DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
The amendment filed 03/13/2026 has been entered. Applicant has amended claims 1, 7-9, 11, and 15-18. Claim 10 and 20 has been cancelled. Claims 1-9, 11-19 and 21 are currently pending in the instant application.
Response to Arguments
Applicant’s arguments, see pages 9-10, filed 03/13//2026, with respect to the rejection(s) of claim(s) 1-9, 11-19 and 21 under 35 U.S.C. 103 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Sethi et al (US 2025/0021420). Sethi et al (US 2025/0021420) teaches the amended limitations as seen in the current rejection below.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Xu et al (US 2019/0354524) in view of Arrigoni et al (US 2024/0242031) and Sethi et al (US 2025/0021420).
Regarding claim 1, Xu teaches a computer-implemented method for log processing, comprising: obtaining log data ([0030] The multiple sets of historical logs (component) 110 assembles (or receives, retrieves, etc.) heterogeneous logs from arbitrary systems or software applications that produce logs to record system events, status or any other information. The heterogeneous logs are transported into architecture 100 (and multiple sets of historical logs (component) 110) via streaming process, message transporter, file transfer, or any appropriate manner of providing logs); creating a log template based on the obtained log data; identifying a parameter count in the log template ([0032] As shown in FIG. 2, original logs 305 and corresponding formats 310 are illustratively depicted in accordance with an embodiment of the present invention. The example original logs 305 and the corresponding log formats illustrate that the logs include a time stamp (with a date (e.g., 2018 Apr. 15) and a time (10:12:23)) as well as a base number (illustrated as 2341 and 382234 in original logs 305, base 16number:P1F1 and base 16number:P2F1 in log formats 310),);
Xu does not explicitly teach computing a score for a given log line within the log data that measures an estimated importance of the given log line, wherein the score is a function of the parameter count and the score is specific to the given log line;
Arrigoni teaches computing a score for a given log line within the log data that measures an estimated importance of the given log line, wherein the score is a function of the parameter count and the score is specific to the given log line; ([0086] - The categories are used to identify exceptions, keywords, and to extract severity levels, classes, and phrases. Each raw log line is then categorized according to the created categories. Finally, a sentiment score is generated for every log line based on the categorized data and identified phrases. In some examples, the sentiment score may correspond to an amount of interest. The sentiment score gives the user an ability to understand each log line based on an overall sentiment score. A more detailed process of using forensics will be described in further detail in FIGS. 6 and FIGS. 7.) ([0095] As shown in example 600, a basic user may not need sophisticated knowledge to read and interpret the raw log line. Instead, the created categories allow the most relevant data to be easily identified and extracted. The enhancement and enrichment of the different categories may also iterate and improve with time. Finally, the forensics process will also summarize the log line with a sentiment score generated based on the data from the categorizes..)
Accordingly, it would have been obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to have modified the teachings of Xu to include computing a score for a given log line within the log data that measures an estimated importance of the given log line, wherein the score is a function of the parameter count and the score is specific to the given log line; and storing the given log line to a storage location based on the score, wherein a different log line within the log data is stored to a different storage location based on a different computed score associated with the different log line.
as taught by Arrigoni. It would be advantageous to improve the efficiency of the log parsing while ensuring the accuracy of the log parsing as seen in cited sections of Arrigoni.
Xu in view Arrigoni does not explicitly teach determining whether to store the log line in long-term storage or short-term storage based on the score; and storing the given log line to either the long-term storage or the short-term storage location based on the determining.
Sethi teaches determining whether to store the log line in long-term storage or short-term storage based on the score [0221] Turning to the embodiment shown in FIG. 4.2, FIG. 4.2 shows a diagram of components of the system at a later point in time. Assume here that, based on the second determination performed in FIG. 4.1, the analyzer makes a third determination that App. A's RASS is less than a predetermined storage space limit (25 GB). Based on the result of the third determination, the analyzer notifies an administrator to initiate configuring of extra storage space for App. A's AL before extending the current AL retention period of
[0222] App. A. Once the extra storage space is configured (where the RASS for the AL of App. A is increased to 210 GB (underlined)), the analyzer extends the current AL retention period of App. A to 120 days (underlined) to provide long-term log data retention for App. A.
; and storing the given log line to either the long-term storage or the short-term storage location based on the determining ([0124] In one or more embodiments, the database (180) may be implemented using physical devices that provide data storage services (e.g., storing data and providing copies of previously stored data). The devices that provide data storage services may include hardware devices and/or logical devices. For example, the database (180) may include any quantity and/or combination of memory devices (i.e., volatile storage), long-term storage devices (i.e., persistent storage), other types of hardware devices that may provide short-term and/or long-term data storage services, and/or logical storage devices (e.g., virtual persistent storage/virtual volatile storage).).
