International Business Machines Corporation
Correlating logs from multiple sources based on log content

Abstract:

A computer-implemented method for consolidating log file entries may be provided. The method comprises receiving a first log file and a second log file, determining a first characterizing feature set of a first log file entry of the first log file and a second characterizing feature set of a second log file entry of the second log file, and determining a correlation factor value of a correlation between the first log file entry and the second log file entry by classifying a relationship of the first log file entry and the second log file entry using the characterizing feature sets. The method further comprises upon determining that the correlation factor value is above a predetermined correlation factor threshold value, determining that the first log file entry and the second log file entry relate to each other and belong to a same action flow.