LEC: Log Event Correlation Architecture Based on Continuous Query

International audienceIn our rapidly evolving society, every corporation is trying to improve its competitiveness by refactoring and improving some - if not all - of its industrial software infrastructure. This goes from mainframe applications that actually handle the company’s profit generating material, to the internal desktop applications used to manage these application servers. These applications often have extended activity logging features that notify the administrators of every event encounter at runtime. Unfortunately, the standalone nature of the event logging sources renders the correlation of log event infrastructure prone to “continuous queries”. This paper describes an approach that “adapts and employs continues queries” for distributed log event correlation with the aim to solve problems that face the present log event management systems. It will present LEC architecture that analyze a set of distributed log events that follow a set of correlation rules; then the main output is a stream of correlated log events