DETAILED ACTION
Claims 1, 13, 14, 17 and 20 have been amended.
Claims 1-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 04/06/26 has been entered.
Response to Arguments
Applicant’s arguments with respect to the 103 rejection of claim 1 (see applicant’s arguments; pages 10-12) have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
In particular, the examiner no longer relies upon George, and has introduced Kaushal to disclose the amended limitation “modifying, by the process and based on the user selection and user feedback comprising a user rating of an element of the visualization”, as shown in the rejection below.
Further, with respect to the 103 rejection of claims 4, 10, 12 and 13, the applicant states that Hinterbichler does not cure the deficiencies of Kumaresan and George in view of amended claim 1 (see applicant’s remarks; pages 19 and 20). As discussed above, the examiner has introduced Kaushal to disclose the amended claim 1, as shown in the rejection below.
Applicant’s arguments with respect to the 103 rejection of claim 17 (see applicant’s arguments; pages 12-15) have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
In particular, the examiner has introduced Johnston to disclose the amended limitation “wherein the log template is determined based on a parsing tree that encodes nodes of the parsing tree with constant tokens of the network monitoring log messages to create the log template”, as shown in the rejection below.
Applicant’s arguments with respect to the 103 rejection of claim 20 (see applicant’s arguments; pages 16-19) have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
In particular, the examiner no longer relies upon George, and has introduced Chen to disclose the amended limitation “modify based on the user selection and user feedback comprising a customized log template for log message mapping, generation of subsequent visualizations of log templates such that the subsequent visualizations incorporate the customized log template”, as shown in the rejection below.
Claim Interpretation
Regarding claims 1, 13, 17 and 20, the claims recite alternative language, i.e. using the term “or”, and as such, the Examiner interprets certain features to not be required due to the claim language listing the features in the alternative. The rejection below specifies the particular limitations.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-3, 5-9, 11 and 14-16 are rejected under 35 U.S.C. 103 as being unpatentable over Kumaresan et al. (U.S. 2021/0027503 A1) in view of Kaushal et al. (U.S. 12,585,642 B2).
Regarding claim 1, Kumaresan discloses a method, comprising:
determining, by a process, a log template mapped from network monitoring log messages (see Kumaresan; paragraphs 0038, 0040, 0041 and 0069; Kumaresan discloses a log analytics system, i.e. “a process”, implemented as a set of mechanisms and/or modules, performs, i.e. “determining”, collection and analysis of log data, i.e. “log messages”, from log monitoring, i.e. “from network monitoring log messages”, such as, the format of the log in log records, i.e. “log template mapped”);
generating, by the process, a visualization of the log template including interactive graphical representations of a detection frequency for the log template (see Kumaresan; paragraphs 0038, 0066, 0072, and 0073; Kumaresan discloses the analytics system, i.e. “the process”, implemented as mechanisms and/or modules, provides a user interface that allows a user to interact, i.e. “interactive”, with the log analytics system that provides a sample of the log records, i.e. “log template”, visually depicted, i.e. “graphical representations”, as the quantity of log messages changing during a time series, “detection frequency…”, over a parallel coordinate axis so that the user is able to recognize distribution values across the log records, i.e. “…for the log template”), a frequency distribution of parameter values per parameter for the log template (see Kumaresan; paragraphs 0073, 0079, 0084 and 0092; Kumaresan discloses the parallel coordinate axis provides representation of distribution and variation of values, including parameters, to identify any time patterns, i.e. “a frequency distribution”, that exist between each parameter, i.e. “parameter values per parameter…”, of the log record, i.e. “…for the log template”), and relationships between parameter values across different parameters for the log template (see Kumaresan; paragraphs 0073, 0084 and 0092; Kumaresan discloses the visual depiction of a set of paths for the log record over the parallel coordinate axis for a parallel coordinate chart enables the user to recognize the distribution and variation of values, including parameters, i.e. “different parameters”, across the same data fields of multiple log records, i.e. “relationships between parameter values…”. In other words, the axis in the parallel coordinate chart represents a relationship between parameter values by showing the variation of parameter values across the same data fields. The examiner notes that the examiner’s interpretation of a parallel coordinate axis of a parallel coordinate chart representing relationships between parameter values is supported by the applicant’s specification where it states relationships between parameter values across different parameters is shown in an axis of a parameter parallel coordinate chart; see applicant’s specification as filed; page 20 lines 9-17);
filtering, by the process, data included in the visualization based on a user selection of a portion of a particular graphical representation (see Kumaresan; paragraphs 0079, 0080 and 0088; Kumaresan discloses the analytics system, i.e. “the process”, enables the user to highlight a portion of a coordinate axis, i.e. “user selection of a portion of a particular graphical representation”, for visualization of only the parameter values of the selected portion, i.e. “filtering…data”).
