Management of Log Data in a Networked System

Abstract

A method for managing log messages in a system includes identifying a log message having a data value, filtering a first data value from a historical log record for a first interval, predicting whether any particular system events should occur when the first data value is filtered from a received log record and identifying the corresponding system events, initiating a second interval while filtering the first data value from a received log record, determining whether any non-predicted system events have occurred, and removing the filter for the first data value responsive to determining that a non-predicted system event has occurred.

What is claimed is: 
     
         1 . A method for managing log messages in a system, the method comprising:
 identifying a log message having a data value;   filtering a first data value from a historical log record for a first interval;   predicting whether any particular system events should occur when the first data value is filtered from a received log record and identifying the corresponding system events;   initiating a second interval while filtering the first data value from a received log record;   determining whether any non-predicted system events have occurred; and   removing the filter for the first data value responsive to determining that a non-predicted system event has occurred.   
     
     
         2 . The method of  claim 1 , further comprising:
 determining whether any predicted system events have not occurred responsive to determining that a non-predicted system event has not occurred; and   removing the filter for the data value responsive to determining that a predicted system events has not occurred.   
     
     
         3 . The method of  claim 2 , further comprising suppressing the data value from a stage in the message propagation pipeline responsive to determining that no predicted system events have not occurred. 
     
     
         4 . The method of  claim 3 , wherein the suppressing the data value from a stage in the message propagation pipeline includes modifying a portion of executable code that originated the log message having the data value to cease sending log messages having the data value. 
     
     
         5 . The method of  claim 3 , wherein the suppressing the data value from a stage in the message propagation pipeline includes issuing a command to an application that originated the log message having the data value to cease sending log messages having the data value. 
     
     
         6 . The method of  claim 3 , wherein the suppressing the data value from a stage in the message propagation pipeline includes issuing a command to a console to cease displaying log messages having the data value. 
     
     
         7 . The method of  claim 1 , wherein the first data value is associated with a log message. 
     
     
         8 . A computer system for manage log messages, the system comprising a processor that is operative to identify a log message having a data value, filter a first data value from a historical log record for a first interval, predict whether any particular system events should occur when the first data value is filtered from a received log record and identifying the corresponding system events, initiate a second interval while filtering the first data value from a received log record, determine whether any non-predicted system events have occurred, and remove the filter for the data value responsive to determining that a non-predicted system event has occurred. 
     
     
         9 . The system of  claim 7 , wherein the processor is further operative to determine whether any predicted system events have not occurred responsive to determining that a non-predicted system event has not occurred, and remove the filter for the data value responsive to determining that a predicted system events has not occurred. 
     
     
         10 . The system of  claim 9 , wherein the further operative to suppress the data value from a stage in the message propagation pipeline responsive to determining that no predicted system events have not occurred. 
     
     
         11 . The system of  claim 10 , wherein the suppressing the data value from a stage in the message propagation pipeline includes modifying a portion of executable code that originated the log message having the data value to cease sending log messages having the data value. 
     
     
         12 . The system of  claim 10 , wherein the suppressing the data value from a stage in the message propagation pipeline includes issuing a command to an application that originated the log message having the data value to cease sending log messages having the data value. 
     
     
         13 . The system of  claim 10 , wherein the suppressing the data value from a stage in the message propagation pipeline includes issuing a command to a console to cease displaying log messages having the data value. 
     
     
         14 . The system of  claim 10 , wherein the system includes a plurality of central processing units. 
     
     
         15 . A computer program product for managing log records, the computer program product comprising:
 a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:   identifying a log message having a data value;   filtering a first data value from a historical log record for a first interval;   predicting whether any particular system events should occur when the first data value is filtered from a received log record and identifying the corresponding system events;   initiating a second interval while filtering the first data value from a received log record;   determining whether any non-predicted system events have occurred; and   removing the filter for the data value responsive to determining that a non-predicted system event has occurred.   
     
     
         16 . The computer program product of  claim 15 , wherein the method further comprises:
 determining whether any predicted system events have not occurred responsive to determining that a non-predicted system event has not occurred; and   removing the filter for the data value responsive to determining that a predicted system events has not occurred.   
     
     
         17 . The computer program product of  claim 16 , wherein the method further comprises suppressing the data value from a stage in the message propagation pipeline responsive to determining that no predicted system events have not occurred. 
     
     
         18 . The computer program product of  claim 17 , wherein the suppressing the data value from a stage in the message propagation pipeline includes modifying a portion of executable code that originated the log message having the data value to cease sending log messages having the data value. 
     
     
         19 . The computer program product of  claim 17 , wherein the suppressing the data value from a stage in the message propagation pipeline includes issuing a command to an application that originated the log message having the data value to cease sending log messages having the data value. 
     
     
         20 . The computer program product of  claim 17 , wherein the suppressing the data value from a stage in the message propagation pipeline includes issuing a command to a console to cease displaying log messages having the data value.