US Patent 11244058 Security tool

An apparatus includes a memory and a hardware processor. The memory stores a plurality of conversion rules. The processor receives a first log from a server. The first log indicates that the server attempted to install a software patch. The processor converts, based on the plurality of conversion rules, the first log into a different format to produce a second log and extracts a plurality of words from the second log. The processor also determines, based on the extracted words, that the software patch install failed and determines, based on the extracted words, a cause for the software patch install failure. The processor further determines a series of steps to remedy the cause and perform the series of steps to remedy the cause.