Accordingly, it would have been obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to have modified the teachings of Xu in view of Arrigoni to include determining whether to store the log line in long-term storage or short-term storage based on the score; and storing the given log line to either the long-term storage or the short-term storage location based on the determining. It would be advantageous to improve the system's performance in scalability, and to provide an architecture that is extremely flexible to satisfy users' requirements as taught by Sethi [0019].
Regarding claim 2, Xu in view of Arrigoni and Sethi teaches the method of claim 1, Xu further teaches further comprising: determining a novelty factor for the given log line; and wherein computing the score is further based on the novelty factor ([0050] Log parsing against current global log formats (subcomponent) 1023 analyzes the new set of tokenized text log through the regular expression matching. The log format is represented by regular expression. Upon receiving a list of existing log formats, log parsing against current global log formats (subcomponent) 1023 matches the new logs against the list of regular expressions. Only those logs which are not matched to any of existing log formats will be the output to the log syntactic format generation on the unparsed text logs (subcomponent) 1024 for learning new log formats).
Regarding claim 3, Xu in view of Arrigoni and Sethi teaches the method of claim 1, Xu further teaches further comprising: determining a throughput rate for the given log line; and wherein computing the score is further based on the throughput rate ([0056] Frequency counting for each log format to obtain single time series (component) 1032 performs frequency counting for each log format. Each set of training historical logs contains multiple log messages that correspond to one distinct log format. Subcomponent extracts the time stamps for each log message. Users are required to provide a time range which specifies the size of time window (for example, time period) to count the log message frequencies. The time range parameter will be different for different information technology (IT) computing systems. Some systems, for example hardware component monitoring system, can require a larger time range to collect enough log messages to form a time series because the underlying system has slow dynamics. On the other Arrigonid, certain cloud computing system require a much smaller time range due to their fast dynamics. A system administrator (for example, automated or human) can provide this parameter to the log retrieval architecture 100 based on their domain expertise).
Regarding claim 4, Xu in view of Arrigoni and Sethi teaches the method of claim 3, Xu further teaches wherein a higher score is computed as a function of the throughput rate ([0056] Frequency counting for each log format to obtain single time series (component) 1032 performs frequency counting for each log format. Each set of training historical logs contains multiple log messages that correspond to one distinct log format. Subcomponent extracts the time stamps for each log message. Users are required to provide a time range which specifies the size of time window (for example, time period) to count the log message frequencies. The time range parameter will be different for different information technology (IT) computing systems. Some systems, for example hardware component monitoring system, can require a larger time range to collect enough log messages to form a time series because the underlying system has slow dynamics. On the other Arrigonid, certain cloud computing system require a much smaller time range due to their fast dynamics. A system administrator (for example, automated or human) can provide this parameter to the log retrieval architecture 100 based on their domain expertise).
Regarding claim 5, Xu in view of Arrigoni and Sethi teaches the method of claim 3, Xu further teaches wherein a higher score is computed as an inverse function of the throughput rate ([0068] Compute similarity distance between two sets of multivariate time series (component) 2042 calculates the similarity distance between the query log multivariate time series and (every) historical log multivariate time series (stored in the database 125). Because the multivariate time series is represented by the term frequencies for each log format, therefore compute similarity distance between two sets of multivariate time series 2042 uses cosine distance to measure the similarity between two single-variate time series with the same log format IDs. Where two single-variate time series of attributes, A and B, the cosine similarity, cos(θ)).
Regarding claim 6, Xu in view of Arrigoni and Sethi teaches the method of claim 1, Xu further teaches further comprising: obtaining at least one keyword; and wherein computing the score is further based on a number of occurrences of the at least one keyword in the obtained log data ([0070] Because term frequencies are positive numbers, therefore, the value of cos(θ) ranges between 0 and 1 with 0 being least similar and 1 being identical. Component 2042 repeats this procedure for every available pair of time series with the same log format IDs. If there are some log formats only existing in one set of logs, then the cos(θ) will be zero. Then the final similarity score will be summation of all similarity distances divided by the total number of distinct log formats between any two sets of multivariate time series. The compute similarity distance between two sets of multivariate time series component 2042 will compute similarity for each historical log set against the query log multivariate time series).
