Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 04/16/2026 has been entered.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 5-20 are rejected under 35 U.S.C. 103 as being unpatentable over Tammisalo et al. (U.S. Pg Pub No. 20150030313 A1), in view of Greenwood et al. (U.S. Pg Pub No. 20190332269 A1), in further view of Bhusan et al. (U.S. Patent No. US 11915377 B1). Hereinafter referred to as Tammisalo, Greenwood, and Bhusan respectively.
Regarding Claim 1, Tammisalo teaches A data processing system comprising: a processor; (Tammisalo P[0008] “there is provided an apparatus for a computerized system comprising at least one processor”) and a memory in communication with the processor; the memory comprising executable instructions that, when executed by the processor alone or in combination with other elements, cause the data processing system to perform functions of: (Tammisalo P[0008] “and at least one memory including computer program code”) receiving, via a portal, a request for viewing a video related to a computing environment, (Tammisalo P[0010] “receiving a request for a video representation of a session”) the request including a correlation ID and the computing environment including a plurality of services; (Tammisalo P[0057] “The session selector 714 receives a request from a web browser with identification of a session”) upon determining that the video associated with the correlation ID is not available in the video storage medium, retrieving based on the correlation ID, via a management service, metadata associated with operations of at least one of the plurality of services of the computing environment ; (Tammisalo, see P[0021] for mentions of “privileged access auditing” for a management service, P[0057] “a user may enter search criteria for session metadata and content, and in response to receiving a request from the user, performs the search.”) generating from the retrieved metadata and using the management service, aggregated data representing at least one of flow of data in one or more of the plurality of services or operations of one or more of the plurality of services (Tammisalo P[0042] “FIG. 5 illustrates converting audit log data to video and causing display based on the converted data. The audit log data and/or its metadata is accessed and decrypted as needed ”) (Tammisalo P[0021] “In certain embodiments the audio log data is processed to produce frame images indicative of events during the session to generate a video stream. For example, the frame images can be indicative of the display the audited user saw and/or action(s) performed by the audited user.”) storing the generated video in the video storage medium with the correlation ID for future use; (Tammisalo P[0059] “The videos may be computed on the fly or may be computed and cached for a while whenever needed.”) and providing the generated video for display. (Tammisalo P[0034] “A web server 121 may be used for receiving requests from a user. The requests may include e.g., selection of a session, request to display a video and so on. The web server sends responses back to the user, e.g., a list of matching sessions or an HTML page (HyperText Mark-up Language page) causing a video stream for a selected session to be displayed.”)
However, Tammisalo fails to teach wherein the correlation ID is associated with an error in the computing environment, specifically the correlation ID being attached to telemetry data for debugging an operation of any of the services or other programming in the computing environment; and determining, based on the correlation ID that the video associated with the correlation ID is not available in a video storage medium; including telemetry entries that are tagged with the correlation ID and generated by a plurality of the services; indicative of a bug in the one or more plurality of services; wherein generating the aggregated data comprises: identifying, from the retrieved metadata, telemetry entries associated with the correlation ID across the plurality of services; ordering the identified telemetry entries based on associated time information to generate a chronological sequence of events for an end-to-end execution associated with the correlation ID that spans the plurality of services; reconstructing, from the chronological sequence of events, the flow of data and/or operations across the plurality of services for the end-to-end execution; and for debugging the one or more of the plurality of services.
Tammisalo and Greenwood are analogous to the claimed invention because both of them are in the same field of retrieving data from cloud storage using a search with ID.
Greenwood teaches determining, based on the correlation ID that the video associated with the correlation ID is not available in a video storage medium; (Greenwood, P[0062] “These partial manifests can be a mapping from partition-ID (or block-ID) to container-ID, and the partial manifests can be assembled into a manifest file that identifies storage locations of the partitions of the tertiary replica. … If a partition is unavailable when requested…”). In the case where a search turns up unsuccessful, Greenwood teaches that metadata is retrieved from an object manifest file for further operation.
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modify Tammisalo’s retrieval of metadata from a successfully found session to instead have Greenwood’s operation to retrieve metadata when a search is unsuccessful. Doing so would allow for both outcomes of a search (successful and unsuccessful) to be covered, allowing the user of the system to view a video depiction of the aggregated data, whether it was previously generated or not, improving user experience.