While Kumaresan discloses “the visualization”, Kumaresan does not explicitly disclose modifying, by the process and based on the user selection and user feedback comprising a user rating of an element of the visualization, generation of subsequent visualizations of log templates such that the subsequent visualizations are better aligned with user preferences for visualizations of the log template.
In analogous art, Kaushal discloses modifying, by the process and based on the user selection and user feedback comprising a user rating of an element of the visualization (see Kaushal; column 15 lines 14-15 and 49-58; Kaushal discloses a customized, i.e. “modifying…”, log data report, i.e. “visualization”, that is created by a user providing feedback on filters, i.e. “an element of the visualization”, that were applied to the log. For example, the user can inspect the filters and indicate, i.e. “a user rating”, if they are accurate or not. In other words, the user’s indication is rating whether the filters are accurate or not), generation of subsequent visualizations of log templates such that the subsequent visualizations are better aligned with user preferences for visualizations of the log template (see Kaushal; column 15 lines 9-15 and 49-58; Kaushal discloses subsequent visualizations for a customized log data report based on the user feedback on whether the filters are accurate or not. In other words, based on the user’s feedback, the subsequent visualizations are accurate with what the user wants to see, i.e. “aligned with the user’s preferences”).
One of ordinary skill in the art would have been motivated to combine Kumaresan and Kaushal because they both disclose features of visualization of log data, and as such, are within the same environment.
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to incorporate the feature of a customized report of log data as taught by Kaushal into the system of Kumaresan in order to provide the benefit of improved user experience by allowing any modifications to the data fields in the parallel coordinate chart (see Kumaresan; paragraph 0092) to include filters and user feedback to promote accuracy for any subsequent visualizations of a log data report (see Kaushal; column 15 lines 9-15 and 53-58).
Regarding claim 2, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein an interactive graphical representation of the relationships between parameter values across the different parameters for the log template is a parallel coordinate chart (see Kumaresan; paragraphs 0073, 0084 and 0092; Kumaresan discloses the visual depiction of a set of paths for the log record over the parallel coordinate axis for a parallel coordinate chart enables the user to recognize the distribution and variation of values, including parameters, i.e. “different parameters”, across the same data fields of multiple log records, i.e. “relationships between parameter values…”. In other words, the axis in the parallel coordinate chart represents a relationship between parameter values by showing the variation of parameter values across the same data fields).
Regarding claim 3, Kumaresan and Kaushal disclose all the limitations of claim 2, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein a graphical property of connecting elements between the parameter values across the different parameters corresponds to a frequency of a corresponding parameter combination in the log template (see Kumaresan; paragraphs 0073, 0079, 0084 and 0092; Kumaresan discloses the parallel coordinate axis provides representation of distribution and variation of values, including parameters, i.e. “different parameters”, to identify any time patterns, i.e. “frequency of a corresponding parameter combination”, that exist between each parameter of the log record, i.e. “…in the log template”).
Regarding claim 5, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein a portion of the parameter values are categorical (see Kumaresan; paragraphs 0088 and 0089; Kumaresan discloses the user can perform operations, such as, labeling, i.e. “categorical”, parameter values on highlighted portions corresponding to the parameter values, i.e. “a portion of the parameter values”, on the parallel coordinate axis).