Regarding claim 7, Xu in view of Arrigoni and Sethi teaches the method of claim 1, Sethi further teaches wherein the determining comprises determining to store the given log line in a short-term first-in first-out (FIFO) storage in response to the score being below a predetermined threshold, and wherein the storing comprises storing the given log line in the short-term FIFO storage [0221] Turning to the embodiment shown in FIG. 4.2, FIG. 4.2 shows a diagram of components of the system at a later point in time. Assume here that, based on the second determination performed in FIG. 4.1, the analyzer makes a third determination that App. A's RASS is less than a predetermined storage space limit (25 GB). Based on the result of the third determination, the analyzer notifies an administrator to initiate configuring of extra storage space for App. A's AL before extending the current AL retention period of
[0222] App. A. Once the extra storage space is configured (where the RASS for the AL of App. A is increased to 210 GB (underlined)), the analyzer extends the current AL retention period of App. A to 120 days (underlined) to provide long-term log data retention for App. A.
Regarding claim 8, Xu in view of Arrigoni and Sethi teaches the method of claim 7, Sethi further teaches wherein the determining comprises determining to store the given log line in the long-term storage in response to the score being above a predetermined threshold, and wherein the storing comprises storing the given log line in the long-term storage [0221] Turning to the embodiment shown in FIG. 4.2, FIG. 4.2 shows a diagram of components of the system at a later point in time. Assume here that, based on the second determination performed in FIG. 4.1, the analyzer makes a third determination that App. A's RASS is less than a predetermined storage space limit (25 GB). Based on the result of the third determination, the analyzer notifies an administrator to initiate configuring of extra storage space for App. A's AL before extending the current AL retention period of
[0222] App. A. Once the extra storage space is configured (where the RASS for the AL of App. A is increased to 210 GB (underlined)), the analyzer extends the current AL retention period of App. A to 120 days (underlined) to provide long-term log data retention for App. A.
Regarding claim 9, Xu in view of Arrigoni and Sethi teaches the method of claim 8, Xu further teaches further comprising: in response to the score above a second predetermined threshold: storing a first plurality of log lines that temporally precede the log line, in the long-term storage; and storing a second plurality of log lines that temporally follow the log line in the long-term storage ([0079] Referring now to FIG. 10, a block diagram illustrating a component for update model databases 206 is depicted in accordance with an embodiment of the present invention).
Claims 11-19 are rejected using similar reasoning seen in the rejection of claims 1-10 due to reciting similar limitations but directed towards different statutory categories.
Claim(s) 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Xu et al (US 2019/0354524) in view of Arrigoni et al (US 2024/0242031) as applied to claim 1 above, and further in view of Rodriguez Bravo (US 11,853,173).
Regarding claim 21, Xu in view of Arrigoni and Sethi teaches The method of claim 1, Xu in view of Arrigoni does not teach wherein the given log line is stored in a real-time buffer until it is scored, wherein the real-time buffer stores log lines as they arrive.
Rodriguez Bravo teaches wherein the given log line is stored in a real-time buffer until it is scored, wherein the real-time buffer stores log lines as they arrive (Col 15 lines 1-15 FIG. 8 is a block diagram 800 indicating processing flow of log files in accordance with embodiments of the present invention. A computer system 802 generates multiple log files, indicated as 804-814. Log file 804 is the currently analyzed log file, generated at time t. Log file 806 is generated at time t-1. Log file 808 is generated at time t-2. Log file 810 is generated at time t-3. Log file 812 is generated at time t-4. Log file 814 is generated at time t-5. In embodiments, the log files can be generated at periodic intervals, such as every hour, every day, etc. In some embodiments, a new log file is generated when the existing log file reaches a size limit (e.g., 500 KB). In some embodiments, a window 820 defines a collection of previously generated log files. In embodiments, the collection of previously generated log files in window 820 (as shown in FIGS. 8, 810, 808, and 806), is compared against the training log files 832, 834, and 836, which comprise training set 840. )
Accordingly, it would have been obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to have modified the teachings of Xu in view of Arrigoni to include wherein the given log line is stored in a real-time buffer until it is scored, wherein the real-time buffer stores log lines as they arrive as taught by Rodriguez Bravo . It would be advantageous since it allows the most recent log data to be analyze and the system to not drift as seen in the cited sections of Rodriguez Bravo.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAMUEL SHARPLESS whose telephone number is (571)272-1521. The examiner can normally be reached M-F 7:30 AM- 3:30 PM (ET).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, ALEKSANDR KERZHNER can be reached at 571-270-1760. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/S.C.S./Examiner, Art Unit 2165
/ALEKSANDR KERZHNER/Supervisory Patent Examiner, Art Unit 2165
Prosecution Insights