However, Tammisalo and Greenwood fail to teach wherein the correlation ID is associated with an error in the computing environment, specifically the correlation ID being attached to telemetry data for debugging an operation of any of the services or other programming in the computing environment; including telemetry entries that are tagged with the correlation ID and generated by a plurality of the services; indicative of a bug in the one or more plurality of services; wherein generating the aggregated data comprises: identifying, from the retrieved metadata, telemetry entries associated with the correlation ID across the plurality of services; ordering the identified telemetry entries based on associated time information to generate a chronological sequence of events for an end-to-end execution associated with the correlation ID that spans the plurality of services; reconstructing, from the chronological sequence of events, the flow of data and/or operations across the plurality of services for the end-to-end execution; and for debugging the one or more of the plurality of services.
Tammisalo, Greenwood, and Bhusan are analogous to the claimed invention because both of them are in the same field of retrieving data from cloud storage using a search with ID.
Bhusan teaches wherein the correlation ID (Bhusan Col 6 Line 4 “Events are field-searchable”) is associated with an error in the computing environment (Bhusan Col 25 Line 5 “Event 326 is associated with an entry in a server error log”), specifically the correlation ID being attached to telemetry data for debugging an operation of any of the services or other programming in the computing environment. (Bhusan Col[5] Lines[32-44] “During operation, the data intake and query system receives machine data from any type and number of sources (e.g., one or more system logs, streams of network packet data, sensor data, application program data, error logs, stack traces, system performance data, etc.). The system parses the machine data to produce events each having a portion of machine data associated with a timestamp, and stores the events. The system enables users to run queries against the stored events to, for example, retrieve events that meet filter criteria specified in a query, such as criteria indicating certain keywords or having specific values in defined fields. Additional query terms can further process the event data, such as, by transforming the data, etc.” Bhusan Col 5 Line 58-Col 6 Line 22 “As described above, the system stores the events in a data store. The events stored in the data store are field-searchable, where field-searchable herein refers to the ability to search the machine data (e.g., the raw machine data) of an event based on a field specified in search criteria. For example, a search having criteria that specifies a field name “UserID” may cause the system to field-search the machine data of events to identify events that have the field name “UserID.” In another example, a search having criteria that specifies a field name “UserID” with a corresponding field value “12345” may cause the system to field-search the machine data of events to identify events having that field-value pair (e.g., field name “UserID” with a corresponding field value of “12345”). Events are field-searchable using one or more configuration files associated with the events. Each configuration file can include one or more field names, where each field name is associated with a corresponding extraction rule and a set of events to which that extraction rule applies. The set of events to which an extraction rule applies may be identified by metadata associated with the set of events.” Bhusan Col 23 Line 64-Col 24 Line 3 “FIG. 3B further illustrates an expanded event data file 316C showing an example of data that can be stored therein. In the illustrated embodiment, four events 320, 322, 324, 326 of the machine data file 316C are shown in four rows. Each event 320-326 includes machine data 330 and a timestamp 332. The machine data 330 can correspond to the machine data received by the system 102.” Bhusan Col 25 Lines 5-11 “Event 326 is associated with an entry in a server error log, as indicated by “error.log” in the source column 336 that records errors that the server encountered when processing a client request. Similar to the events related to the server access log, all the raw machine data in the error log file pertaining to event 326 can be preserved and stored as part of the event 326.”)
metadata associated with operations of at least one of the plurality of services of the computing environment including telemetry entries (Bhusan Fig 3B shows telemetry entries (320, 322, 324, 326)) that are tagged with the correlation ID (Bhusan Col 6 Line 4 “Events are field-searchable” Examiner Note: Any of data contained within each telemetry entry can be searched and serves as an identifier to identify data, therefore a correlation ID.) and generated by a plurality of the services (Bhusan Fig 3B shows a source column 336 which shows which source the machine data kept in the telemetry entries is from.).
aggregated data representing at least one of flow of data in one or more of the plurality of services or operations of one or more of the plurality of services indicative of a bug in the one or more plurality of services; (Bhusan Col[5] Lines[32-44] “During operation, the data intake and query system receives machine data from any type and number of sources (e.g., one or more system logs, streams of network packet data, sensor data, application program data, error logs, stack traces, system performance data, etc.). The system parses the machine data to produce events each having a portion of machine data associated with a timestamp, and stores the events. The system enables users to run queries against the stored events to, for example, retrieve events that meet filter criteria specified in a query, such as criteria indicating certain keywords or having specific values in defined fields. Additional query terms can further process the event data, such as, by transforming the data, etc.”)
