DETAILED ACTION
This action is in response to an amendment filed on July 20, 2026 for the application of Kumar et al., for a “Metrics, events, alert extractions from system logs” filed on August 14, 2023. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are pending in the application.
Claims 1-20 have been amended.
Claims 1-20 are rejected under 35 USC § 101.
Claims 1-3, 6-10, 13-17, and 19-20 are rejected under 35 USC § 102.
Claims 4-5, 11-12, and 18 are rejected under 35 USC § 103.
Claim Objections
Claim 6 is objected to because of the following informalities: Claim 6, line 2 recites the limitation “to generate assign the event”. Examiner suggests changing “to generate assign the event” to “to assign the event”. Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) mental processes-concepts performed in human mind.
Claim 1 recites abstract ideas:
generate normalized data blocks by applying at least one user-defined function to the one or more data blocks, the at least one user-defined function comprising one or more rules for normalizing data corresponds to data analysis steps recited at high level of generality such that they could be performed in the human mind, which are mental processes. The broadest reasonable interpretation of the limitation in light of the specification encompasses analyzing and formatting data ([0018]).
cluster the normalized data blocks into one or more clusters corresponds to data analysis steps recited at high level of generality such that they could be performed in the human mind, which are mental processes. A human can organize data into one or more groups.
identify data patterns from the one or more clusters, including at least one data pattern correlated with an event represented in the log data corresponds to data analysis steps recited at high level of generality such that they could be performed in the human mind, which are mental processes. A human can analyze data and perform data pattern matching/recognizing.
provide output data identifying an event correlated with one of the identified data patterns represented by the additional data block corresponds to data analysis steps recited at high level of generality such that they could be performed in the human mind, which are mental processes. A human can analyze data and perform data patterns matching/recognizing and identify data correlated with the identified patterns.
Claim 1 does not recite additional limitations that integrate the judicial exceptions into practical application.
A system comprising: a processing unit configured to amounts to mere instructions to implement the abstract ideas on a computer, which is mere instructions to apply an exception. See MPEP 2106.05(f).
receive one or more data blocks corresponding to log data generated by a plurality of network-connected devices and receiving an additional data block corresponding to additional log data generated by at least one of the network-connected devices amount to mere data gathering recited at a high level of generality, and thus is insignificant extra-solution activity. These limitations amount to receiving or transmitting data over a network and are well-understood, routine, conventional activity (MPEP 2106.05(d)).
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exceptions because the additional elements amount to generally linking the use of a judicial exception to a particular technological environment or field of use, insignificant extra-solution activity and mere instructions to apply an exception. See MPEP 2106.05(f), MPEP 2106.05(g), and MPEP 2106.05(h).
As for the limitations recited in claims 2-7, when considering each of the claims as a whole these additional elements do not integrate the exception into a practical application, using one or more of the considerations laid out by the Supreme Court and the Federal Circuit. The additional elements do not reflect an improvement in the functioning of a computer, or an improvement to other technology or technical field. The additional elements do not implement a judicial exception with, or use a judicial exception in conjunction with, a particular machine or manufacture that is integral to the claim. The additional elements do not apply or use the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular technological environment, such that the claim as a whole is more than a drafting effort designed to monopolize the exception.
As per claims 8 and 15, please refer to the analysis section of claim 1.
As per claims 9-14 and 16-20 please refer to the analysis section of claims 2-7.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-3, 6-10, 13-17, and 19-20 are rejected under 35 U.S.C. 102(a)(1)/(a)(2) as being anticipated by Bob et al. (U.S. PGPUB 20220247763).
As per claims 1 and 8, Bob discloses a system/method comprising: a processing unit ([0073]) configured to:
receiving, by an operations management system (OMS) via a network interface ([0040], “data processors with interfaces to external systems (e.g., network or customer-facing) so as to receive incoming data streams and other digital information through a data interface to data ingestor 110”), a plurality of data blocks indicative of corresponding to log data (Fig. 1, log data stream 102) generated by a plurality of network-connected devices during operation (Fig. 1) and ([0040], “present invention may be implemented in a data center using processor-based machines such as servers, data processors, digital data storage devices, data communication networks, appliances and the like”);
generating, by the OMS, normalized data blocks by applying at least one user-defined function to the one or more data blocks (Fig. 4, element 404 “dynamic normalizing”), the at least one user-defined function comprising one or more rules for normalizing data ([0054], “normalization rules”);
clustering, by the OMS, the normalized data blocks into one or more clusters (Fig. 4, element 406 “dynamic aggregation);
identifying, by the OMS, data patterns from the one or more clusters, including at least one data pattern correlated with an event represented in the log data ([0056], “If the parsing expressions and normalization rules are set up to identify such events and patterns as anomalous then this can trigger an action as an anomaly detection event.”); and
responsive to receiving an additional data block corresponding to additional log data generated by at least one of the network-connected devices ([0059]-[0060]), providing, by the OMS, output data identifying an event correlated with one of the identified data patterns represented by the additional data block ([0061]) and (Figs. 4-5).
As per claims 2, 9, and 16, Bob discloses the processing unit is further configured to extract the at least one user-defined function from a database ([0054], “normalization rules”), and wherein identifying the data patterns comprises identifying one or more unique data patterns for each of the one or more clusters ([0056], “If the parsing expressions and normalization rules are set up to identify such events and patterns as anomalous then this can trigger an action as an anomaly detection event.”).
