association between the specific combination of features 112 and the malfunction 110 that has occurred.
  • the association 108 is stored and used as a comparison data set for predicting an impending reoccurrence of the malfunction 110 .
  • the assignment can be stored in the memory 106 computer system 100 or in the database 120, for example.
  • Further log data 122 which are logged in the database 120, are continuously monitored by the computer system 100 or another computer system which has the assignment 108 and/or which has access to the assignment 108. When the characteristic combination of features 112 occurs in the logged log data 122, an imminent occurrence of the associated malfunction 110 is predicted.
  • a warning is output via the communication interface of the computer system 100 to other computer systems which are directly affected by the malfunction or indirectly affected when the malfunction occurs on the computer system 100 .
  • the other computer system is an admin computer system that is assigned to an administrator of computer system 100 .
  • the warning is output via a user interface of computer system 100 to an output device of computer system 100, such as a display.
  • countermeasures 114 to be carried out upon the occurrence of the malfunction 110 in order to avoid or limit the malfunction 110 can be added to the allocation 108 in a fixed manner.
  • the countermeasures include executable program instructions that are to be executed to avoid or limit the malfunction 110 .
  • the countermeasures 114 for example by the computer system 100 and/or other computer systems, are carried out automatically in response to the prediction of the imminent malfunction 110.
  • the countermeasures include, for example, blocking the execution of expected and potentially problematic instructions, delaying the execution of the corresponding instructions and/or outsourcing the execution of the corresponding instructions to an alternative component of the computer system 100 or an alternative computer system.
  • FIG. 2 shows a distributed computer system 198 with a server 100 for analyzing log data 152, 182.
  • the server 100 is, for example, the computer system from FIG. 1.
  • the computer system 100 itself does not record any log data.
  • the computer system 100 itself does not record any log data.
  • the analyzed log data 152, 182 is log data from servers 130, 160 of a server group 190 with a plurality of N servers in the distributed computer system 198, where N is a natural number greater than 1.
  • the servers 130, 160 of the server group 190 each include, for example, a processor 132, 162 for executing program instructions 134, 164, a memory 136, 166, and a communication interface 140, 170.
  • the servers 130, 160 are configured, for example, to log to log data 152, 182 in a database 150, 180.
  • the servers ISO, 160 additionally include one or more sensors 138, 168, for example.
  • the servers 150, 160 of the server group 190 communicate, for example, via a network 192 with one another and with the first server 100.
  • the network is, for example, a public network, such as the Internet, or a private network, such as an intranet and /or an internal communication network of the distributed computer system 198.
  • a fault message is sent to the first server 100, for example.
  • the error report indicates, for example, the type and time of the malfunction that occurred and the server or servers affected by the malfunction.
  • the first server 100 asks for log data to be extracted from the databases 150, 180, which were logged within a time interval At preceding the malfunction.
  • the first server 100 receives the extracted log data and determines a characteristic combination of features 112.
  • the first server 100 uses, for example, a statistical analysis of the servers 150, 160 of the server group 190 or the log recorded by them -Data on. For example, further data sets with server log data are used for statistical evaluation
  • the first server 100 creates, for example, an association 108 between the specific characteristic feature combination 112 and the malfunction 110 that has occurred. Furthermore, countermeasures against the malfunction that has occurred 110 can be defined and added to the association 108, for example.
  • the first server sends the assignment 108, for example, to the servers 150, 160 of the server group 190, which use the characteristic combination of features 112 to monitor the log data 152, 182 logged by them. If the characteristic combination of features 112 occurs in the logged log data 152, 182, an impending occurrence of the malfunction 110 is predicted. For example, the server 130, 160 predicting the malfunction 110 sends a warning about the impending malfunction 110 to the other servers in the server group 190 and/or to the first server 100. The server predicting the malfunction 110 also leads
  • one or more countermeasures defined by the mapping 108 took 114 out.
  • one or more of the alert recipients Servers of the server group 190 and/or the first server 100 also execute one or more countermeasures 114 defined by the association 108 .
  • FIG. 3 shows a distributed computer system 198 with a server 100 for analyzing log data 152, 182, the structure and function of which is analogous to the distributed computer system 198 of FIG.
  • the difference from the distributed computer system 198 in FIG. 2 is that the log data 152, 182 of the servers 150, 160 of the server group 190 are stored in a central database 194, to which the first server 100, for example, has access.
  • the first server 100 can therefore retrieve log data from the individual servers 150, 160, which were logged within a time interval At preceding the malfunction, from the central database 194 extract.
  • the first server 100 determines the characteristic combination of features 112 using the extracted log data and creates the assignment 108 between the characteristic combination of features 112, the malfunction 110 and, if necessary, countermeasures ll4 against the malfunction 110. Furthermore, for example, the first server 100 monitors the central database 194 logged log data 152, 182. If the characteristic combination of features 112 occurs in the logged log data 152, 182, an impending occurrence of the malfunction 110 is predicted by the first server 100. For example, the first server 100 sends a warning about the impending malfunction 110 to the servers 130, 150 of the server group 190. Furthermore, the first server 100 causes, for example, one or more countermeasures 114 defined by the assignment 108 to be carried out by one or more servers 130, 150 of the server group 190 and/or through the server 100.
  • FIG. 4A shows a chronological sequence of logged log data 196 of types "A", “B", “C” and "D".
  • the time is plotted on the x-axis, while the types of log data are plotted on the y-axis, for example.
  • a sequence "BABADCDBA” is logged, on which the occurrence of a malfunction 110 at time ts is recorded or logged Extracted log data
  • the extracted log data of the time interval ⁇ t are shown as an example in FIG.
  • the log data of type “A”, “B” is log data that occurs or is logged frequently, without a malfunction occurring.
  • FIG. 4C shows an exemplary sequence of log data 196 of type “A”, “B”, such as frequently occurs in the logged log data within a time interval At. This frequently The sequence of log data that occurs is thus, for example, not characteristic of the extracted log data. Rather, the remaining sequence of log data of type "D", "C” is characteristic of the extracted log data. As shown in FIG. 4A, this sequence is determined as a characteristic combination of features 112 with the sequence "DCD". has a be protruding malfunction 110 can occur. For example, countermeasures can be assigned to the characteristic feature combination 112 . For example, it can be determined that an impending occurrence of malfunction 110 is already predicted when a log data sequence "DC" is present and the countermeasures block, delay and/or outsource the execution of the action marked with log date D to another system component for execution.
  • Figure 5 shows an exemplary method for analyzing log data.
  • log data is logged.
  • a malfunction is detected, upon the detection of which in block 204 log data is extracted from the logged log data which was logged within a time interval ⁇ t preceding the malfunction.
  • a feature combination characteristic of the occurrence of the functional disorder is determined in the extracted log data, and in block 208 an assignment of the characteristic feature combination to the functional disorder detected in block 202 is created.
  • a statistical analysis for example, is used to determine the characteristic combination of features.
  • the mapping created is stored for monitoring future logged log data.
  • logged log data is monitored.
  • FIG. 6 shows an exemplary method for examining log data using a map created by a log data analysis method such as the method shown in FIG.
  • logged log data is monitored.
  • block 302 it is checked whether the logged log data includes the characteristic combination of features according to the assignment provided and/or according to an assignment from a plurality of assignments provided. If the characteristic combination of features is not detected, the monitoring of the log data in block 300 continues unchanged. If the characteristic combination of features is detected, the method continues in block 304 .
  • an impending occurrence of the malfunction is predicted, which is assigned to the detected combination of characteristic features.
  • a warning about the upcoming function is issued.
  • stored countermeasures are executed, which are also assigned to the characteristic combination of features and/or the predicted malfunction. reference list

