DETAILED ACTION
This office action is in response to applicant remarks filed on August 4, 2025 in application 18/166,243.
Claims 1-20 are presented for examination. Claims 1-2, 4-5, 8, 15 and 20 are amended.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed December 23, 2025 have been fully considered but they are not persuasive.
Applicant stated that Patthak et al. does not teach the first and the second similarly search. Examiner have clarified the newly amended claim limitations citations below. Refer below for further details.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-4, 6-8, 11-15, 18-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Diwanji et al. (US 2024/0135261) in further view of Patthak et al. (US 2016/0292592).
In regard to claim 1, Diwanji et al. teach a system, comprising:
at least one processor (computers, para. 59); and
at least one memory coupled to the at least one processor, comprising instructions that cause the processor to perform operations (memories, para. 60) comprising:
receiving a group of computer log entries that comprises letters in an alphabet (log write varies for different programming languages … log message comprising natural-language words and phrase as well as various types of text strings that represent file name, para. 91, fig. 14, normalizing using natural language processing, para. 105);
converting log entries of the group of computer log entries into respective first vectors that comprise numerical values (log messages obtained are embedded into log vectors in an embedding space, para. 131);
Diwanji et al. does not explicitly teach but Patthak et al. teach after performing the converting, performing a first similarity search among the first vectors to group the first vectors into respective groups of vectors identify respective different computer issues (a similarity comparison is then performed to classify the log and to generate classification results, fig. 15, para. 191-192);
performing machine learning on the respective groups of vectors to identify respective signatures of the respective different computer issues (implement machine learning-based classifications of logs according to some embodiments of the invention, fig. 16, para. 193-196);
representing the respective signatures of the respective different computer issues as respective third vectors, wherein the number of the third vectors corresponds to a number of the groups of vectors, and wherein the number of the third vectors corresponds to a number of the different computer issues (training data is organized by the data’s known log types, para. 198, the log data is vectorized on a log-type basis, each set of logs within a sub-directory for a given log type is transformed into a vector and plotted onto a coordinate space. From those vectors, clusters of vectors can be formed, para. 199);
after performing the first similarity search (after the training data is organized, fig. 17, para. 197-199), performing a second similarity search with respect to a second vector and the third vectors that correspond to the signature that correspond to the signatures of the different computer issues to identify a computer issue of the different computer issues exhibited by a computer device that has a log entry represented by the second vector, wherein the second vector is generated independently from the group of computer log entries and is generated after the representing of the respective signatures as the third vectors (similarly comparison is performed for the generated vector data …. known log data may have been used to construct comparison data, e.g., by vectorizing the sample data and constructing clusters for the sample data using an appropriate clustering algorithm. The similarly comparison is performed by comparing the vector data for the log under analysis to the vector data for the known samples, para. 209, fig. 20). It is noted that the first and third vector are the known samples and the second vector are the log under analysis; and
performing a remedial action with respect to the computing device to address the computer issue exhibited by the computing device (a corrective action engine may perform any necessary actions to be taken withing the customer network to attempt to bring the system back up, fig. 1B, 134, para. 59).
It would have been obvious to modify the system of Diwanji et al. by adding Patthak et al. machine learning classification. A person of ordinary skill in the art before the effective filing date of the claimed invention would have been motivated to make the modification because it would aid in classify logs (para. 40).
In regard to claim 2, Diwanji et al. does not explicitly teach but Patthak et al. teach the system of claim 1, wherein the group of computer log entries is a first group of computer log entries, and wherein the operations further comprise: filtering out at least some first log entries of the first group of computer log entries to produce a second group of computer log entries (first classifier may operate based upon vectors generated by the characters within the log, para. 190), wherein the second group of computer log entries comprises a group of unique log entries of the first group of computer log entries, wherein the filtering is distinct from combining first computer log entries of the first group of computer log entries, and wherein the converting of the log entries of the first group of computer log entries into the respective first vectors is performed on the second group of computer log entries (second classifier operated based upon vectors generated by identification of certain tokens within the log … pattern signatures check a log against that signature, para. 190) after performing the filtering (the logs 1501a-c may undergo filtering by a filter, para. 188).
Refer to claim 1 for motivational statement.
In regard to claim 3, Diwanji et al. does not explicitly teach but Patthak et al. teach the system of claim 1, wherein the respective groups of vectors are first respective groups of vectors, and wherein the operations further comprise: identifying third respective groups of vectors, wherein the third respective groups of vectors are drawn from the first respective groups of vectors and satisfy a defined criterion of meaningfulness with respect to identifying any devices that have a first computer issue (a known set of logs are used to form learning models 1505a and 1505b to identify characteristics of known log types, para. 187, fig. 15), and wherein the performing the machine learning is performed on the third respective groups of vectors (learning models for the known sets of logs, para. 192) It is noted that the group of first vector, from log entries, with same known computer issue is represented as third vectors.
