DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In response to Applicant’s claims filed on January 8, 2026, claims 1, 3-11, 13-20 are now pending for examination in the application.
Response to Arguments
This office action is in response to amendment filed 01/08/2026. In this action Claim(s) 1, 3-5, 7-11, 13-15, 17-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tiwari et al. (US Pub. No. 20220318019) and JHA et al. [1] (US Pub. No. 20220197879) in further view of Balaiah et al. (US Pub. No. 20230122630). The Balaiah et al. reference has been added to include wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice.
Applicant’s arguments:
In regards to claim 1 on Page(s) 11, applicant argues “The reasons for this are that the operation of receiving the data-stream of logs sent by the client computer device cannot be performed solely by the human mind, and the operation of generating logs through computer-encoding based on a computer protocol and the operation of decoding the field based on a protocol to obtain storage attribute information cannot be performed solely by the human mind either. Also, since the storing operation depends on a computer device with a memory, the operation of storing the logs corresponding to the microservice in designated addresses cannot be performed solely by the human mind, and respective field regions in the computer data regions storing data cannot be performed solely by the human mind. Moreover, searching the target storage address corresponding to the storage attribute information of the target log relates to an execution of computer code. Therefore, the above features specified in claim 1 cannot be performed solely by the human mind and are additional elements, not abstract ideas.
.”
Examiner’s Reply:
Generating rules and validating metadata are steps that can be performed in the human mind. The abstract idea recited in the claims is generally linking it to a computer environment.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, 3-11, 13-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-patentable subject matter. The claims are directed to an abstract idea without significantly more.
Claim 1, 3-11, 13-20 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The judicial exception is not integrated into a practical application. The claims do not include additional elements that are sufficient to amount to significantly more than judicial exception. The eligibility analysis in support of these findings is provided below, on Claim Rejections - 35 USC 101 accordance with the "2019 Revised Patent Subject Matter Eligibility Guidance" (published on 1/7/2019 in Fed, Register, Vol. 84, No. 4 at pgs. 50-57, hereinafter referred to as the "2019 PEG").
Step 1. in accordance with Step 1 of the eligibility inquiry (as explained in MPEP 2106), it is first noted the claim method (claims 1, 3-10), device (claims 11, 13-20), is/are directed to one of the eligible categories of subject matter and therefore satisfies Step 1.
Step 2A. In accordance with Step 2A, prong one of the 2019 PEG, it is noted that the independent claims recite an abstract idea falling within the Mental Processes & Mathematical Concepts enumerated groupings of abstract ideas set forth in the 2019 PEG. Examiner is of the position that independent claims 1, 8, 11, and 18-20 are directed towards the Mental Process Grouping of Abstract Ideas.
Independent claim(s) 1, 11, 18, and 19 recites the following limitations directed towards a Mental Processes & Mathematical Concepts:
wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to generate a log); and
wherein the target log is obtained by encoding a raw log with a preset field type through the client based on a preset log transfer protocol, a log structure of the target log comprises a header region and a content region (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to encode a raw log),
decoding, based on the preset log transfer protocol, the routing field region
determining, based on the storage attribute information of the target log, a storage address of the target log (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to determine a storage address);
wherein the determining, based on the storage attribute information of the target log, a storage address of the target log, comprises:
searching, based on the storage attribute information of the target log, a target storage address corresponding to the storage attribute information of the target log from a pre- constructed corresponding relationship between storage attribute information and storage address, and determining the target storage address as the storage address of the target log (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to determine a storage address).