As per claim 3, Bob discloses the processing unit is further configured to store and associate each association data that associates an identified data pattern ([0032] and [0036]) with a contextual meta tag indicative of an event represented by the identified data pattern ([0055]-[0056] and [0063]).
As per claims 6 and 13, Bob discloses the processing unit is further configured to generate assign the event identified by the output data to a category that has a priority level ([0039], “Also, note that an incident 26 can comprise data indicative of or encoding a summary, a severity of the incident (e.g., classification of low, medium, high or critical severity)”) and provide dashboard data for presenting the event based at least in part on the priority level ([0063] and [0078], “provide a user interface include printers or display screens for visual presentation”).
As per claims 7 and 14, Bob discloses storing association data that associates an identified data pattern with a contextual meta tag indicative of an event represented by the identified data pattern ([0032], [0036], and [0063]); receiving, from a user device, a modification to the contextual meta tag; updating the association data to associate the identified data pattern with the modified contextual meta tag ([0046], “These may be created, updated or modified by human operators or staff of a customer or service provider. Rules relating to each main function of the analytics engine 300 are possible, including for example: enrichment rules directed mainly to the enrichment subsystem or module 380; parsing rules directed mainly to the parser or parsing subsystem 370; normalizing rules directed mainly to a normalizer or normalizing subsystem 374; filter and/or routing rules directed mainly to the filter-router or routing subsystem 330; and aggregation rules directed to the aggregator or aggregating subsystem 360.”); and responsive to receiving a further data block representing the identified data pattern, providing further output data identifying an event indicated by the modified contextual meta tag ([0032], [0036], and [0063]).
As per claims 10 and 17, Bob discloses re-clustering, by the OMS, the normalized data blocks in each cluster to identify one or more unique data-pattern groups ([0056], “If the parsing expressions and normalization rules are set up to identify such events and patterns as anomalous then this can trigger an action as an anomaly detection event.”), wherein at least one unique data-pattern group is correlated with an event represented in the log data ([0059]-[0061]) and (Figs. 4-5).
As per claim 15, refer to the analysis section of claims 1 and 8. Bob further discloses access a storage device to retrieve one or more data blocks corresponding to log data received from one or more remote data sources associated with a plurality of computing devices ([0048]).
As per claim 19, Bob discloses the operations management unit is further configured to: store association data associating an identified data pattern with a contextual meta tag indicative of an event represented by the identified data pattern ([0032], [0036], and [0063]); and create, for the entity, a taxonomy comprising a plurality of categories, each category associated with at least one contextual meta tag ([0065] and [0071]).
As per claim 20, Bob discloses the operations management unit is further configured to generate output data for presenting one or more dashboards on a user device ([0078], “provide a user interface include printers or display screens for visual presentation”) based at least in part on a taxonomy ([0065] and [0071]) and a request received from the user device ([0039], “Note that an observation 24 can comprise data indicative or encoding a timestamp, a type or classification, and other data related to the observation. Also, note that an incident 26 can comprise data indicative of or encoding a summary, a severity of the incident (e.g., classification of low, medium, high or critical severity)”) and ([0063], “a user or entity may receive observations generated automatically by the system and method as a by-product of the stated analytics and other steps. For example, observation generation can include generation of warning signals, alarms, alert messages or similar trigger events to assist human or machine parties in avoiding unwanted consequences to their data or computing infrastructure on account of events reflected in the present log data streams.”).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 4-5, 11-12, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Bob et al. (U.S. PGPUB 20220247763) in view of Hassan et al. (U.S. PGPUB 20210117838).
As per claims 4-5, 11-12, and 18, Bob fails to explicitly disclose machine learning model configured based at least in part on entity-specific parameters.
As per claims 4, 11, and 18, Hassan of analogous art teaches the processing unit is further configured to execute at least one machine learning model configured using entity-specific parameters received from a meta store to identify, in the additional log data, an entity associated with one of the network-connected devices that generated the additional log data, and wherein the output data further identifies the entity ([0045], “a machine learning model is used to extract an exception entity... named entity recognition (NER) is a natural language processing (NLP) technique used to identify entities from text and classify them into the defined categories.”).
All of the claimed elements were known in Bob and Hassan and could have been combined by known methods with no change in their respective functions. It therefore would have been obvious to a person of ordinary skill in the art before the time of effective filing language to combine their methods. One would be motivated to make this combination since Hassan’s NER model is a mere example of Bob’s machine learning model.
As per claims 5 and 12, Hassan discloses at least one machine learning model comprises a Named Entity Recognition (NER) model configured to identify mentions of the entity ([0045], “a machine learning model is used to extract an exception entity... named entity recognition (NER) is a natural language processing (NLP) technique used to identify entities from text and classify them into the defined categories.”) in the additional log data ([0031], “Log 115”).
Response to Arguments
Applicant’s amendments filed on July 20, 2026 necessitated a new ground(s) of rejection in this Office action. Accordingly, applicant’s arguments have been fully considered but are moot in view of the new ground(s) of 35 U.S.C. 101/103 rejections, as set forth in this office action.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Elmira Mehrmanesh whose telephone number is (571)272-5531. The examiner can normally be reached on M-F from 10-6.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bryce Bonzo, can be reached at telephone number (571) 272-3655. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center. Status information for published applications may be obtained from Patent Center. Status information for unpublished applications is available through Patent Center for authorized users only. Should you have questions about access to Patent Center, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/uspto-automated- interview-request-air-form.
/Elmira Mehrmanesh/
Primary Examiner, Art Unit 2113
