DETAILED ACTION
This Action is a response to the filing received 14 August 2024. Claims 1-20 were originally presented. In a Preliminary Amendment filed 29 October 2024, claims 1-20 were canceled and claims 21-40 were newly added. Claims 21-40 remain pending for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Applicant’s claim for the benefit of a prior-filed application under 35 U.S.C. 119(e) or under 35 U.S.C. 120, 121, 365(c), or 386(c) is acknowledged.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 14 August 2024 is being considered by the examiner.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. § 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 21-40 are rejected under 35 U.S.C. § 112(b) as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor regards as the invention.
Claim 21 recites the limitation “the one or more log token units in a ordered series of one or more log token units of the log entry.” The claim does not previously make mention of one or more log token units. Claims 28 and 35 also recite this limitation and similarly lack antecedent basis for this limitation. Claims 22-27, 29-34 and 36-40 do not include additional language which cures this antecedent basis issue.
Claim 21 additionally recites the limitation "the previously initialized log template" in line 16. There is insufficient antecedent basis for this limitation in the claim. The claim previously recites only “a log template” and “the updated log template.” Claims 28 and 35 also recite the limitation “the previously initialized log template” and similarly lack antecedent basis for this limitation. Claims 22-27, 29-34 and 36-40 do not include additional language which cures this antecedent basis issue. Accordingly, claims 21-40 are rejected as indefinite for insufficient antecedent basis.
For the purpose of compact prosecution, Examiner is interpreting “the one or more log token units in a ordered series of one or more log token units of the log entry” to refer to one or more token units in an ordered series of one or more log token units of the log entry obtained from the log stream. Further, Examiner is interpreting the term “the previously initialized log template” to refer to the initial “a log template” prior to the application of updates. While the claims do not recite “an updated log template” prior to the recitation of the term “the updated log template,” it is contextually clear that “the updated log template” refers to “a/the log template” subsequent to application of the updates.
Claim Rejections - 35 USC § 101
35 U.S.C. § 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 21-40 are rejected under 35 U.S.C. § 101 because the claimed invention is directed to an abstract idea without significantly more.
At Step 1, the claims are evaluated for whether they fall within one of the statutory categories of patent-eligible subject matter. Claims 21-27 recite machines; claims 28-34 recite processes; and claims 35-40 recite articles of manufacture. The analysis accordingly proceeds to Step 2.
At Step 2A, Prong 1, the claims are evaluated for whether they recite (set forth or describe) a judicial exception, such as an abstract idea (MPEP § 2106.04(II)). Abstract ideas include mental processes – concepts performed in the human mind, including observations, evaluations, judgments or opinions (MPEP § 2106.04(a)).
Claim 21 recites the following mental process steps: (1) determine that a log template matches a log entry obtained from a log stream based at least in part on one or more anchor tokens for a previous received log entry that matches one of the one or more log token units in a ordered series of one or more log token units of the log entry; (2) determine one or more updates to the log template; and (3) determine that the updated log template matches a further log entry obtained from the log stream.
Element (1) recites an observation, evaluation or judgment that a human user may perform in the mind that one or more anchor token units for a previously received log entry matches one of the one or more log token units in an ordered series of token units in a subsequently received log entry, and that, therefore, a log template matches the log entry. This is a simple comparison of first data to second data, which in some embodiments comprises human-readable plain language text.
Element (2) recites an observation, evaluation or judgment that a human use may perform in the mind that based on some information, a log template should be updated. For example, when reviewing a series of log entries, the human user may identify a repeating pattern in the log entries not captured in the log template, and determine that the log template should be updated to be consistent with the pattern.
Element (3) recites an observation, evaluation or judgment that one or more log entries received subsequent to the update of the log template is a match for the updated log template. Like the initial determination, this is a simple comparison of first data to second data which may comprise human-readable plain language text.
As claim 21 is found to recite an abstract idea, the analysis proceeds to Step 2A, Prong 2, where the claims are evaluated for whether they recite additional elements which integrate the abstract idea into a practical application.
The additional elements of claim 21 include: (1) a system comprising one or more processors and memory storing program instructions executable by the processor to cause the processor to implement on online log parser which performs the claimed functions; (2) applying the one or more updates to update the log template; and (3) providing the ordered series of the one or more log token units and a log template based on the previously initialized log template to a destination for a parsed version of the log stream.