Step 2A. In accordance with Step 2A, prong two of the 2019 PEG, the judicial exception is not integrated into a practical application because of the recitation in claim(s) 1,11, 18 and 19:
a processor (i.e., as a generic processor/component performing a generic computer function),
a memory (i.e., as a generic processor/component performing a generic computer function), and
a bus (i.e., as a generic processor/component performing a generic computer function),
wherein the memory stores machine-readable instructions executable by the processor, when the electronic device runs, the processor is in communication with the memory via the bus, and when the machine-readable instructions are executed by the processor, steps of a log processing method are performed by the processor, wherein the log processing method comprises:
receiving a target log sent from a client (recites insignificant extra solution activity that amounts to mere data gathering),
the header region comprises a routing field region, the routing field region is used for storing storage attribute information of the target log (recites insignificant extra solution activity that amounts to storing attribute information), and
the content region is used for storing a log content (recites insignificant extra solution activity that amounts to storing log content); and
storing the target log into the storage address (recites insignificant extra solution activity that amounts to storing the target log).
Step 2B. Similar to the analysis under 2A Prong Two, the claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception. Because the additional elements of the independent claims amount to insignificant extra solution activity and/or mere instructions, the additional elements do not add significantly more to the judicial exception such that the independent claims as a whole would be patent eligible.
Independent claims 8 and 20 recites the following limitations directed towards a Mental Processes:
Step 2A. In accordance with Step 2A, prong two of the 2019 PEG, the judicial exception is not integrated into a practical application because of the recitation in claim(s) 8 and 20:
obtaining a raw log
wherein a log structure of the target log comprises a header region and a content region, the header region comprises a routing field region, the routing field region is used for storing storage attribute information of the target log (recites insignificant extra solution activity that amounts to storing attribute information), and
the content region is used for storing a log content (recites insignificant extra solution activity that amounts to storing log content); and
sending the target log to a server to cause the server
storing the target log into the storage address (recites insignificant extra solution activity that amounts to storing the log).
Step 2B. Similar to the analysis under 2A Prong Two, the claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception. Because the additional elements of the independent claims amount to insignificant extra solution activity and/or mere instructions, the additional elements do not add significantly more to the judicial exception such that the independent claims as a whole would be patent eligible.
Therefore, independent claims 1, 8, and 11 are rejected under 35 U.S.C. 101.
With respect to claim(s) 3 and 13:
Step 2A, prong one of the 2019 PEG:
wherein the header region further comprises an index field region, the index field region comprises a plurality of index fields (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to encode a raw log),
the target log comprises a plurality of sub-logs, and each sub-log of the plurality of sub-logs corresponds to at least one index field of the plurality of index fields (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to encode a raw log); and
the method further comprises: determining, for each sub-log of the plurality of sub-logs, log attribute information of the sub-log, and storing the log attribute information of the sub-log into a corresponding index field, wherein the log attribute information is used for querying a corresponding sub-log (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to determine attribute information).
Step 2A Prong Two Analysis:
storing the log attribute information of the sub-log into a corresponding index field (recites insignificant extra solution activity that amounts to storing the attribute).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 4 and 14:
Step 2A, prong one of the 2019 PEG:
searching, based on the log information to be queried, a target log content corresponding to the log information to be queried, and sending the target log content to the client (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to searching a log content).
Step 2A Prong Two Analysis:
receiving a log query request sent from the client, wherein the log query request carries log information to be queried (recites insignificant extra solution activity that amounts to mere data gathering).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 5 and 15:
Step 2A, prong one of the 2019 PEG:
wherein the log information to be queried comprises log attribute information to be queried or log content information to be queried (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to querying log content).
searching, based on the log attribute information to be queried, target log attribute information matched with the log attribute information to be queried, from the index field region (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to searching the target log attribute), and
searching, based on the target log attribute information, the target log content associated with the target log attribute information from a region corresponding to the storage address (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to searching the target log content); or
searching, based on the log content information to be queried, the target log content matched with the log content information to be queried from a region corresponding to the storage address (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to searching the target log content).