Regarding claim 6, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses further comprising: disabling, based on the user selection indicating that a particular parameter is irrelevant, a graphical representation of a frequency distribution of a particular parameter value for the log template and a graphical representation of a relationship between parameter values for that particular parameter for the log template (see Kumaresan; paragraphs 0073, 0079, 0084 and 0092; Kumaresan discloses the parallel coordinate axis provides representation of distribution and variation of values, including parameters, to identify any time patterns, i.e. “a frequency distribution”, that exist between each parameter, i.e. “parameter values”, of the log record, i.e. “…for the log template” and the user is able to over-ride, i.e. “disabling…indicating that a particular parameter is irrelevant”, some of the selection of parameter values such that the parallel coordinate axis does not show the selection of parameter values for the time patterns, i.e. “graphical representation of a frequency distribution”, and the distribution and variation between the selected parameter values, i.e. “a graphical representation of a relationship between parameter values for that particular parameter”).
Regarding claim 7, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein the user selection of the portion of the particular graphical representation includes a selection of a region of the particular graphical representation corresponding to a specific time window (see Kumaresan; paragraphs 0066, 0079, 0080, 0084 and 0088; Kumaresan discloses evaluation of the log data for a time series, i.e. “specific time window”, and the analytics system enables the user to highlight a portion of a coordinate axis, i.e. “a selection of a region of the particular graphical representation”, for visualization of only the parameter values of the selected portion for that time to identify any existing time patterns).
Regarding claim 8, Kumaresan and Kaushal disclose all the limitations of claim 7, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein filtering the data included in the visualization includes highlighting a region of another graphical representation that corresponds to the specific time window (see Kumaresan; paragraphs 0066, 0079, 0080, 0084 and 0088; Kumaresan discloses enabling the user to highlight a portion of a different coordinate axis, i.e. “highlighting a region of another graphical representation”, for visualization of only the parameter values of the selected portion for a time series, i.e. “specific time window”, to identify any existing time patterns).
Regarding claim 9, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein the user selection of the portion of the particular graphical representation includes a selection of parameter value ranges within the particular graphical representation (see Kumaresan; paragraphs 0074, 0079 and 0080; Kumaresan discloses user highlighting portions of the coordinate axis, i.e. “particular graphical representation”, corresponding to variations, i.e. “ranges”, in the parameter values).
Regarding claim 11, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein the user selection of the portion of the particular graphical representation includes a selection of a first region of the particular graphical representation corresponding to a first specific time window and a section of a second region of the particular graphical representation corresponding to a second specific time window (see Kumaresan; paragraphs 0066, 0079, 0080, 0084 and 0088; Kumaresan discloses evaluation of the log data for different time series, i.e. “first specific time window” and “second specific time window”, and the analytics system enables the user to highlight a portion of different coordinate axis, i.e. “a selection of a first region…” and “a selection of a second region”…“of the particular graphical representation”, for visualization of only the parameter values of the selected portion for each time series to identify any existing time patterns).
Regarding claim 14, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses further comprising: modifying, for the subsequent visualizations and based on the user rating of the element of the visualization,, an inferential data model utilized to identify constant and parametric components within network monitoring log messages for log template mapping (see Kumaresan; paragraphs 0047, 0079 and 0080; Kumaresan discloses modifying clustering of the log record, i.e. “for log template mapping”, to identify duration and parameter values, i.e. “constant and parametric components”, using k-mean clustering, mean-shift clustering, expectation-maximizing clustering or any clustering algorithm, i.e. “inferential data model”; and further Kaushal discloses subsequent visualizations for a customized log data report based on the user feedback on whether the filters are accurate or not “based on the user rating of the element of the visualization”; see column 15 lines 9-15 and 49-58).
The prior art used in the rejection of the current claim is combined using the same motivation as was applied in claim 1.
Regarding claim 15, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein determining the log template mapped from network monitoring log messages comprises: processing the network monitoring log messages to determine one or more repeating constant portions across the network monitoring log messages and information that is specific to each network monitoring log message (see Kumaresan; paragraphs 0038, 0040, 0041 and 0066; Kumaresan discloses a log analytics system performs collection and analysis of log data, i.e. “log messages”, from log monitoring, i.e. “network monitoring log messages” on a periodic basis to identify patterns, i.e. “repeating constant portions”, in the log data and information corresponding to the log messages); and identifying the one or more repeating constant portions as the log template and the information that is specific to each network monitoring log message as parameters of the log template (see Kumaresan; paragraphs 0040, 0041, 0066 and 0079; Kumaresan discloses identifying patterns, i.e. “identifying the one or more repeating constant portions”, in the log data and information, such as parameter values, i.e. “the information…as parameters of the log template”, corresponding to the log messages).