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Probability & Statistics with Applications (AREA)
  • Debugging And Monitoring (AREA)

Abstract

L'invention concerne un procédé d'analyse de données de journal (122, 152, 182, 196) d'un système informatique (100). Le procédé comprend les étapes consistant à : journaliser des données de journal (122, 152, 182, 196) ; lors de la survenue d'un dysfonctionnement (110), extraire les données de journal (122, 152, 182, 196) journalisées dans un intervalle de temps (Δt) précédant le dysfonctionnement (110) ; déterminer au moyen d'une analyse statistique, une combinaison caractéristique d'attributs (112) qui comprend un ou plusieurs attributs caractéristiques de la combinaison extraite de données de journal (122, 152, 182, 196) ; stocker une attribution (108) de la combinaison caractéristique d'attributs (112) déterminée au dysfonctionnement (110) ; et surveiller les données de journal journalisées (122, 152, 182, 196), la surveillance, lors de la journalisation d'une combinaison de données de journal (122, 152, 182, 196) qui a la combinaison de caractéristiques d'attributs (112) stockée, consistant à prédire une survenue imminente du dysfonctionnement (110).
EP22711907.0A 2021-02-26 2022-02-22 Prédiction d'une survenue imminente d'un dysfonctionnement sur la base d'une analyse de données de journal Pending EP4298521A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102021104735.8A DE102021104735A1 (de) 2021-02-26 2021-02-26 Log-Daten Analyse
PCT/EP2022/054300 WO2022179996A1 (fr) 2021-02-26 2022-02-22 Prédiction d'une survenue imminente d'un dysfonctionnement sur la base d'une analyse de données de journal