Step 2A Prong Two Analysis:
the header region further comprises an index field region, the index field region comprises a plurality of index fields, and the plurality of index fields are used for storing log attribute information (recites insignificant extra solution activity that amounts to storing log attributes).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 6 and 16:
Step 2A, prong one of the 2019 PEG:
wherein the target log comprises a plurality of sub-logs (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to searching the target log content); and
the searching, based on the log content information to be queried, the target log content matched with the log content information to be queried from a region corresponding to the storage address (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to searching the target log content), comprises:
decoding the target log to obtain a plurality of raw sub-logs respectively corresponding to the plurality of sub-logs, wherein each raw sub-log of the plurality of raw sub-logs comprises a plurality of log contents (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to decoding a log);
determining, for each log content of the plurality of log contents of each raw sub-log, a pointer of each log content in a memory (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to determining a pointer); and
determining, based on the log content corresponding to each pointer, a target pointer matched with the log content information to be queried (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to determining a match), and
searching the target log content from a storage address indicated by the target pointer (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to searching the target log content).
Step 2A Prong Two Analysis:
the header region further comprises an index field region, the index field region comprises a plurality of index fields, and the plurality of index fields are used for storing log attribute information (recites insignificant extra solution activity that amounts to storing log attributes).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 7 and 17:
Step 2A, prong one of the 2019 PEG:
wherein the log structure of the target log further comprises a protocol header,
the log compression algorithm type refers to a compression algorithm for compressing the raw log (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to compress a log);
the log length is used for indicating a maximum amount of data of a log to be encoded; and
the protocol verification information is used for verifying whether there is an error in the target log relative to the raw log (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to verifying an error).
Step 2A Prong Two Analysis:
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 9:
Step 2A, prong one of the 2019 PEG:
wherein the raw log comprises a plurality of raw sub-logs, each raw sub-log comprises a plurality of key-value pairs, and each key-value pair comprises a keyword and a key-value (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to encoding a log); and
the encoding, based on a preset log transfer protocol, the raw log to obtain a target log, comprises:
determining, for the plurality of raw sub-logs, at least one identical raw keyword present in the plurality of raw sub-logs (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to determining a keyword); and
for each identical raw keyword, replacing the raw keyword with a target keyword to obtain a plurality of new raw sub-logs (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to replacing a keyword), and
encoding the plurality of new raw sub-logs, wherein a byte length of the target keyword is less than a byte length of the raw keyword (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to encoding a log).
Step 2A Prong Two Analysis:
This judicial exception is not integrated into a practical application because there are no additional elements to provide practical application.
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 10:
Step 2A, prong one of the 2019 PEG:
generating a log query request in response to a query operation, wherein the log query request carries log information to be queried (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to generating a query request);
Step 2A Prong Two Analysis:
sending the log query request to the server (recites insignificant extra solution activity that amounts to sending a query),
receiving the target log content, corresponding to the log information to be queried, sent from the server (recites insignificant extra solution activity that amounts to mere data gathering).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 3-5, 7-11, 13-15, 17-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tiwari et al. (US Pub. No. 20220318019) and JHA et al. [1] (US Pub. No. 20220197879) in further view of Balaiah et al. (US Pub. No. 20230122630).
With respect to claim 1, Tiwari et al. teaches a log processing method, comprising:
receiving a target log sent from a client, wherein the target log is obtained by encoding a raw log with a preset field type through the client based on a preset log transfer protocol, a log structure of the target log comprises a header region and a content region, the header region comprises a routing field region, the routing field region is used for storing storage attribute information of the target log, and the content region is used for storing a log content (Paragraph 27 discloses encoding the log data in a manner that reduces the payload size of the information transferred over the network); an
decoding, based on the preset log transfer protocol, the routing field region to obtain the storage attribute information of the target log (Paragraph 27 discloses decoding the log data into the full log file for use by data analytics or other tools). Tiwari et al. discloses determining, based on the storage attribute information of the target log, a storage address of the target log.
