An Apple patent (number 20110066973) for rendering system log data has appeared at the US Patent & Trademark Office.

Per the patent, messages generated by processes on a computer system are aggregated into process groups. The process groups can be displayed in a single user interface using a number of graphs and plots to provide a holistic view of message activity for a given process group, and for all processes running on the computer system. The inventors are Richard Plom and ALi Sazegari.

Here's Apple's background and summary of the invention: "Modern computer systems can have many processes running at the same time. Some of these processes generate system log data, which describe the health or status of the process. Conventional operating systems may include a simple message or log viewer that displays system log data as a flat list of messages. A flat list of messages, however, does not provide the user with a sense of trends or interaction between processes.

"Messages generated by processes on a computer system can be aggregated into process groups. The process groups (e.g., applications, system, disk, network security) can be displayed in a single user interface using a number of graphs and plots to provide a holistic view of message activity for a given process group, and for all process groups running on the computer system.

"In some implementations, messages for process groups can be displayed in a compound or grouped bar graph where each segment of the bar is associated with a different process group (hereafter "process group segment"), and each grouped bar graph can be associated with a message type (e.g., emergency, alert, critical, error, warning, notice, info, debug). The grouped bar graphs can indicate to a user message activity for each process group. The user can select (e.g., point and click) a process group segment of a grouped bar graph to get more detailed information about the messages generated by the process group.

"The detailed information can also be displayed as graphs to indicate a quantity of messages of a particular message type (e.g., horizontal bar graphs). A given grouped bar graph can be arranged as a side-by-side, joined or adjoining version; it may also have the bars partway on top of each other or overlapping. In some implementations, opposing or paired bars can be displayed. In some implementations, the process group segments of a grouped bar graph can be color coded with a color specified by the user.

"In some implementations, a single user interface combines graphs (e.g., bar graphs, pie charts) and plots of process group messages with a message viewer for displaying messages. The messages displayed in the message viewer can be color coded to visually show the relationship between messages, message types and process groups. The user can "drill down" on a process group segment of a grouped bar graph (e.g., click or touch the segment) to view messages associated with the selected process group segment.

"In some implementations, message activity from all process groups can be aggregated into a single, scrollable plot or curve to indicate total message activity on the computer system. The plot can include markers for indicating times where messages of a certain message type (e.g., alert messages) have occurred.

"In some implementations, an interactive user interface element can be included in the user interface for filtering the display of messages by message type. Also, interactive user interface elements can be provided to allow a user to manage process groups and rules for filtering and displaying messages."

-- Dennis Sellers