Regarding claim 16, Kumaresan and Kaushal disclose all the limitations of claim 15, as discussed above, and further the combination of Kumaresan and Kaushal clearly discloses wherein identifying is based on a parsing tree that encodes nodes of the parsing tree with constant tokens of the network monitoring log messages to create the log template (see Kumaresan; paragraphs 0061, 0071, 0076, 0096 and 0102; Kumaresan discloses undergoing a parse stage where the log entries are parsed using a decision tree, i.e. “parsing tree”, which includes one or more nodes, i.e. “encodes nodes”, for each log message of the log record, i.e. “to create the log template”. Further, the network can be implemented as a token-ring, as such, having “constant tokens of the network monitoring log messages”).
Claims 4, 10 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Kumaresan et al. (U.S. 2021/0027503 A1) in view of Kaushal et al. (U.S. 12,585,642 B2), as applied to claim 1 above, and further in view of Hinterbichler et al. (U.S. 2014/0282031 A1).
Regarding claim 4, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and while the combination of Kumaresan and Kaushal disclose “visualization of the log template”, as discussed above, the combination of Kumaresan and George does not explicitly disclose wherein the visualization of the log template further includes a log table for each of the network monitoring log messages included in the interactive graphical representations
In analogous art, Hinterbichler discloses wherein the visualization of the log template further includes a log table for each of the network monitoring log messages included in the interactive graphical representations (see Hinterbichler; paragraphs 0016, 0020 and 0022; Hinterbichler discloses the interactive visualization of the log messages in certain format, i.e. “log template”, includes a log area, i.e. “a log table”, that displays a plurality of log messages generated over a period of time).
One of ordinary skill in the art would have been motivated to combine Kumaresan, Kaushal and Hinterbichler because they all disclose features of analyzing log data, and as such, are within the same environment.
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to incorporate the feature of modifying the display of log data representation as taught by Hinterbichler into the combined system of Kumaresan and Kaushal in order to provide the benefit of improved user experience by allowing any modifications to the data fields in the parallel coordinate chart (see Kumaresan; paragraph 0092) to be accurately represented corresponding to the log records (see Kumaresan; paragraph 0085).
Regarding claim 10, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above. The combination of Kumaresan and Kaushal does not explicitly disclose further comprising: updating a log table included in the visualization to depict only log message data with parameter values within selected parameter value ranges.
In analogous art, Hinterbichler discloses further comprising: updating a log table included in the visualization to depict only log message data with parameter values within selected parameter value ranges (see Hinterbichler; paragraphs 0020, 0022, 0027 and 0037; Hinterbichler discloses a log area, i.e. “a log table”, that displays a plurality of log messages generated over a period of time and can be modified, i.e. “updating a log table”, to include variation of values for data fields, i.e. “parameter value ranges”).
One of ordinary skill in the art would have been motivated to combine Kumaresan, Kaushal and Hinterbichler because they all disclose features of analyzing log data, and as such, are within the same environment.
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to incorporate the feature of modifying the display of log data representation as taught by Hinterbichler into the combined system of Kumaresan and Kaushal in order to provide the benefit of improved user experience by allowing any modifications to the data fields in the parallel coordinate chart (see Kumaresan; paragraph 0092) to be accurately represented corresponding to the log records (see Kumaresan; paragraph 0085).
Regarding claim 12, Kumaresan and Kaushal disclose all the limitations of claim 11, as discussed above. Further, the combination of Kumaresan and Kaushal clearly discloses the frequency distribution of parameter values per parameter for the log template (see Kumaresan; paragraphs 0073, 0079, 0084 and 0092; Kumaresan discloses the parallel coordinate axis provides representation of distribution and variation of values, including parameters, to identify any time patterns, i.e. “a frequency distribution”, that exist between each parameter, i.e. “parameter values per parameter…”, of the log record, i.e. “…for the log template”), and
the relationships between parameter values across different parameters for the log template (see Kumaresan; paragraphs 0073, 0084 and 0092; Kumaresan discloses the visual depiction of a set of paths for the log record over the parallel coordinate axis for a parallel coordinate chart enables the user to recognize the distribution and variation of values, including parameters, i.e. “different parameters”, across the same data fields of multiple log records, i.e. “relationships between parameter values…”).
