Log analysis in vector space

Abstract

The disclosed embodiments provide for identification of a remedial action based on analysis of a system log file. In some example embodiments, messages from the system log file are used as input to generate vectors within a vector space. Portions of the log messages may generate vectors that cluster into a region in the vector space. The region of vector space is associated with one or more remedial actions. The disclosed embodiments are configured, in some example embodiments, to perform the one or more remedial actions when activity in the log file maps to the region of vector space associated with the one or more remedial actions. In some example embodiments, a remedial action can include submitting a problem report to a problem tracking database.

What is claimed is: 
     
         1 . A method, comprising:
 generating, by one or more processors, a message block vector based on a plurality of messages generated by a wireless device;   determining, by the one or more processors, if the message block vector is within a message block cluster associated with a nominal performance or an exception condition of a wireless network; and   invoking, by the one or more processors, a remedial action associated with the message block cluster based on the determination that the message block vector is within the message block cluster.   
     
     
         2 . The method of  claim 1 , wherein generating the message block vector based on the plurality of messages generated by the wireless device comprises grouping related messages of the plurality of messages based on at least one of an arrival time of each of the related messages, a generation time of each of the related messages, contents of each of the related messages, or one or more components of the wireless device that generated the related messages. 
     
     
         3 . The method of  claim 1 , wherein generating the message block vector based on the plurality of messages generated by the wireless device comprises:
 filtering each of the plurality of messages;   providing the filtered messages to a machine learning model to generate at least one message vector based on the filtered messages; and   generating, by the machine learning model, the message block vector based on an association of the at least one message vector to a message block, wherein the association of the at least one message vector to the message block is based on one or more criterion.   
     
     
         4 . The method of  claim 3 , wherein the one or more criterion comprises a starting criterion for the message block, a maintaining criterion for the message block, or a termination criterion for the message block. 
     
     
         5 . The method of  claim 1 , wherein the plurality of messages generated by the wireless device comprises a plurality of log messages received from one of a plurality of access point (AP) devices. 
     
     
         6 . The method of  claim 1 , wherein the message block cluster includes a message block cluster definition of a volume within a multi-dimensional volume in vector space. 
     
     
         7 . The method of  claim 1 , wherein determining if the message block vector is within the message block cluster comprises projecting message vectors of the message block vector into a vector space associated with the remedial action. 
     
     
         8 . The method of  claim 1 , wherein invoking the remedial action comprises determining a root cause associated with the message block cluster. 
     
     
         9 . The method of  claim 1 , wherein invoking the remedial action includes at least one of invoking a restart of a transmitter of the wireless device, changing operating parameters of the wireless device, upgrading software executing on the wireless device, opening an issue report in an issue tracking database, or notifying a system administrator. 
     
     
         10 . The method of  claim 1 , further comprising:
 generating, by the one or more processors, a message vector including N dimensions for the message block vector, wherein a value of each dimension is generated based on one or more features of a message of the plurality of messages.   
     
     
         11 . The method of  claim 10 , wherein the one or more features of the message include a frequency of the message, a relative position of the message within a message block, a timing between the message and a preceding message, one or more fields of the message, or an entirety of the message. 
     
     
         12 . A system, comprising:
 a plurality of access point (AP) devices; and   a network management system comprising at least one processor configured to:
 generate a message block vector based on a plurality of messages generated by a wireless device; 
 determine if the message block vector is within a message block cluster associated with a nominal performance or an exception condition of a wireless network; and 
 invoke a remedial action associated with the message block cluster based on the determination that the message block vector is within the message block cluster. 
   
     
     
         13 . The system of  claim 12 , wherein to generate the message block vector, the at least one processor is configured to group related messages of the plurality of messages based on at least one of an arrival time of each of the related messages, a generation time of each of the related messages, contents of each of the related messages, or one or more components of the wireless device that generated each of the related messages. 
     
     
         14 . The system of  claim 12 , wherein to generate the message block vector, the at least one processor is configured to:
 filter each of the plurality of messages;   provide the filtered messages to a machine learning model to generate at least one message vector based on the filtered messages; and   generate, by the machine learning model, the message block vector based on an association of the at least one message vector to a message block, wherein the association of the at least one message vector to the message block is based on one or more criterion.   
     
     
         15 . The system of  claim 12 , wherein the message block cluster includes a message block cluster definition of a volume within a multi-dimensional volume in vector space. 
     
     
         16 . The system of  claim 12 , wherein to determine if the message block vector is within the message block cluster, the at least one processor is configured to project message vectors of the message block vector into a vector space associated with the remedial action. 
     
     
         17 . The system of  claim 12 , wherein to invoke the remedial action, the at least one processor is configured to determine a root cause associated with the message block cluster. 
     
     
         18 . Non-transitory computer readable storage media comprising instructions that when executed configure hardware processing circuitry to:
 generate a message block vector based on a plurality of messages generated by a wireless device;   determine if the message block vector is within a message block cluster associated with a nominal performance or an exception condition of a wireless network; and   invoke a remedial action associated with the message block cluster based on the determination that the message block vector is within the message block cluster.   
     
     
         19 . The non-transitory computer readable storage media of  claim 18 , wherein to generate the message block vector, the hardware processing circuitry is configured to:
 filter each of the plurality of messages;   provide the filtered messages to a machine learning model to generate at least one message vector based on the filtered messages; and   generate, by the machine learning model, the message block vector based on an association of the at least one message vector to a message block, wherein the association of the at least one message vector to the message block is based on one or more criterion.   
     
     
         20 . The non-transitory computer readable storage media of  claim 18 , wherein to determine if the message block vector is within the message block cluster, the hardware processing circuitry is configured to project message vectors of the message block vector into a vector space associated with the remedial action.