However, JHA et al. [1] discloses determining, based on the storage attribute information of the target log, a storage address of the target log (Paragraph 64 discloses stores information that maps each data center tenant to a location where each tenant's log message data is stored in one of the databases 710-712 and Paragraph 64 discloses determining the event type of each log message by considering each log message as a set of tokens separated by non-printed characters referred to as “white space.”), and
storing the target log into the storage address (Paragraph 66 discloses log message classifier determines an event type label, counts the number of log messages in each one second time interval with the same event type, time stamp of the one second time interval (e.g., beginning of the one second interval), sample text of the event type, the time unit and system identification (i.e., id) and records this information in a second-level aggregated record).
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify over Tiwari et al. with JHA et al. to include determining, based on the storage attribute information of the target log, a storage address of the target log. This would have facilitated log storage and retrieval. See JHA et al. [1] Paragraphs 3-5.
Tiwari et al. as modified by JHA et al. discloses wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice.
However, Balaiah et al. teaches wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice (Paragraph 64 discloses Log data generated for every transaction is compressed, tokenized, and exported over secure Transport Layer Security (TLS) connections to the log routers 154 that direct the logs to the storage cluster 156, hosted in the appropriate geographical region, for each organization);
wherein the determining, based on the storage attribute information of the target log, a storage address of the target log, comprises:
searching, based on the storage attribute information of the target log, a target storage address corresponding to the storage attribute information of the target log from a pre-constructed corresponding relationship between storage attribute information and storage address, and determining the target storage address as the storage address of the target log (Paragraph 292-293 discloses identify the endpoints is to mine the application's log, e.g., database and registry entries, on the user device 300, for this information and initiate probes to them, when needed, periodically, etc. The thick client application can include application logs which is a rich set of data written into local files, databases, registry, etc., by parsing these, we can get a clear insight into the application behavior and the network endpoints they are communicating with)
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify over Tiwari et al. and JHA et al. with Balaiah et al. to include wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice. This would have facilitated log storage and retrieval. See Balaiah et al. Paragraph(s) 7.
The Tiwari et al. reference as modified by JHA et al. [1] and Balaiah et al. teaches all the limitations of claim 1. Regarding claim 3, Tiwari et al. discloses the method according to claim 1, wherein the header region further comprises an index field region, the index field region comprises a plurality of index fields (Paragraph 29 discloses index and analyze the log file for various reasons. One application server 112 may include multiple applications that each generate a respective log file 114a through 114n),
the target log comprises a plurality of sub-logs, and each sub-log of the plurality of sub-logs corresponds to at least one index field of the plurality of index fields (Paragraph 29 discloses index and analyze the log file for various reasons. One application server 112 may include multiple applications that each generate a respective log file 114a through 114n); and
the method further comprises:
determining, for each sub-log of the plurality of sub-logs, log attribute information of the sub-log, and storing the log attribute information of the sub-log into a corresponding index field, wherein the log attribute information is used for querying a corresponding sub-log (Paragraph 56 discloses decoder 152 repeats this process for each string in the received message, for example, for each string in the snippet 600 of FIG. 6 until the message from the log file 200 is reconstructed at the destination computing device 150. Then, the data analytics tools 153 may index and perform one or more data analytics operations on the data).
The Tiwari et al. reference as modified by JHA et al. [1] and Balaiah et al. teaches all the limitations of claim 1. Regarding claim 4, JHA et al. [1] discloses the method according to claim 1, wherein after the determining, based on the storage attribute information of the target log, a storage address of the target log, and storing the target log into the storage address, the method further comprises:
receiving a log query request sent from the client, wherein the log query request carries log information to be queried (Paragraph 49 discloses a log query service 704 that processes queries received from an interface 706. A typical query is a request for a number of log messages of a particular event type generated within a time interval called a “query time interval.”); and
searching, based on the log information to be queried, a target log content corresponding to the log information to be queried, and sending the target log content to the client (Paragraph 49 discloses a log query service 704 that processes queries received from an interface 706. A typical query is a request for a number of log messages of a particular event type generated within a time interval called a “query time interval.”). The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Tiwari et al. reference and the JHA et al. [1] reference is applicable to dependent claim 4.