The combination of Kumaresan and Kaushal does not explicitly disclose wherein a color coding that differentiates data associated with the first specific time window from data associated with the second specific time window is applied to the interactive graphical representations of the detection frequency for the log template.
In analogous art, Hinterbichler discloses wherein a color coding that differentiates data associated with the first specific time window from data associated with the second specific time window is applied to the interactive graphical representations of the detection frequency for the log template (see Hinterbichler; paragraphs 0016, 0020, 0022 and 0025; Hinterbichler discloses in the interactive visualization displaying different colors, i.e. “color coding that differentiates”, associated with highlight portions of the log messages at different periods of time, i.e. “associated with a first specific time window…” and “associated with the second specific time window”).
One of ordinary skill in the art would have been motivated to combine Kumaresan, Kaushal and Hinterbichler because they all disclose features of analyzing log data, and as such, are within the same environment.
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to incorporate the feature of modifying the display of log data representation as taught by Hinterbichler into the combined system of Kumaresan and Kaushal in order to provide the benefit of improved user experience by allowing any modifications to the data fields in the parallel coordinate chart (see Kumaresan; paragraph 0092) to be accurately represented corresponding to the log records (see Kumaresan; paragraph 0085).
Claim 13 is rejected under 35 U.S.C. 103 as being unpatentable over Kumaresan et al. (U.S. 2021/0027503 A1) in view of Kaushal et al. (U.S. 12,585,642 B2), as applied to claim 1 above, and further in view of Chen et al. (U.S. 2009/0271448 A1).
Regarding claim 13, Kumaresan and Kaushal disclose all the limitations of claim 1, as discussed above, and while the combination of Kumaresan and Kaushal disclose “user feedback”, as discussed above, the combination of Kumaresan and Kaushal does not explicitly disclose wherein the user feedback includes one or more of: a user customization of a graphical representation.
In analogous art, Chen discloses wherein the user feedback includes a customized log template for log message mapping (see Chen; paragraphs 0028 and 0029; Chen discloses a user instructing a computer to display user-initiated log file records for a log file, i.e. “log template”. In particular, the log file is analyzed to determine a repeating pattern, i.e. “log message mapping”, of log file records automatically generated and stored in the log file and to display only the user-initiated log file records in the log file, i.e. “customized log template”. In other words, the log file is customized by identifying repeated patterns of log file records automatically generated and only displaying user-initiated log file records. The examiner notes that according to the applicant’s specification, log message mapping includes identifying repeating constant portions in the log template; see applicant’s specification as filed; page 32 lines 18-22).
One of ordinary skill in the art would have been motivated to combine Kumaresan, Kaushal and Chen because they all disclose features of analyzing log data, and as such, are within the same environment.
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to incorporate the feature of determining repeating patterns of log file records as taught by Chen into the combined system of Kumaresan and Kaushal in order to provide the benefit of improved user experience by allowing the user to be able to determine within a log which commands are automatically generated and which are user initiated (see Chen; paragraphs 0002, 0003 and 0029).
Claims 17-19 are rejected under 35 U.S.C. 103 as being unpatentable over Kumaresan et al. (U.S. 2021/0027503 A1) in view of Johnston et al. (U.S. 2022/0245165 A1), and further in view of George (U.S. 2018/0095983 A1).