Refer to claim 1 for motivational statement.
In regard to claim 4, Diwanji et al. teach the system of claim 1, wherein performing the first similarity search with respect to the first vectors to identify the respective groups of vectors comprises: determining respective Euclidean distances between respective pairs of vectors of the first vectors (similarity metrics between two word vectors, such as Euclidean distance or cosine similarity, provide a measure of the linguistic or semantic similarity of the corresponding words, para. 136).
In regard to claim 6, Diwanji et al. teach the system of claim 1, wherein a first portion of the group of computer log entries comprises first text in a first language, and wherein a second portion of the group of computer log entries comprises second text in a second language (log writes varies for different programming languages, para. 91).
In regard to claim 7, Diwanji et al. teach the system of claim 6, wherein a first vector of a first group of vectors of the groups of vectors corresponds to a first computer log entry of the group of computer log entries that comprises the first text in the first language, and wherein a second vector of the first group of vectors corresponds to a second computer log entry of the group of computer log entries that comprises the second text in the second language (log writes varies for different programming languages, log write instructions are determined by the developer and unstructured, or semi-structure, and relatively cryptic, para. 91, normalization and preprocessing of log messages aid in correcting errors, removes redundancies, and removes stop words and also identifies important words and convert words to fit a vocabulary of words, para. 105). It is noted that different programming languages log in various format and structures. The system of Diwanji et al. provide a navigable interface of groups of log messages.
In regard to claim 8, Diwanji et al. teach a method, comprising:
converting, by a system comprising a processor, log entries of a group of device log entries into respective first vectors that comprise numerical values (log messages obtained are embedded into log vectors in an embedding space, para. 131), wherein the group of device log entries comprises text drawn from an alphabet (log write varies for different programming languages … log message comprising natural-language words and phrase as well as various types of text strings that represent file name, para. 91, fig. 14, normalizing using natural language processing, para. 105).
Diwanji et al. does not explicitly teach but Patthak et al. teach after performing the converting, performing, by the system, a first similarity search with respect to the first vectors to create respective groups of vectors that identify a same know device issue (a similarity comparison is then performed to classify the log and to generate classification results, fig. 15, para. 191-192);
performing, by the system, machine learning on the respective groups of vectors to identify respective signatures of known device issues (implement machine learning-based classifications of logs according to some embodiments of the invention, fig. 16, para. 193-196), wherein the respective signatures of the known device issues correspond to respective third vectors, wherein a number of the third vectors corresponds to a number of the groups of vectors, and wherein the number of the third vectors corresponds to a number of the different computer issues (training data is organized by the data’s known log types, para. 198, the log data is vectorized on a log-type basis, each set of logs within a sub-directory for a given log type is transformed into a vector and plotted onto a coordinate space. From those vectors, clusters of vectors can be formed, para. 199);
performing, by the system, a second similarity search with respect to a second vector and the third vectors to identify a know device issue of the know device issues exhibited by a computing device that has a log entry represented by the second vector, wherein the second vector is generated independently from the group of computer log entries (similarly comparison is performed for the generated vector data …. known log data may have been used to construct comparison data, e.g., by vectorizing the sample data and constructing clusters for the sample data using an appropriate clustering algorithm. The similarly comparison is performed by comparing the vector data for the log under analysis to the vector data for the known samples, para. 209, fig. 20). It is noted that the first and third vector are the known samples and the second vector are the log under analysis; and
performing, by the system, a remedial action with respect to the computing device to address the computer issue exhibited by the computing device (a corrective action engine may perform any necessary actions to be taken withing the customer network to attempt to bring the system back up, fig. 1B, 134, para. 59).
Refer to claim 1 for motivational statement.
In regard to claim 11, Diwanji et al. teach the method of claim 8, further comprising: removing, by the system, duplicate text strings of respective log entries of the group of device log entries to produce de-duplication log entries, wherein the converting of the log entries into the respective first vectors is performed on the de-duplication log entries (normalization and preprocessing of log messages aid in correcting errors, removes redundancies, and removes stop words and also identifies important words and convert words to fit a vocabulary of words, para. 105).
In regard to claim 12, Diwanji et al. teach the method of claim 8, wherein the group of device log entries comprises the text drawn from the alphabet and numbers (log write varies for different programming languages … log message comprising natural-language words and phrase as well as various types of text strings that represent file name, para. 91, fig. 14, normalizing using natural language processing, para. 105).
In regard to claim 13, Diwanji et al. teach the method of claim 8, wherein the respective first vectors comprise respective one-dimensional vectors (event-type distribution of event types generated in adjacent time windows, fig. 27, para. 124-125).