Element (1) recites a general-purpose computer on which the steps of the log parser are performed, or the use of a general-purpose computer as a tool to perform the abstract idea steps identified above. This does not rise to the level of a particular machine or to an improvement in the functioning of a computer. Elements (2) and (3) are insignificant applications; that is, they recite the idea of a solution or an outcome to an application of the result of the identified mental process steps at a high level of generality. Whether these elements are considered individually or in any combination, or whether the claim is considered as a whole, these additional elements do not integrate the abstract idea into a practical application.
The analysis therefore proceeds to Step 2B, where the claims are evaluated for whether they recite additional elements that amount to significantly more than the abstract idea. The analysis provided with respect to Step 2A, Prong 2 is incorporated, and the additional elements are further evaluated for whether they recite other than what is well-understood, routine or conventional in the field. Element (1) recites a general-purpose computer for performing its well-understood, routine and/or conventional functions (i.e., a processor for executing instructions – performing repetitive calculations; and a memory that stores instructions and from which the instructions may be retrieved). As element (2) recites an insignificant application at a high level of generality, it is not further evaluated here. And even should element (3) be considered an output of the results of the abstract idea, presenting an output on a GUI on a local or remote computer is consistent with storage or retrieval of data from memory and/or over a network. Whether considered individually or in any combination, or whether the claim is considered as a whole, these additional elements do not amount to significantly more than the abstract idea. Accordingly, claim 21 is ineligible under 35 U.S.C. § 101.
Claims 28 and 35 are ineligible for similar reasons as those presented with respect to claim 21. Claim 28 recites a process for performing the claimed steps; and claim 35 recites non-transitory computer-readable media on which processor-executable program instructions are stored and which cause a computing device to implement the claimed steps. These additional elements recite either the statutory category or the use of a general-purpose computer to perform the method steps.
Claims 22-26, 29-33 and 36-40 recite types of updates that may be made to the log template. Each of these is an observation, evaluation or judgment that a human user may perform in the mind based on data patterns observed in log entries that a log template should be updated based on the patterns.
Claims 27 and 34 recite that the online log parser is implemented as part of a service of a provider network. This additional element sets forth a distributed computing service at a high level, and accordingly does not recite a particular machine or an improvement in the functioning of a computer or other technology. Accordingly, it does not integrate the abstract idea into a practical application or recite significantly more than the abstract idea.
In view of the foregoing, claims 22-40 are also ineligible under 35 U.S.C. § 101.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. §§ 102 and 103 (or as subject to pre-AIA 35 U.S.C. §§ 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. § 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. § 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 21-23, 25-30, 32-37 and 39-40 are rejected under 35 U.S.C. § 103 as being unpatentable over Chan et al., U.S. 2023/0093225 A1 (“Chan”)1 in view of Gaudin et al., U.S. 11,494,275 B1 (“Gaudin”).
Regarding claim 21, Chan teaches: A system (Chan, e.g., FIG. 3 and ¶48, disclosing processing system), comprising:
one or more processors (Chan, e.g., FIG. 3, processors 21a-21c); and
a memory, that stores program instructions that, when executed by the at least one processor, cause the one or more processors to implement (Chan, e.g., FIG. 3 and ¶48, “Processors 21 are coupled to system memory 34 …” See also, e.g., ¶69, “a computer readable storage medium (or media) having computer readable instructions thereon for causing a processor to carry out aspects …”) an online log parser (Chan, e.g., ¶52, “methods, systems, and computer program products for annotating a log based on processing log documentation …”), configured to:
determine that a log template matches a log entry obtained from a log stream, based, at least in part, on one or more anchor tokens for a previous received log entry that matches one of the one or more log token units in a ordered series of one or more log token units of the log entry (Chan, e.g., ¶55, “matching process identifies the tokens in log messages that correspond to variables in its template …” See also, e.g., ¶56, “method includes an anchor based divide-and-conquer tree matching algorithm. An anchor is a sequence of consecutive constant keywords in a log message … log message is divided at these anchors, and the tokens in between the anchors is matched with each corresponding subtree. The tree matching is … depth first …” See also, e.g., ¶57, “method 600 also includes determining whether the entry of the log corresponds to a template of the set of log entry templates …”); …; and
provide the ordered series of the one or more log token units and a log template based on the previously initialized log template to a destination for a parsed version of the log stream (Chan, e.g., ¶58, “Based on a determination that the entry of the log corresponds to the template … the method 600 … includes annotating the entry based on the corresponding log entry template … and stores each value of the one or more variables in a dictionary …”).