Regarding claim 17, Kumaresan discloses a tangible, non-transitory, computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor on a computer (see Kumaresan; paragraph 0014; Kumaresan discloses a non-transitory computer-readable storage medium containing instructions which, when executed on the one or more data processors, cause the one or more data processors to perform) cause the computer to perform a method comprising:
determining a log template mapped from network monitoring log messages, (see Kumaresan; paragraphs 0038, 0040, 0041 and 0069; Kumaresan discloses a log analytics system, i.e. “a process”, implemented as a set of mechanisms and/or modules, performs, i.e. “determining”, collection and analysis of log data, i.e. “log messages”, from log monitoring, i.e. “from network monitoring log messages”, such as, the format of the log in log records, i.e. “log template mapped”);
generating a visualization of the log template including interactive graphical representations of a detection frequency for the log template (see Kumaresan; paragraphs 0038, 0066, 0072, and 0073; Kumaresan discloses the analytics system, i.e. “the process”, implemented as mechanisms and/or modules, provides a user interface that allows a user to interact, i.e. “interactive”, with the log analytics system that provides a sample of the log records, i.e. “log template”, visually depicted, i.e. “graphical representations”, as the quantity of log messages changing during a time series, “detection frequency…”, over a parallel coordinate axis so that the user is able to recognize distribution values across the log records, i.e. “…for the log template”), a frequency distribution of parameter values per parameter for the log template (see Kumaresan; paragraphs 0073, 0079, 0084 and 0092; Kumaresan discloses the parallel coordinate axis provides representation of distribution and variation of values, including parameters, to identify any time patterns, i.e. “a frequency distribution”, that exist between each parameter, i.e. “parameter values per parameter…”, of the log record, i.e. “…for the log template”), and relationships between parameter values across different parameters for the log template (see Kumaresan; paragraphs 0073, 0084 and 0092; Kumaresan discloses the visual depiction of a set of paths for the log record over the parallel coordinate axis for a parallel coordinate chart enables the user to recognize the distribution and variation of values, including parameters, i.e. “different parameters”, across the same data fields of multiple log records, i.e. “relationships between parameter values…”. In other words, the axis in the parallel coordinate chart represents a relationship between parameter values by showing the variation of parameter values across the same data fields. The examiner notes that the examiner’s interpretation of a parallel coordinate axis of a parallel coordinate chart representing relationships between parameter values is supported by the applicant’s specification where it states relationships between parameter values across different parameters is shown in an axis of a parameter parallel coordinate chart; see applicant’s specification as filed; page 20 lines 9-17);
filtering data included in the visualization based on a user selection of a portion of a particular graphical representation (see Kumaresan; paragraphs 0079, 0080 and 0088; Kumaresan discloses the analytics system, i.e. “the process”, enables the user to highlight a portion of a coordinate axis, i.e. “user selection of a portion of a particular graphical representation”, for visualization of only the parameter values of the selected portion, i.e. “filtering…data”).
While Kumaresan discloses “determining a log template mapped from network monitoring log messages”, as discussed above, Kumaresan does not explicitly disclose wherein the log template is determined based on a parsing tree that encodes nodes of the parsing tree with constant tokens of the network monitoring log messages to create the log template.
In analogous art, Johnston discloses wherein the log template is determined based on a parsing tree that encodes nodes of the parsing tree with constant tokens of the network monitoring log messages to create the log template (see Johnston; paragraphs 0016, 0031 and 0042; Johnston discloses a parser tree produces a log template, i.e. “log template determined based on a parsing tree”. The logs are tokenized, such that, the parser tree includes nodes with a number of tokens, i.e. “encodes nodes of the parsing tree with constant tokens…”, to create the log template, i.e. “create the log template”).
One of ordinary skill in the art would have been motivated to combine Kumaresan and Johnston because they both disclose features of analyzing log data, and as such, are within the same environment.
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to incorporate the feature of a parser tree as taught by Johnston into the system of Kumaresan in order to provide the benefit of efficiency by allowing the handling of massive volumes of event log data (see Johnston; paragraph 0003) to include matching incoming logs with any existing logs (see Johnston; paragraph 0016).
While Kumaresan discloses “the visualization”, Kumaresan does not explicitly disclose modifying, based on the user selection and any user feedback derived from user customization or ratings on the visualization, generation of subsequent visualizations of log templates such that the subsequent visualizations are better aligned with user preferences for visualizations of the log template.