Publications (1)

Publication Number Publication Date
EP4298521A1 true EP4298521A1 (fr) 2024-01-03

Family

ID=80928624

Family Applications (1)

Application Number Title Priority Date Filing Date
EP22711907.0A Pending EP4298521A1 (fr) 2021-02-26 2022-02-22 Prédiction d'une survenue imminente d'un dysfonctionnement sur la base d'une analyse de données de journal

Country Status (3)

Country Link
EP (1) EP4298521A1 (fr)
DE (1) DE102021104735A1 (fr)
WO (1) WO2022179996A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102022125396A1 (de) * 2022-09-30 2024-04-04 Bundesdruckerei Gmbh Vorhersage eines wiederholten Auftretens einer Funktionsstörung
DE102022125399A1 (de) 2022-09-30 2024-04-04 Bundesdruckerei Gmbh Detektieren eines Angriffs auf ein zu schützendes Computersystem

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8291264B2 (en) 2009-08-03 2012-10-16 Siemens Aktiengesellschaft Method and system for failure prediction with an agent
US10127125B2 (en) * 2016-10-21 2018-11-13 Accenture Global Solutions Limited Application monitoring and failure prediction

Also Published As

Publication number Publication date
DE102021104735A1 (de) 2022-09-01
WO2022179996A1 (fr) 2022-09-01

Similar Documents

Publication Publication Date Title
DE602004012900T2 (de) Verfahren zur Analyse von Leistungsinformation
DE69923435T2 (de) System und verfahren zur optimierung der leistungskontrolle von komplexen informationstechnologiesystemen
DE69525513T2 (de) Verfahren zum Aufzeigen von Wegen zur Verbesserung der Leistung von Computerdatenspeichersystemen
US7526508B2 (en) Self-managing database architecture
WO2022179996A1 (fr) Prédiction d'une survenue imminente d'un dysfonctionnement sur la base d'une analyse de données de journal
DE69523588T2 (de) Gerät und methode zur ereigniskorrelation und problemmeldung
DE112019001480B4 (de) Automatisches Optimieren der Ressourcennutzung in einemZieldatenbankverwaltungssystem zum Erhöhen der Arbeitslastleistung
DE112020004623T5 (de) Ml-basierte ereignishandhabung
DE10393571T5 (de) Verfahren und System zum Validieren logischer End-to-End-Zugriffspfade in Storage Area Netzwerken
DE112020005227T5 (de) Speicherzustandsüberwachung für differenziertedatenwiederherstellungskonfigurationen
DE112010004284T5 (de) Verfahren und System zum Verwalten von Sicherheitsobjekten
DE10211606A1 (de) Datenverarbeitungseinrichtung
DE102005020893A1 (de) System zur adaptiven Bestimmung von Operationseigenschaften einer ausführbaren Anwendung
EP2056201A2 (fr) Procédé, système de calcul et produit de programme informatique
DE112019003288T5 (de) Verwenden eines moduls mit maschinellem lernen, um zu ermitteln, wann eine fehlerprüfung eines speicherelements durchzuführen ist
DE112013006588T5 (de) Verwaltungssystem zum Verwalten eines Computersystems und Verwaltungsverfahren hierfür
DE112011100168T5 (de) Erfassen von Diagnosedaten in einer Datenverarbeitungsumgebung
DE112020004688T5 (de) Debuggen und erstellen von profilen von maschinenlernmodelltraining
DE102023116348A1 (de) Wiederherstellung von sicherungskopien aus einem entfernten speicher
DE102022125396A1 (de) Vorhersage eines wiederholten Auftretens einer Funktionsstörung
EP3367231A1 (fr) Procédé et système de stockage permettant de stocker une pluralité d'unités de données
EP2224340A1 (fr) Procédé et système de gestion concus pour configurer un système d'information dynamique ainsi que produit programme d'ordinateur
DE102023121499A1 (de) Gesundheitsbezogenes management eines netzes
DE68911719T2 (de) Verfahren und Vorrichtung, die schlechte Leistung eines Rechnersystemes diagnostisiert.
DE102022132369A1 (de) Erkennung und beseitigung von deadlocks in einem datenbankmanagementsystem

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20230926

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20240627