Site News  |   Monitor Keywords  |   Monitor Archive  |   Organizer  |   Account Info  |

Tightly-coupled synchronized selection, filtering, and sorting between log tables and log charts

Tightly-coupled synchronized selection, filtering, and sorting between log tables and log charts description/claims

The present invention relates generally to an event detection and monitoring system and specifically, relates to displaying event data in both tabular and chart formats. The tabular and chart format data are tightly-coupled so that when a user selects an event in one format, the corresponding event in the other format is highlighted.

An event detection and monitoring system detects the occurrence of a system event and creates a record of the event. Event log files are created by many different programs to record different types of events for later analysis, and can be sorted and ordered by categories such as time, date, event type, and the like. While log files in tabular format do provide a wealth of information about individual events in isolation, they do not readily illuminate patterns or clusters of events that in the aggregate may help to isolate or narrow a problem that may be causing the events being reported.

When an event occurs that is recorded, relevant information about the event is placed into an event log or log chart, often displayed on a computer screen. Typically, an event log or log chart is a text file with one or more lines of text describing each event. Event logs may also include sorting criteria such as time of the event or of the report, name of the event, type of event, person reporting or on the scene, error code, etc. For a reader seeking a broad overview of numerous events in context with one another, reading the text-based event log presents too much detail and obscures relationships between groups of events. Data from the event log is therefore sometimes put into a graphical format, preferably a chart, that displays only some of the data of the event log for many events simultaneously. The event log may be ongoing and updated as events occur, such as safety system monitoring and maintenance at a chemical manufacturing plant, or it may be a compilation of historical events, such as automated in-flight measurements downloaded from an aircraft after landing for analysis.

One usability problem with log tables (data presented in a tabular format) is that the format makes it difficult for a user to explore the tabular data except as individual entries of discrete events. Log tables may contain hundreds or thousands of rows of entries, which can be tedious for the user to quickly explore or navigate in order to find the desired entry or to identify a pattern of events. Conventional sorting and filtering software and controls can assist in culling the volume of data to absorb, but these do not take advantage of data visualization that can facilitate a data mining and exploring mode of interaction. Conventional sorting and filtering controls assume that users know the information they are searching for and would benefit from exploring general patterns of activity that might be more readily apparent by viewing a chart. Data visualization is a higher-level user interaction approach, and another tool for users in determining and analyzing problems. However, as the user drills down to the root of the problem using the chart presentation, the log table might provide the next level of more detailed information for problem determination. Both types of event log format presentations—tabular and chart—provide different benefits. Tight coupling between log tables and log charts provide the user with a more robust tool, facilitating data exploration and providing synergy.

Currently, there are systems capable of converting data that is in tabular format into chart format. See for example Japanese Patent Nos. 2000200302 by Nishemura Hidenori et al. and U.S. Pat. No. 4,760,418 by Watanabe et al. There are also systems capable of graphing stored data. See for example Japanese Patent No. 4243493A to Nakabayashi Kazunori et al.

There are no currently available systems known to the inventors that are capable of tightly coupling events in a log table to a log chart and events from a log chart to a log table, thereby creating two-way connections. This invention provides a two-way connection between data is a tabular format and data in a chart format.

The present invention overcomes the individual limitations of a tabular and a graphical presentation format (such as log tables and log charts) by providing a tightly coupled two-way connection between common events depicted on both of them. An event selected from the event log file is shared between the log table and the log chart. A table and chart each carry different information of the same event, and each appeals to different mental processes. For example, a graphical presentation makes patterns of faults more obvious than a columnar series of text entries (depending upon the nature of the pattern and the graph). Based on which display of an event piques a user's interest, an event from that display may be selected and the corresponding event in the other display is automatically highlighted or otherwise visually offset, according to the present invention, for maximizing the information available to the user for that event. The selection can be a single event or multiple events being selected from the table, from the chart, or via the filter from the log file that populates the table and chart. The tight coupling between log tables and log charts is also beneficial when combined with conventional sorting and filtering of the event log table.

The graphical views make user log interactions more valuable than viewing only event log tables. For example, the visual clustering of events around certain time periods readily shows repetitive problems. Such event clustering is more difficult to see in a tabular log thereby making tight coupling of log tables and log charts more valuable to users and administrators.

The present invention is embodied in one aspect as computer program embodied on a computer readable medium. The program includes computer executable instructions for displaying a first portion of the logged event in a tabular format and a second portion of the logged event in a graphical format for each of a plurality of logged or recorded events. The first portion and second portion reflect the concept that each format carries different information of the same event. Where the first portion is the whole, the second portion is a subset of the first portion. Where a parent database carries more detail for each event than is displayed in either format, the first and second portions may be only partial portions of the entire event as recorded in the separate database. The computer executable instructions further cause the display of an event in the graphical format to change in response to at least one event being selected in the tabular format, and also cause the display of an event in the tabular format to change in response to the event being selected in the graphical format. The change in display may be a highlighting or some other visual accentuation to offset the subject event from other displayed events. The present invention also includes the method that is described above as being executed by the computer program, but apart from the computer program embodiment itself.

In another aspect, a computer program embodied on a computer readable medium similar to that described above includes changing the display of a selected event in the graphical format to reflect a modification done to a selected event at the chart format. That is, a user may change a recorded event at the tabular format display, and that change will be automatically reflected in the graphical display.

Another aspect of the present invention is a system for coupling a tabular display to a graphical display. The system includes a computer readable first and second memory that may or may not be separate memory entities, a processor, and an input. The first memory stores a plurality of recorded events, each event having a first portion of data fields and a second portion of data fields. At least one data field is common to both the first and second portion, but the first and second portions are not identical (at least one data field differs). In the Figures described herein, time is the common data field, though that is only illustrative. The processor is coupled to the first memory, and arranges the first portion into a tabular format and the second portion into a graphical format. The tabular and graphical formats are combined into an output signal that, when output to a monitor, enables the monitor to display both formats simultaneously as is shown by way of example in FIGS. 2A-2B. The input is coupled to the processor to receive a first and a second user input. The first user input selects the first portion of one or more recorded events, such as an event displayed in the tabular format. Similarly, the second user input selects the second portion of one or more recorded events, such as an event displayed in the graphical format. A third user input filters the plurality of events according to one of the data fields. The second memory is coupled to the processor, and stores computer instructions that operate in response to the user inputs. Specifically, the computer instructions of the second memory operate to alter the output signal so that the recorded event selected by either of the first or second user input is visually offset from other recorded events in both the tabular format and the graphical format. This is true for both the first and second user inputs, so whether the user selects a recorded event in the tabular format or the graphical format, the selection is reflected in both simultaneously displayed formats. The third user input filters the plurality of events, so the computer instructions of the second memory operate in response to the third user input to alter the output signal so that only a subset of the plurality of recorded events are included in the output signal. That subset is consistent with the filtering of the third user input.

These and additional features of the present invention will become more clearly apparent when the following detailed description is read in conjunction with the accompanying drawings.

FIG. 1 is a computer system that may be used to practice the present invention and displaying a log chart and log table consistent with the present invention.

FIG. 2A is a graphical representation of events and alerts shown along a time line.

FIG. 2B is a tabular representation of some of the events and alerts shown in FIG. 2A.

FIG. 3 is a flow chart depicting the process for adding events to a log chart and to a log table.

• Provisional Patent
• Utility Patent

• What Is a Patent?
• What Is a Trademark or Servicemark?
• What Is a Copyright?
• Patent Laws