In regard to claim 14, Diwanji et al. teach the method of claim 8, wherein the respective first vectors have a predefined length (word vectors correspond to the words in the corpus may be learned, word vectors may also be created as domain specific embedding of the NLP, the word vector may have elements (e.g. …Ne=100) and the embedding space may be a 100-dimensional space, para. 131-135).
In regard to claim 15, Diwanji et al. teach a non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:
converting log entries of a group of computer log entries into respective first vectors that comprise numerical values (log messages obtained are embedded into log vectors in an embedding space, para. 131).
Diwanji et al. does not explicitly teach but Patthak et al. teach after performing the converting, performing a first similarity search on the first vectors to group the first vectors into respective groups of vectors that identify a same know computer issue (a similarity comparison is then performed to classify the log and to generate classification results, fig. 15, para. 191-192);
performing machine learning on the respective groups of vectors (implement machine learning-based classifications of logs according to some embodiments of the invention, fig. 16, para. 193-196) to identify respective signatures of known computer issues that correspond to the respective groups (training data is organized by the data’s known log types, para. 198, the log data is vectorized on a log-type basis, each set of logs within a sub-directory for a given log type is transformed into a vector and plotted onto a coordinate space. From those vectors, clusters of vectors can be formed, para. 199),
performing a second similarity search with respect to a second vector with respect to third vectors that correspond to the signatures of the known computer issues to identify a computer issues exhibited by a computing device that has a log entry represented by the second vector, wherein the second vector is generated independently from the group of computer log entries (similarly comparison is performed for the generated vector data …. known log data may have been used to construct comparison data, e.g., by vectorizing the sample data and constructing clusters for the sample data using an appropriate clustering algorithm. The similarly comparison is performed by comparing the vector data for the log under analysis to the vector data for the known samples, para. 209, fig. 20). It is noted that the first and third vector are the known samples and the second vector are the log under analysis; and
performing a remedial action with respect to the computing device to address the computer issue (a corrective action engine may perform any necessary actions to be taken withing the customer network to attempt to bring the system back up, fig. 1B, 134, para. 59).
Refer to claim 1 for motivational statement.
In regard to claim 18, Diwanji et al. teach the non-transitory computer-readable medium of claim 15, wherein the group of computer log entries comprises telemetry data, and wherein the telemetry data comprises pairs of time stamp values and log entry values (log message often contains various parametric information such as timestamps, field values, and IP addresses ... log message also contain non-parametric tokens that describe the type of events, para. 105).
In regard to claim 19, Diwanji et al. teach the non-transitory computer-readable medium of claim 15, wherein the group of computer log entries is stored in documents that comprise human-readable text (log write instruction also include text strings and natural language words, para. 92, fig. 15).
In regard to claim 20, Diwanji et al. does not explicitly teach but Patthak et al. teach the non-transitory computer-readable medium of claim 15, wherein the operations further comprise: determining the remedial action before the performing of the remedial action with respect to the computing device to address the computer issue (a corrective action engine may perform any necessary actions to be taken withing the customer network to attempt to bring the system back up, fig. 1B, 134, para. 59).
Refer to claim 1 for motivational statement.
****************************
Claims 5 is/are rejected under 35 U.S.C. 103 as being unpatentable over Diwanji et al. (US 2024/0135261) in further view of Patthak et al. (US 2016/0292592) in further view of Bertoni Scarton et al. (US 2021/0240691).
In regard to claim 5, Diwanji et al. and Patthak et al. does not explicitly teach the system of claim 1, wherein performing the first similarity search with respect to the first vectors to identify the respective groups of vectors comprises: determining respective dot products between respective pairs of vectors of the first vectors.
Bertoni Scarton et al. teach of using the dot product of two vectors corresponding to consecutive log entries to determine the similarity (para. 42-44).
It would have been obvious to modify the system of Diwanji et al. and Patthak et al. by adding Bertoni Scarton et al. anomaly identification in log files. A person of ordinary skill in the art before the effective filing date of the claimed invention would have been motivated to make the modification because it would aid in determining cosine similarities (para. 43-44).
*******************************
Claim 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Diwanji et al. (US 2024/0135261) in further view of Patthak et al. (US 2016/0292592) in further view of Bigdelu et al. (US 2024/0143612).
In regard to claim 9, Diwanji et al. and Patthak et al. does not explicitly teach the method of claim 8, further comprising: ordering, by the system, text of respective log entries of the group of device log entries in an alphabetical order before converting the log entries into the respective first vectors.
Bigdelu et al. teach of for each token entry or field-value pair entry or unique identifiers can be listed in chronological order where entries can be sorted alphabetically (para. 150).
It would have been obvious to modify the system of Diwanji et al. and Patthak et al. by adding Bigdelu et al. using a field value for different fields. A person of ordinary skill in the art before the effective filing date of the claimed invention would have been motivated to make the modification because it would aid in providing various ways to sorting entries (para. 150).