The Tiwari et al. reference as modified by JHA et al. [1] and Balaiah et al. teaches all the limitations of claim 4. Regarding claim 5, JHA et al. [1] discloses the method according to claim 4, wherein the log information to be queried comprises log attribute information to be queried or log content information to be queried (Paragraph 49 discloses a log query service 704 that processes queries received from an interface 706. A typical query is a request for a number of log messages of a particular event type generated within a time interval called a “query time interval.”);
the header region further comprises an index field region, the index field region comprises a plurality of index fields, and the plurality of index fields are used for storing log attribute information; and the searching, based on the log information to be queried, a target log content corresponding to the log information to be queried, comprises:
searching, based on the log attribute information to be queried, target log attribute information matched with the log attribute information to be queried, from the index field region (Paragraph 49 discloses a log query service 704 that processes queries received from an interface 706. A typical query is a request for a number of log messages of a particular event type generated within a time interval called a “query time interval.”), and
searching, based on the target log attribute information, the target log content associated with the target log attribute information from a region corresponding to the storage address; or
searching, based on the log content information to be queried, the target log content matched with the log content information to be queried from a region corresponding to the storage address. The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Tiwari et al. reference and the JHA et al. [1] reference is applicable to dependent claim 4.
The Tiwari et al. reference as modified by JHA et al. [1] and Balaiah et al. teaches all the limitations of claim 4. Regarding claim 7, Tiwari et al. discloses the method according to claim 1, wherein the log structure of the target log further comprises a protocol header, the protocol header is used for storing protocol information, and the protocol information comprises at least one selected from a group comprising a version number of the preset log transfer protocol, a log compression algorithm type, a log length, and protocol verification information, the version number of the preset log transfer protocol is used for characterizing a version of a log transfer protocol that is used for generating the target log (Paragraph 19 discloses encoding mechanism results in a reduced-size payload that may then be further compressed using a compression algorithm);
the log compression algorithm type refers to a compression algorithm for compressing the raw log; the log length is used for indicating a maximum amount of data of a log to be encoded (Paragraph 19 discloses encoding mechanism results in a reduced-size payload that may then be further compressed using a compression algorithm); and
the protocol verification information is used for verifying whether there is an error in the target log relative to the raw log (Paragraph 23 discloses application log file may contain errors, informational events, warnings, transactional information, and other information).
With respect to claim 8, Tiwari et al. teaches a log processing method, comprising:
obtaining a raw log, and encoding, based on a preset log transfer protocol, the raw log to obtain a target log (Paragraph 27 discloses encoding the log data in a manner that reduces the payload size of the information transferred over the network);
wherein a log structure of the target log comprises a header region and a content region, the header region comprises a routing field region, the routing field region is used for storing storage attribute information of the target log, and the content region is used for storing a log content (Paragraph 29 discloses index and analyze the log file for various reasons. One application server 112 may include multiple applications that each generate a respective log file 114a through 114n); and
sending the target log to a server (Paragraph 29 discloses index and analyze the log file for various reasons. One application server 112 may include multiple applications that each generate a respective log file 114a through 114n). Tiwari et al. discloses to cause the server to determine a storage address of the target log based on the storage attribute information in the routing field region.
However, JHA et al. [1] discloses to cause the server to determine a storage address of the target log based on the storage attribute information in the routing field region (Paragraph 64 discloses stores information that maps each data center tenant to a location where each tenant's log message data is stored in one of the databases 710-712 and Paragraph 64 discloses determining the event type of each log message by considering each log message as a set of tokens separated by non-printed characters referred to as “white space.”), and
storing the target log into the storage address (Paragraph 66 discloses log message classifier determines an event type label, counts the number of log messages in each one second time interval with the same event type, time stamp of the one second time interval (e.g., beginning of the one second interval), sample text of the event type, the time unit and system identification (i.e., id) and records this information in a second-level aggregated record).
