Patent attributes
A method that involves receiving a set of first log records. The set of first log records are duplicated using key operation pairs to generate a set of second log records from the set of first log records. The set of second log records are duplicated using a second set of intervals to generate a set of third log records from the set of second log records. The set of third log records are aggregated using the second set of intervals to generate a set of aggregated log records. The set of aggregated log records includes an aggregated log record comprising a number indicating a number of events from the set of first log records that have the key, that have the operation, and that occurred during an interval of the second set of intervals. The operation is identified by comparing the aggregated log record to a server log record.
