Automatic generation of event-handling rules from system log entries

摘要

Approaches to automatic generation of event handling rules are presented. In one approach, a system for automatic event handling rule generation includes a system log file, containing a syslog entry. A rule module is used to interpret the syslog entry. An entry format depository is available to the rule module, and contains a description of the general format corresponding to the syslog entry. An entry causation depository is available to the rule module, and contains both a cause for the syslog entry's creation, and a solution template corresponding to the syslog entry. The rule module uses the general format to parse information from the syslog entry, and uses that information to locate the cause and a solution template. The rule module then uses the information from the syslog entry to complete the solution template, thereby generating a rule to alter the behavior which caused the syslog entry to be created.