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify over Tiwari et al. with JHA et al. [1] to include determining, based on the storage attribute information of the target log, a storage address of the target log. This would have facilitated log storage and retrieval. See JHA et al. Paragraphs 3-5.
However, Balaiah et al. teaches wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice (Paragraph 64 discloses Log data generated for every transaction is compressed, tokenized, and exported over secure Transport Layer Security (TLS) connections to the log routers 154 that direct the logs to the storage cluster 156, hosted in the appropriate geographical region, for each organization);
wherein the determining, based on the storage attribute information of the target log, a storage address of the target log, comprises:
searching, based on the storage attribute information of the target log, a target storage address corresponding to the storage attribute information of the target log from a pre-constructed corresponding relationship between storage attribute information and storage address, and determining the target storage address as the storage address of the target log (Paragraph 292-293 discloses identify the endpoints is to mine the application's log, e.g., database and registry entries, on the user device 300, for this information and initiate probes to them, when needed, periodically, etc. The thick client application can include application logs which is a rich set of data written into local files, databases, registry, etc., by parsing these, we can get a clear insight into the application behavior and the network endpoints they are communicating with)
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify over Tiwari et al. and JHA et al. with Balaiah et al. to include wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice. This would have facilitated log storage and retrieval. See Balaiah et al. Paragraph(s) 7.
The Tiwari et al. reference as modified by JHA et al. [1] teaches all the limitations of claim 8. Regarding claim 9, Tiwari et al. discloses the method according to claim 8, wherein the raw log comprises a plurality of raw sub-logs, each raw sub-log comprises a plurality of key-value pairs, and each key-value pair comprises a keyword and a key-value (Paragraph 39 discloses The log file 200 includes multiple strings of log data. In this example, the log file 200 is an example from a domain controller log. Each string of data includes multiple positions in the string and multiple words in the string with each word occupying one of the positions); and
the encoding, based on a preset log transfer protocol, the raw log to obtain a target log, comprises:
determining, for the plurality of raw sub-logs, at least one identical raw keyword present in the plurality of raw sub-logs (Paragraph 39 discloses The log file 200 includes multiple strings of log data. In this example, the log file 200 is an example from a domain controller log. Each string of data includes multiple positions in the string and multiple words in the string with each word occupying one of the positions); and
for each identical raw keyword, replacing the raw keyword with a target keyword to obtain a plurality of new raw sub-logs (Paragraph 66 discloses replacing position “2” 932 word [12524] in signature 905 with position “2” 932 word [4432] from string 903, and replacing position “4” 934 word “marimba.com” in signature 905 with position “4” word 934), and
encoding the plurality of new raw sub-logs, wherein a byte length of the target keyword is less than a byte length of the raw keyword (Paragraph 27 discloses encoding the log data in a manner that reduces the payload size of the information transferred over the network).
The Tiwari et al. reference as modified by JHA et al. [1] teaches all the limitations of claim 8. Regarding claim 10, JHA et al. [1] discloses the method according to claim 8, further comprising:
generating a log query request in response to a query operation, wherein the log query request carries log information to be queried (Paragraph 49 discloses a log query service 704 that processes queries received from an interface 706. A typical query is a request for a number of log messages of a particular event type generated within a time interval called a “query time interval.”);
sending the log query request to the server, wherein the log query request is used for searching a target log content corresponding to the log information to be queried (Paragraph 49 discloses a log query service 704 that processes queries received from an interface 706. A typical query is a request for a number of log messages of a particular event type generated within a time interval called a “query time interval.”); and
receiving the target log content, corresponding to the log information to be queried, sent from the server (Paragraph 49 discloses a log query service 704 that processes queries received from an interface 706. A typical query is a request for a number of log messages of a particular event type generated within a time interval called a “query time interval.”). The motivation to combine statement previously provided in the rejection of independent claim 8 provided above, combining the Tiwari et al. reference and the JHA et al. [1] reference is applicable to dependent claim 10.