wherein generating the aggregated data comprises: identifying, from the retrieved metadata, telemetry entries associated with the correlation ID across the plurality of services; (Bhusan Fig 3B (320, 322, 324, 326)) ordering the identified telemetry entries based on associated time information to generate a chronological sequence of events for an end-to-end execution associated with the correlation ID that spans the plurality of services; (Bhusan Fig 3B shows telemetry entries (320, 322, 324, 326) that have Time 332, and are organized in chronological sequence.) reconstructing, from the chronological sequence of events, the flow of data and/or operations across the plurality of services for the end-to-end execution; (Bhusan Col [30] Lines [38-44] “For example, commands may be used to filter unwanted information out of the results, extract more information, evaluate field values, calculate statistics, reorder the results, create an alert, create summary of the results, or perform some type of aggregation function. In some embodiments, the summary can include a graph, chart, metric, or other visualization of the data.” Examiner Note: The ordered telemetry events provides a representation of a flow of operations occurring in the system, and the construction of a summary, such as a graph, is a construction of the flow of data for an end-to-end execution.)
the operations of the one or more of the plurality servers for debugging the one or more of the plurality of services; (Bhusan Col 25 Lines 5-11 “Event 326 is associated with an entry in a server error log, as indicated by “error.log” in the source column 336 that records errors that the server encountered when processing a client request. Similar to the events related to the server access log, all the raw machine data in the error log file pertaining to event 326 can be preserved and stored as part of the event 326.” Examiner’s Note: Bhusan teaches debugging through error log, since debugging is the purpose of an error log.)
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Tammisalo in view of Greenwood’s invention to include a correlation ID associated with an error, the metadata comprising telemetry entries, and constructing aggregated data from a chronological flow of data from the telemetry entries, as taught by Bhusan. The combination would result in the metadata gathered consisting of multiple telemetry entries, which are then used in chronological order to achieve aggregated data that represents the flow of data and/or operations across services, to subsequently be used in video production for the purposes of generating a visualization of data for debugging. Doing so would allow for organized, timestamped telemetry entries into an aggregated representation of system activity, which improves the ability to analyze, trace and diagnose errors occurring across multiple services.
Regarding Claim 2, Tammisalo, in view of Greenwood, in further view of Bhusan, teaches the data processing system of claim 1, wherein the generated video is stored with the correlation ID so that a future request with the correlation ID is provided with the generated video. (Tammisalo, P[0057] “The session selector 714 receives a request from a web browser with identification of a session”, P[0059] “The video is stored in a video buffer 724. The buffer may be, e.g., a file”)
Regarding Claim 3, Tammisalo, in view of Greenwood, in further view of Bhusan, teaches the data processing system of claim 1, wherein storing the generated video in the video storage medium with the correlation ID includes storing metadata about the generated video in a video metadata database, (Tammisalo, P[0055] “The session audit log data and the index are stored using a storage manager 710”) the video metadata database including the correlation ID for each video stored in the video storage medium. (Tammisalo, P[0057] “The search may be performed e.g. using an index created by the session indexer and a database of metadata.”)
Regarding Claim 5, Tammisalo, in view of Greenwood, in further view of Bhusan, further teaches the data processing system of claim 1, wherein the correlation ID is included in an error log generated in response to an error in the computing environment. (Bhusan Col 25 Lines 5-11 “Event 326 is associated with an entry in a server error log, as indicated by “error.log” in the source column 336 that records errors that the server encountered when processing a client request. Similar to the events related to the server access log, all the raw machine data in the error log file pertaining to event 326 can be preserved and stored as part of the event 326.”)
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Tammisalo’s and Greenwood’s combination to include a correlation ID associated with an error that is included in the error log, as taught by Bhusan. The combination supports an identifier to be associated with an error, as well as the error to be included in an error log, as that is the purpose of an error log, and is a common practice in the art.