In analogous art, George discloses modifying, by the process and based on the user selection and any user feedback derived from user customization or ratings on the visualization, generation of subsequent visualizations of log templates such that the subsequent visualizations are better aligned with user preferences for visualizations of the log template (see George; paragraphs 0035, 0037, 0040 and 0071; George discloses display, i.e. “visualization”, of log files in a graphical user interface for analysis by a user. The user may select, i.e. “user selection”, a string and perform an operation, then a log analytics management software automatically creates a script based on the operation and any input received from the user. For example, a variable setting operation includes the user selecting a string within the log file, i.e. “log template”, and inputting a label for the variable, i.e. “user feedback derived from user customization”. A script for the operation is stored for future use, i.e. “subsequent visualizations”, such as, accessible for use in other log files. In other words, a user modifies a current visualization of a log file, then a script is created based on the modification, i.e. “user preferences”, that is used for future use on other log files, i.e. “modifying…generation of subsequent visualizations of log templates”) (The claim list features in the alternative. While the claim lists a number of optional limitations only one limitation from the list is required and needs to be met by the prior art. The Examiner has chosen the “user customization” alternative).
One of ordinary skill in the art would have been motivated to combine Kumaresan, Johnston and George because they both disclose features of analyzing log data, and as such, are within the same environment.
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to incorporate the feature of modifying the display of log data representation as taught by George into the combined system of Kumaresan and Johnston in order to provide the benefit of improved user experience by allowing any modifications to the data fields in the parallel coordinate chart (see Kumaresan; paragraph 0092) to be saved and used for future use (see George; paragraph 0037).
Regarding claim 18, Kumaresan, Johnston and Kaushal disclose all the limitations of claim 17, as discussed above, and further the combination of Kumaresan, Johnston and Kaushal clearly discloses wherein an interactive graphical representation of the relationships between parameter values across the different parameters for the log template is a parallel coordinate chart (see Kumaresan; paragraphs 0073, 0084 and 0092; Kumaresan discloses the visual depiction of a set of paths for the log record over the parallel coordinate axis for a parallel coordinate chart enables the user to recognize the distribution and variation of values, including parameters, i.e. “different parameters”, across the same data fields of multiple log records, i.e. “relationships between parameter values…”. In other words, the axis in the parallel coordinate chart represents a relationship between parameter values by showing the variation of parameter values across the same data fields).
Regarding claim 19, Kumaresan, Johnston and Kaushal disclose all the limitations of claim 17, as discussed above, and further the combination of Kumaresan, Johnston and Kaushal clearly discloses further comprising: modifying, for the subsequent visualizations, an inferential data model utilized to identify constant and parametric components within network monitoring log messages for log template mapping (see Kumaresan; paragraphs 0047, 0079 and 0080; Kumaresan discloses modifying clustering of the log record, i.e. “for log template mapping”, to identify duration and parameter values, i.e. “constant and parametric components”, using k-mean clustering, mean-shift clustering, expectation-maximizing clustering or any clustering algorithm, i.e. “inferential data model”).
Claim 20 is rejected under 35 U.S.C. 103 as being unpatentable over Kumaresan et al. (U.S. 2021/0027503 A1) in view of Chen et al. (U.S. 2009/0271448 A1).
Regarding claim 20, Kumaresan discloses an apparatus, comprising:
one or more network interfaces to communicate with a network (Kumaresan; paragraphs 0012 and 0149; Kumaresan discloses a data processing apparatus that is coupled to an interface);
a processor coupled to the one or more network interfaces and configured to execute one or more processes (see Kumaresan; paragraphs 0014 and 0149; Kumaresan discloses one or more processors coupled to the interface); and
a memory configured to store a process that is executable by the processor (see Kumaresan; paragraph 0143; Kumaresan discloses a system memory that stores program instructions and executable by processing unit);
determine a log template mapped from network monitoring log messages (see Kumaresan; paragraphs 0038, 0040, 0041 and 0069; Kumaresan discloses a log analytics system, i.e. “a process”, implemented as a set of mechanisms and/or modules, performs, i.e. “determining”, collection and analysis of log data, i.e. “log messages”, from log monitoring, i.e. “from network monitoring log messages”, such as, the format of the log in log records, i.e. “log template mapped”);