With respect to claim 11, Tiwari et al. teaches an electronic device, comprising
a processor (See Fig. 1),
a memory (See Fig. 1), and
a bus (See Fig. 1), wherein the memory stores machine-readable instructions executable by the processor, when the electronic device runs, the processor is in communication with the memory via the bus, and when the machine-readable instructions are executed by the processor, steps of a log processing method are performed by the processor, wherein the log processing method comprises:
receiving a target log sent from a client, wherein the target log is obtained by encoding a raw log with a preset field type through the client based on a preset log transfer protocol, a log structure of the target log comprises a header region and a content region, the header region comprises a routing field region, the routing field region is used for storing storage attribute information of the target log, and the content region is used for storing a log content (Paragraph 27 discloses encoding the log data in a manner that reduces the payload size of the information transferred over the network); and
decoding, based on the preset log transfer protocol, the routing field region to obtain the storage attribute information of the target log (Paragraph 27 discloses decoding the log data into the full log file for use by data analytics or other tools). Tiwari et al. discloses determining, based on the storage attribute information of the target log, a storage address of the target log.
However, JHA et al. discloses determining, based on the storage attribute information of the target log, a storage address of the target log (Paragraph 64 discloses stores information that maps each data center tenant to a location where each tenant's log message data is stored in one of the databases 710-712 and Paragraph 64 discloses determining the event type of each log message by considering each log message as a set of tokens separated by non-printed characters referred to as “white space.”), and
storing the target log into the storage address (Paragraph 66 discloses log message classifier determines an event type label, counts the number of log messages in each one second time interval with the same event type, time stamp of the one second time interval (e.g., beginning of the one second interval), sample text of the event type, the time unit and system identification (i.e., id) and records this information in a second-level aggregated record).
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify over Tiwari et al. with JHA et al. [1] to include determining, based on the storage attribute information of the target log, a storage address of the target log. This would have facilitated log storage and retrieval. See JHA et al. Paragraphs 3-5.
However, Balaiah et al. teaches wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice (Paragraph 64 discloses Log data generated for every transaction is compressed, tokenized, and exported over secure Transport Layer Security (TLS) connections to the log routers 154 that direct the logs to the storage cluster 156, hosted in the appropriate geographical region, for each organization);
wherein the determining, based on the storage attribute information of the target log, a storage address of the target log, comprises:
searching, based on the storage attribute information of the target log, a target storage address corresponding to the storage attribute information of the target log from a pre-constructed corresponding relationship between storage attribute information and storage address, and determining the target storage address as the storage address of the target log (Paragraph 292-293 discloses identify the endpoints is to mine the application's log, e.g., database and registry entries, on the user device 300, for this information and initiate probes to them, when needed, periodically, etc. The thick client application can include application logs which is a rich set of data written into local files, databases, registry, etc., by parsing these, we can get a clear insight into the application behavior and the network endpoints they are communicating with)
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify over Tiwari et al. and JHA et al. with Balaiah et al. to include wherein the target log is a log generated when a target microservice run by the client is invoked, and the storage attribute information comprises at least one selected from a group comprising a name of a microservice, a host name corresponding to the microservice, and a host network address corresponding to the microservice. This would have facilitated log storage and retrieval. See Balaiah et al. Paragraph(s) 7.
With respect to claim 13, it is rejected on grounds corresponding to above rejected claim 3, because claim 13 is substantially equivalent to claim 3.
With respect to claim 14, it is rejected on grounds corresponding to above rejected claim 4, because claim 14 is substantially equivalent to claim 4.
With respect to claim 15, it is rejected on grounds corresponding to above rejected claim 5, because claim 15 is substantially equivalent to claim 5.