Regarding Claim 6, Tammisalo, in view of Greenwood, in further view of Bhusan, teaches The data processing system of claim 1, wherein providing the generated video for display includes: transmitting a link to a location at which the generated video is stored; (Tammisalo, P[0057] “A web server [...] also sends [...] pages and files (e.g., style sheets, images, videos) back to the web browser”) utilizing a video player to play the generated video; (Tammisalo, P[0016] “FIG. 5 illustrates a method for converting audit log data for an interactive session to a video and outputting a web page for causing the video to be displayed in a web browser.”) and utilizing a transcoding and streaming service to transcode the video to a required format before the video player plays the video. (Tammisalo, P[0052] “In response to the request, an audit log reader 604 reads (and decrypts, if applicable) the session audit log data, sending it to a content extractor 605 that obtains session content or output from the data, sending the content to a content renderer 606 (e.g., a terminal emulator, RDP emulator, or web browser engine), whose output is taken as video frames and sent to a video codec 607 for encoding into a video stream (e.g., a H.264 or MPEG-4 codec). Also, in response to the request, a response web page 609 is generated 608 (e.g., by the web server) and sent back to the web browser 601, causing the video to be displayed.”)
Regarding Claim 7, Tammisalo, in view of Greenwood, in further view of Bhusan, teaches the data processing system of claim 1, wherein the metadata associated with operations of at least one of the plurality of services of the computing environment is retrieved from a metadata storage data store. (Tammisalo, P[0042] “The audit log data and/or its metadata is accessed and decrypted as needed”, P[0055] “The session audit log data and the index are stored using a storage manager 710, which may store the data on local storage 704 or networked storage over a network”)
Regarding Claim 8, Tammisalo, in view of Greenwood, in further view of Bhusan, teaches the data processing system of claim 1, wherein at least one of the plurality of services of the computing environment is registered with the management service. (Tammisalo, P[0021] “Certain embodiments relating to privileged access auditing of use of a computer system are described in the following to illustrate the invention.”, with the “privileged access auditing” being the management service. P[0064] “FIG. 9 illustrates an embodiment where audit log data captured in association with at least one session in a computerized system is obtained at 900.”)
Regarding Claim 9, Tammisalo, in view of Greenwood, in further view of Bhusan, teaches the data processing system of claim 8, wherein registered services include a component that generates a new correlation ID when a new session is initiated. (Tammisalo, P[0039] “If the session is to be authorized, then encryption is negotiated with a server host 305, the session is authenticated to the server 306, and logging session audit data to a vault is started 307.”)
Regarding Claim 10, Tammisalo, in view of Greenwood, in further view of Bhusan, teaches the data processing system of claim 9, wherein the new correlation ID is added to telemetry data associated with the new session. (Tammisalo, P[0028] “A session audit log is advantageously accompanied by metadata containing information about the session, such as the original client host, the client-side user name (or other authentication information provided), a server-side user name, IP addresses or names of the client host and server host, a provided ticket identifier, time and date, total amount of data transferred, and possibly various tags based on matching criteria against text segments obtained from the session.”)
Regarding claim 11, has similar limitations as of claim 1, therefore it is rejected under the same rationale as claim 1.
Regarding claim 12, has similar limitations as of claim 2, therefore it is rejected under the same rationale as claim 2.
Regarding claim 13, has similar limitations as of claim 3, therefore it is rejected under the same rationale as claim 3.
Regarding claim 14, has similar limitations as of claim 6, therefore it is rejected under the same rationale as claim 6.
Regarding claim 15, has similar limitations as of claim 6, therefore it is rejected under the same rationale as claim 6.
Regarding claim 16, has similar limitations as of claim 8, therefore it is rejected under the same rationale as claim 8.
Regarding claim 17, has similar limitations as of claim 9, therefore it is rejected under the same rationale as claim 9.
Regarding claim 18, has similar limitations as of claim 10, therefore it is rejected under the same rationale as claim 10.
Regarding claim 19, has similar limitations as of claims 1 and 11, therefore it is rejected under the same rationale as claims 1 and 11.
Regarding claim 20, has similar limitations as of claims 2 and 12, therefore it is rejected under the same rationale as claims 2 and 12.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DAVID W SOON whose telephone number is (571)272-8113. The examiner can normally be reached M-F 7:30-5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alicia Harrington can be reached at (571) 272-2330. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DAVID W SOON/Examiner, Art Unit 2615
/ALICIA M HARRINGTON/Supervisory Patent Examiner, Art Unit 2615
Prosecution Insights