Chan does not more particularly teach determining and applying one or more updates to the log template, and determining that the updated log template matches a further log entry obtained from the log stream. However, Gaudin does teach: determine one or more updates to the log template; apply the one or more updates to update the log template; determine that the updated log template matches a further log entry obtained from the log stream (Gaudin, e.g., 14:45-56, “generating a model for a set of log statements … that generate log entries … process determines that the set of log statements has changed … provides the model(s) to log entry analyzer … [and] receives modified log statement(s). The process ends at 765 by updating index 145 for search, alert(s), and detected outlier(s).” Examiner’s note: the index maintains information regarding log templates and a map file, the map file mapping log format strings (associated with templates) and trigger patterns which create alerts for analyzed log entries; see Gaudin at, e.g., 7:31-8:8 and 9:58-10:30) for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, e.g., 6:3-8:8).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system and method for processing log entries using templates as taught by Chan to provide for determining and applying one or more updates to the log template, and determining that the updated log template matches a further log entry obtained from the log stream because the disclosure of Gaudin shows that it was known to those of ordinary skill in the pertinent art to improve a system and method for dynamic pattern-based log entry processing and analysis to provide for determining and applying one or more updates to the log template, and determining that the updated log template matches a further log entry obtained from the log stream for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, Id.).
Claims 28 and 35 are rejected for the reasons given in the rejection of claim 21 above. Examiner notes that with respect to claim 28, Chan further teaches: A method (Chan, e.g., ¶52, “methods, systems, and computer program products for annotating a log based on processing log documentation …”), comprising: [[[the operations performed by the system of claim 21]]]; and with respect to claim 35, Chan further teaches: One or more non-transitory computer-readable storage media storing program instructions that, when executed on or across one or more computing devices, cause the one or more computing devices (Chan, e.g., ¶52, “methods, systems, and computer program products for annotating a log based on processing log documentation …” See also, e.g., ¶69, “a computer readable storage medium (or media) having computer readable instructions thereon for causing a processor to carry out aspects …”) to implement: [[[the operations performed by the system of claim 21]]].
Regarding claim 22, the rejection of claim 21 is incorporated, but Chan does not more particularly teach that the updates comprise a token type conversion. However, Gaudin does teach: wherein the one or more updates comprises a token type conversion (Gaudin, e.g., 10:31-62, describing a conversion of a log statement format from “There’ll be {} green bottles hanging on the wall” to “{} green bottles hanging on the wall,” wherein {} is a variable token and the other words are constant tokens; see also, e.g., 11:31-50, “Buildtime engine 120 detects changes to log format strings of log statements (e.g., to fixed parts or variable parts) … creating a logging library at runtime … with the ability to specify alerts in program source code … the ability to enhance the logging library with metadata (e.g., alerts and special values (color, amount, and the like, for ‘bottle’ …” Examiner’s note: an update from “There’ll be {amount} green bottles hanging on the wall” to “There’ll be {amount} {color} bottles hanging on the wall,” for example, represents a conversion of the constant token “green” to variable token “{color}”) for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, e.g., 6:3-8:8).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system and method for processing log entries using templates as taught by Chan to provide that the updates comprise a token type conversion because the disclosure of Gaudin shows that it was known to those of ordinary skill in the pertinent art to improve a system and method for dynamic pattern-based log entry processing and analysis to provide that the updates comprise a token type conversion for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, Id.).