With respect to claim 16, it is rejected on grounds corresponding to above rejected claim 6, because claim 16 is substantially equivalent to claim 6.
With respect to claim 17, it is rejected on grounds corresponding to above rejected claim 7, because claim 17 is substantially equivalent to claim 7.
With respect to claim 18, it is rejected on grounds corresponding to above rejected claim 1, because claim 18 is substantially equivalent to claim 1.
With respect to claim 19, it is rejected on grounds corresponding to above rejected claim 1, because claim 19 is substantially equivalent to claim 1.
With respect to claim 20, it is rejected on grounds corresponding to above rejected claim 8, because claim 20 is substantially equivalent to claim 8.
Claim(s) 6 and 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tiwari et al. (US Pub. No. 20220318019) and JHA et al. [1] (US Pub. No. 20220197879) and Balaiah et al. (US Pub. No. 20230122630) in further view of JHA et al. [2] (US Pub. No. 20220374292).
The Tiwari et al. reference as modified by JHA et al. [1] and Balaiah et al. teaches all the limitations of claim 5. Regarding claim 6, Tiwari et al. discloses the method according to claim 5, wherein the target log comprises a plurality of sub-logs (Paragraph 24 discloses a string of log data refers to a line of data or a row of data in an application log file); and
the searching, based on the log content information to be queried, the target log content matched with the log content information to be queried from a region corresponding to the storage address (Paragraph 20 discloses determines whether data strings in a log file match signatures (or signature strings) stored in memory), comprises:
decoding the target log to obtain a plurality of raw sub-logs respectively corresponding to the plurality of sub-logs, wherein each raw sub-log of the plurality of raw sub-logs comprises a plurality of log contents (Paragraph 27 discloses decoding the log data into the full log file for use by data analytics or other tools). Tiwari et al. does not disclose determining, for each log content of the plurality of log contents of each raw sub-log, a pointer of each log content in a memory.
However, JHA et al. [2] teaches determining, for each log content of the plurality of log contents of each raw sub-log, a pointer of each log content in a memory (Paragraph 139 discloses the routine “new messages” sets a pointer p to reference the ETUH for the event type of the currently considered log/event message m); and
determining, based on the log content corresponding to each pointer, a target pointer matched with the log content information to be queried, and searching the target log content from a storage address indicated by the target pointer (Paragraph 139 discloses the routine “new messages” sets a pointer p to reference the ETUH for the event type of the currently considered log/event message m).
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify over Tiwari et al. and JHA et al. [1] and Balaiah et al. with JHA et al. [2] to include determining, for each log content of the plurality of log contents of each raw sub-log, a pointer of each log content in a memory. This would have facilitated log storage and retrieval. See Yadav et al. Paragraphs 1-4.
Relevant Prior Art
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US Patent No. 11487870 is directed to Logging From User-defined Functions: Column 2 Lines 24—39 discloses Logging from UDFs is important for debuggability during development and troubleshooting issues in production. Some existing solutions recommend users to log to tables from the UDF, but this approach is not scalable and a UDF typically does not allow running SQL queries. Moreover, logging to tables is not the normal procedure that programmers are accustomed to when using programming languages (e.g., Java, Python, etc.). A log may be a record of transactions or activities that take place on a computer system. In one aspect, systems and methods are presented to provide logging support (using language-specific logging frameworks) for UDFs, and a scalable path to log at high volume to make the log data accessible to users using queries from the sandbox. Log data is treated as sensitive and handled with appropriate security policies, as with any other user data in the system.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NICHOLAS E ALLEN whose telephone number is (571)270-3562. The examiner can normally be reached Monday through Thursday 830-630.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Boris Gorney can be reached at (571) 270-5626. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/N.E.A/Examiner, Art Unit 2154
/SYED H HASAN/Primary Examiner, Art Unit 2154
Prosecution Insights