generate a visualization of the log template including interactive graphical representations of a detection frequency for the log template (see Kumaresan; paragraphs 0038, 0066, 0072, and 0073; Kumaresan discloses the analytics system, i.e. “the process”, implemented as mechanisms and/or modules, provides a user interface that allows a user to interact, i.e. “interactive”, with the log analytics system that provides a sample of the log records, i.e. “log template”, visually depicted, i.e. “graphical representations”, as the quantity of log messages changing during a time series, “detection frequency…”, over a parallel coordinate axis so that the user is able to recognize distribution values across the log records, i.e. “…for the log template”), a frequency distribution of parameter values per parameter for the log template (see Kumaresan; paragraphs 0073, 0079, 0084 and 0092; Kumaresan discloses the parallel coordinate axis provides representation of distribution and variation of values, including parameters, to identify any time patterns, i.e. “a frequency distribution”, that exist between each parameter, i.e. “parameter values per parameter…”, of the log record, i.e. “…for the log template”), and relationships between parameter values across different parameters for the log template (see Kumaresan; paragraphs 0073, 0084 and 0092; Kumaresan discloses the visual depiction of a set of paths for the log record over the parallel coordinate axis for a parallel coordinate chart enables the user to recognize the distribution and variation of values, including parameters, i.e. “different parameters”, across the same data fields of multiple log records, i.e. “relationships between parameter values…”. In other words, the axis in the parallel coordinate chart represents a relationship between parameter values by showing the variation of parameter values across the same data fields. The examiner notes that the examiner’s interpretation of a parallel coordinate axis of a parallel coordinate chart representing relationships between parameter values is supported by the applicant’s specification where it states relationships between parameter values across different parameters is shown in an axis of a parameter parallel coordinate chart; see applicant’s specification as filed; page 20 lines 9-17);
filter data included in the visualization based on a user selection of a portion of a particular graphical representation (see Kumaresan; paragraphs 0079, 0080 and 0088; Kumaresan discloses the analytics system, i.e. “the process”, enables the user to highlight a portion of a coordinate axis, i.e. “user selection of a portion of a particular graphical representation”, for visualization of only the parameter values of the selected portion, i.e. “filtering…data”).
While Kumaresan discloses “the visualization”, Kumaresan does not explicitly disclose modify based on the user selection and user feedback comprising a customized log template for log message mapping, generation of subsequent visualizations of log templates such that the subsequent visualizations incorporate the customized log template.
In analogous art, Chen discloses modify based on the user selection and user feedback comprising a customized log template for log message mapping, generation of subsequent visualizations of log templates such that the subsequent visualizations incorporate the customized log template (see Chen; paragraphs 0028 and 0029; Chen discloses a user instructing a computer to display user-initiated log file records for a log file, i.e. “log template”. In particular, the log file is analyzed to determine a repeating pattern, i.e. “log message mapping”, of log file records automatically generated and stored in the log file and to display only, i.e. “modify based on the user selection and user feedback”, the user-initiated log file records in the log file, i.e. “customized log template”. As such, any subsequent display of the log file will include just the user-initiated log file records, i.e. “subsequent visualizations incorporate the customized log template”. In other words, the log file is customized by identifying repeated patterns of log file records automatically generated and only displaying user-initiated log file records and any additional displays of the log file will include the user-initiated log file records. The examiner notes that according to the applicant’s specification, log message mapping includes identifying repeating constant portions in the log template; see applicant’s specification as filed; page 32 lines 18-22)
One of ordinary skill in the art would have been motivated to combine Kumaresan and Chen because they both disclose features of analyzing log data, and as such, are within the same environment.
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to incorporate the feature of determining repeating patterns of log file records as taught by Chen into the system of Kumaresan in order to provide the benefit of improved user experience by allowing the user to be able to determine within a log which commands are automatically generated and which are user initiated (see Chen; paragraphs 0002, 0003 and 0029).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
Frazier, Jr et al. (U.S. 12,309,236 B1) discloses receiving log data and an interactive graph is generated.
Bunyan et al. (U.S. 10,445,290 B1) discloses interactive log file viewing.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ADAM A COONEY whose telephone number is (571)270-5653. The examiner can normally be reached M-F 7:30am-5:00pm (every other Fri off).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Umar Cheema can be reached at 571-270-3037. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/A.A.C/Examiner, Art Unit 2458 06/23/26
/UMAR CHEEMA/Supervisory Patent Examiner, Art Unit 2458
Prosecution Insights