*******************************
Claim 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Diwanji et al. (US 2024/0135261) in further view of Patthak et al. (US 2016/0292592) in further view of Bigdelu et al. (US 2024/0143612) in further view of Richter (SU 2015/0106663).
In regard to claim 10, Diwanji et al. teach the method of claim 9, wherein ordering the text of the respective log entries produces ordered texts, and further comprising: truncating, by the system, text entries of respective ordered texts of the ordered texts beyond a predefined threshold number before the converting of the log entries into the respective first vectors (preprocessing of log messages is executed so that the output of each processing element is the input of the next processing element, para. 106, normalization is executed using regular expressions that are constructed to extract parametric and non-parametric tokens, para. 107, simple regular expressions are combined to form larger regular expressions that match character strings of log messages and the parameter tokens and simple words are discarded from preprocessing log messages, leaving non-parametric tokens, para. 108).
Bigdelu et al. teach of truncating a character string into a different format (para. 174) but Diwanji et al., Patthak et al. and Bigdelu et al. does not explicitly teach wherein the truncating comprises removing respective truncated text from respective ends of the respective ordered texts after a fixed number of character strings of the respective ordered texts.
Richter teaches of truncating a logging string when a hashing algorithm only accept a string of a particular length (para. 41, fig. 6, 606).
It would have been obvious to modify the system of Diwanji et al., Patthak et al. and Bigdelu et al. by adding Richter hash labeling of logging messages. A person of ordinary skill in the art before the effective filing date of the claimed invention would have been motivated to make the modification because it would aid in providing acceptable string of a particular length (para. 41).
*******************************
Claims 16-17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Diwanji et al. (US 2024/0135261) in further view of Patthak et al. (US 2016/0292592) in further view of Sethi et al. (US 2022/0400060).
In regard to claim 16, Diwanji et al. and Patthak et al. does not explicitly teach the non-transitory computer-readable medium of claim 15, wherein the group of computer log entries is categorized in a group of tables that corresponds to device components, and wherein each table of the group of tables corresponds to a different device component of the device components.
Sethi et al. teach of a distinct or separate table generated for each of the current device states where the tables may be derived from telemetry data and device application logs (para. 57).
It would have been obvious to modify the system of Diwanji et al. and Patthak et al. by adding Sethi et al. asset state prediction. A person of ordinary skill in the art before the effective filing date of the claimed invention would have been motivated to make the modification because it would aid in providing separate tables for each device (para. 57).
In regard to claim 17, Diwanji et al. and Patthak et al. does not explicitly teach the non-transitory computer-readable medium of claim 16, wherein the at least one processor is at least one first processor, wherein a first table of the group of tables corresponds to at least one second processor of the device components, wherein a second table of the group of tables corresponds to a storage drive of the device components, and wherein a third table of the group of tables corresponds to memory tables of the device components.
Sethi et al. teach of a distinct or separate table generated for each of the current device states where the tables may be derived from telemetry data and device application logs (para. 57).
Refer to claim 16 for motivational statement.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTO 892.
Kolar et al. (US 2022/0353166) anomaly detection and correction
Frtunikj et al. (US 12,277,752) machine learning model
Zhu et al. (US 12,333,389) analyze data log with machine learning
*****************
Shoham (US 2018/0260446) character truncation for naming convention
Gilderman et al. (US 10,740,286) truncate a character set
Pei et al. (US 9,419,968) truncating a predefined number of characters/digits
Hussain et al. (US 12,164,406) error handling with vector representations
Xia (US 12,093,157) log events that match vector
Tarango et al. (US 12,072,781) monitoring of telemetry in the field
Gandhi et al. (US 2024/0143428) convert error message into an error vector
*****************
Auvenshine et al. (US 2018/0246777) problem analyzer include data log filter command
Levin et al. (US 2022/0086179) anomaly detection with vector generation with filter
Wainer (US 11853,415) log anomaly detection with log vectors
Riddell (US 11,163,731) convert log into vector
Sriharsha et al. (US 2022/0036177) filter logs into tokens into vector
*****************
Voisin et al. (US 12,008,058) classifying relevant natural language text
Dande et al. (US 2023/0367903) dot product for first and second vector
Hersche et al. (US 2023/0206057) neural network classification matrix
Chan et al. (US 2022/0179763) feature vector for similar grouping of history logs
Kumaresan et al. (US 2022/0171800) identify cluster signatures with natural language
Rosing et al. (US 2022/0019441) hypervector with dot product
Cohen et al. (US 2011/0185234) system event logs
Sabato et al. (US 2009/0113246) log transformed into vector
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to LOAN TRUONG whose telephone number is 408-918-7552. The examiner can normally be reached on 10AM-6PM PST M-F.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Thomas Ashish can be reached on 571-272-0631. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Loan L.T. Truong/Primary Examiner, Art Unit 2114 Loan.truong@uspto.gov
Prosecution Insights