Regarding claim 23, the rejection of claim 22 is incorporated, and Gaudin further teaches that the token type conversion converts a constant token to a variable token: wherein the token type conversion converts a constant token to a variable token (Gaudin, e.g., 10:31-62, describing a conversion of a log statement format from “There’ll be {} green bottles hanging on the wall” to “{} green bottles hanging on the wall,” wherein {} is a variable token and the other words are constant tokens; see also, e.g., 11:31-50, “Buildtime engine 120 detects changes to log format strings of log statements (e.g., to fixed parts or variable parts) … creating a logging library at runtime … with the ability to specify alerts in program source code … the ability to enhance the logging library with metadata (e.g., alerts and special values (color, amount, and the like, for ‘bottle’ …” Examiner’s note: an update from “There’ll be {amount} green bottles hanging on the wall” to “There’ll be {amount} {color} bottles hanging on the wall,” for example, represents a conversion of the constant token “green” to variable token “{color}”) for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, e.g., 6:3-8:8).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system and method for processing log entries using templates as taught by Chan to provide that the token type conversion converts a constant token to a variable token because the disclosure of Gaudin shows that it was known to those of ordinary skill in the pertinent art to improve a system and method for dynamic pattern-based log entry processing and analysis to provide that the token type conversion converts a constant token to a variable token for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, Id.).
Claims 29-30 and 36-37 are rejected for the additional reasons given in the rejections of claims 22-23 above.
Regarding claim 25, the rejection of claim 22 is incorporated, but Chan does not more particularly teach that the updates comprise an update to a regular block of the template comprising free-form text. However, Gaudin does teach: wherein the one or more updates comprises an update to a regular block of the template comprising free-form text (Gaudin, e.g., 9:1-23, “Log alert manager 130 generates template 135(1) for log statement 170(1) to track changes to fixed part 205(1) of log format string 175(1) … that causes a problematic and potentially dangerous mismatch between trigger pattern 155(1) of alert configuration 150(1) and log string 190(1) … tracks a modification to fixed part 205(1) of log format string 175(1) … using template 135(1) and updates trigger pattern 155(1) of alert configuration 150(1) … Once buildtime engine 120 determines that fixed part 205(1) of log format string 175(1) has been modified, log alert manager 130 creates or generates map file 140 that indicates a mapping correlation between trigger pattern 155(1) of alert configuration 150(1) and log statement 170(1) (and subsequent updates …”) for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, e.g., 6:3-8:8).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system and method for processing log entries using templates as taught by Chan to provide that the updates comprise an update to a regular block of the template comprising free-form text because the disclosure of Gaudin shows that it was known to those of ordinary skill in the pertinent art to improve a system and method for dynamic pattern-based log entry processing and analysis to provide that the updates comprise an update to a regular block of the template comprising free-form text for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, Id.).
Regarding claim 26, the rejection of claim 22 is incorporated, but Chan does not more particularly teach that the updates comprise an update to a data block of the template that follows a syntax. However, Gaudin does teach: wherein the one or more updates comprises an update to a data block of the template that follows a syntax (Gaudin, e.g., 10:43-62, describing a change in the syntax of a program logging statement, and 11:11-50, describing the tracking of the change and the update of a log format template consistent with the syntax change (i.e., updating a log format template that follows a first syntax to a log format template that follows a second syntax) for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, e.g., 6:3-8:8).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system and method for processing log entries using templates as taught by Chan to provide that the updates comprise an update to a data block of the template that follows a syntax because the disclosure of Gaudin shows that it was known to those of ordinary skill in the pertinent art to improve a system and method for dynamic pattern-based log entry processing and analysis to provide that the updates comprise an update to a data block of the template that follows a syntax for the purpose of updating log templates and related alert triggers such that changes in the formatting or contents of log statements in software do not fail to result in desired notification of log entries of interest (Gaudin, Id.).
Claims 32-33 and 39-40 are rejected for the additional reasons given in the rejections of claims 25-26 above.
Regarding claim 27, the rejection of claim 22 is incorporated, but Chan does not more particularly teach that the online log parser is implemented as part of a service of a provider network. However, Gaudin does teach: wherein the online log parser is implemented as part of a service of a provider network (Gaudin, e.g., 4:61-5:5, “log management server 105 that implements a log data manager 110 and a log alert manager …” See also, e.g., 5:22-26, “Log alert manager 130 includes at least templates 135(1)-(N) … a map file 140 … and an index 145 …” See also, e.g., 5:37-58, “Log management server 105 also manages, maintains, configures, and stores alert configurations []. Each alert configuration [] includes one or more trigger patterns []. A trigger pattern, when matched, fires (or sends) an alert (e.g., to a security analyst) when a given log statement executes … and a given log line is generated … Log management server 105 is communicatively coupled to one or more clients via network …”) for the purpose of facilitating the configuration of alert generation and notification to diverse users of a system such as for security evaluation purposes (Gaudin, e.g., 4:61-6:14).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system and method for processing log entries using templates as taught by Chan to provide that the online log parser is implemented as part of a service of a provider network because the disclosure of Gaudin shows that it was known to those of ordinary skill in the pertinent art to improve a system and method for dynamic pattern-based log entry processing and analysis to provide that the online log parser is implemented as part of a service of a provider network for the purpose of facilitating the configuration of alert generation and notification to diverse users of a system such as for security evaluation purposes (Gaudin, Id.).
Claim 34 is rejected for the additional reasons given in the rejection of claim 27 above.
Claims 24, 31 and 38 are rejected under 35 U.S.C. § 103 as being unpatentable over Chan in view of Gaudin, and in further view of Masson et al., U.S. 11,238,069 B2 (“Masson”).
Regarding claim 24, the rejection of claim 22 is incorporated, but Chan in view of Gaudin does not more particularly teach that the updates comprise a counter property update of a template token. However, Masson does teach: wherein the one or more updates comprises a counter property update of a template token (Masson, e.g., 9:39-10:5, “to be clustered together, data entries 118 include the same token types in the same order, after any consolidation rules have been applied … cluster includes a sequence of tokens in a particular order and a count of the number of entries represented by the cluster, which can be referred to as a cluster pattern … clustering attributes are analyzed by the collector to determine whether a data entry should be added to the cluster … collector is configured to maintain the counter for the cluster and other statistics for the cluster, track the distribution of the data entries in the cluster …” See also, e.g., FIG. 5) for the purpose of facilitating data reduction in the processing and analysis of log entries, such that a more efficient method is provided for identifying more unique, and therefore more likely anomalous, log entries (Masson, e.g., 5:48-6:14).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system and method for processing log entries using templates as taught by Chan in view of Gaudin to provide that the updates comprise a counter property update of a template token because the disclosure of Masson shows that it was known to those of ordinary skill in the pertinent art to improve a system and method for pattern-based log entry processing and analysis to provide that the updates comprise a counter property update of a template token for the purpose of facilitating data reduction in the processing and analysis of log entries, such that a more efficient method is provided for identifying more unique, and therefore more likely anomalous, log entries (Masson, Id.).
Claims 31 and 38 are rejected for the additional reasons given in the rejection of claim 24 above.
Conclusion
Examiner has identified particular references contained in the prior art of record within the body of this action for the convenience of Applicant. Although the citations made are representative of the teachings in the art and are applied to the specific limitations within the enumerated claims, the teaching of the cited art as a whole is not limited to the cited passages. Other passages and figures may apply. Applicant, in preparing the response, should consider fully the entire reference as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art and/or disclosed by Examiner.
Examiner respectfully requests that, in response to this Office Action, support be shown for language added to any original claims on amendment and any new claims. That is, indicate support for newly added claim language by specifically pointing to page(s) and line number(s) in the specification and/or drawing figure(s). This will assist Examiner in prosecuting the application.
When responding to this Office Action, Applicant is advised to clearly point out the patentable novelty which he or she thinks the claims present, in view of the state of the art disclosed by the references cited or the objections made. He or she must also show how the amendments avoid such references or objections. See 37 C.F.R. 1.111(c).
Examiner interviews are available via telephone and video conferencing using a USPTO-supplied web-based collaboration tool. Applicant is encouraged to submit an Automated Interview Request (AIR) which may be done via https://www.uspto.gov/patent/uspto-automated-interview-request-air-form, or may contact Examiner directly via the methods below.
Any inquiry concerning this communication or earlier communication from Examiner should be directed to Andrew M. Lyons, whose telephone number is (571) 270-3529, and whose fax number is (571) 270-4529. The examiner can normally be reached Monday to Friday from 10:00 AM to 6:00 PM ET. If attempts to reach Examiner by telephone are unsuccessful, Examiner’s supervisor, Wei Mui, can be reached at (571) 272-3708. Information regarding the status of an application may be obtained from the Patent Center system. For more information about the Patent Center system, see https://www.uspto.gov/patents/apply/patent-center. If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call (800) 786-9199 (in USA or Canada) or (571) 272-1000.
/Andrew M. Lyons/Primary Examiner, Art Unit 2191
1 As this reference is cited in the 14 August 2024 IDS, it is not cited in the attached PTOL-892.
Prosecution Insights