LOG DATA

Technical field

[0001 ] The present disclosure relates generally to a method, system, computer program and a computer readable storing medium for prioritization of stored log data, the log data generated by nodes in a communications network.

Background

[0002] Today's communication networks are complex technical solutions. For example telecommunication networks have evolved from fixed line circuit switched networks into both fixed and mobile networks. The communication is moving from circuit switched into packet switched. An increasing number of services are deployed in the networks, besides voice communication. The wireless access in mobile communication networks utilizes more and more advanced technologies to facilitate higher data throughput, less delay and jitter, and higher density.

[0003] The communication networks are built on a variety of nodes and may comprise different options for how to enable communication and different features accompanying the communication.

[0004] For example, a mobile network operator collects a huge amount of data from different nodes in the network. This data is stored in different databases; potentially residing in different locations, and using different database

technologies.

[0005] An example of a common type of database may be a relational database using Structured Query Language, SQL or similar relational databases, where a database may contain a set of schemas, where each schema may have a set of tables. For example, there could be a cell event schema with tables for each type of cell events, including Radio Resource Connection, RRC, setup, Radio Access Bearer, RAB, establishment, system release, system utilization, etc. A database table or schema may also have a unique identifier, which can be used globally in the network to identify the database tables.

[0006] Two examples of database tables from network operators are event tables and statistical tables. For event tables, it may be a table for each type of event; and the columns may comprise node id, timestamp, as well as other attributes to explain an event. For example, an event table related to system releases may contain columns node id and timestamp respectively, showing the node and time of these events. Sometimes, a user ID is also present to indicate which user performed the system release.

[0007] In the case of statistical type of database tables, the columns may include node id, timestamp, and a value. The value could be a Key Performance Indicator, KPI, a counter or some aggregated value and the value is usually reported in regular intervals. For example, the cell KPI counter schema may have a table for each KPI type, and the columns include timestamp, cell id, and KPI value.

[0008] In the area of data lifecycle management, DLM, there are different approaches to managing data. An example is a policy-based approach for managing the flow of an information system's data throughout its lifecycle. A problem in managing data may be to understand how data evolves. Another problem may be to determine how data grows. Another problem may be to monitor how usage of data changes. Another problem may be to decide how long data should be stored. Yet another problem may occur in a situation when analyzing problems in a communications network. In this situation log data from different sources may be necessary, but the sources might not have been obvious before starting the analysis.

[0009] The lifetime of the log data may be static and based on the data type specified by the operator. For example, Charging Data Records, CDRs, may be saved for two years, some high intensity cell events are saved for one week, and alarms may be saved for 3 months. [00010] This static approach is simple and it has been working fine considering that each type of raw data had been used for the purposes it was conceived for, by specific tools, etc. However, assuming that data analytics applications typically may combine and/or process data from different sources for different purposes, an independent management of these data, in terms of lifetime, may represent a risk for these applications e.g. the needed data may not exist anymore because it is outdated, and a lot of data stored there may never be used.

Summary

[0001 1 ] It is an object of the invention to address at least some of the problems and issues outlined above, e.g. enabling decision on how long log data shall be stored . An object of the invention is to enable or improve the availability of important log data while avoiding storage of unnecessary log data. It is possible to achieve these objects and others by using a method and an apparatus as defined in the attached independent claims.

[00012] According to one aspect, a method is provided performed by a system for prioritization of stored log data, the log data generated by nodes in a

communications network wherein a first log data piece has been stored with a default priority. The method comprises receiving a priority trigger for the first log data piece from a priority trigger unit. The method comprises determining a new priority for the first log data piece, which new priority is different from the default priority, based on the received priority trigger for the first log data piece. The method comprises storing an entry with the new priority for the first log data piece, the entry associated with the first log data piece, in a prioritization database. The method comprises initiating handling of the first log data piece according to the stored new priority.

[00013] According to another aspect, a system is provided for prioritization of stored log data, the log data generated by nodes in a

communications network, wherein a first log data piece has been stored with a default priority, the system comprising at least one processor and at least one memory, said memory containing instructions executable by said processor. The system is operative to receive a priority trigger for the first log data piece from a priority trigger unit. The system is operative to determine a new priority for the first log data piece, which new priority is different from the default priority, based on the received priority trigger for the first log data piece. The system is operative to store an entry with the new priority for the first log data piece, the entry associated with the first log data piece, in a prioritization database. The system is operative to initiate handling of the first log data piece according to the stored new priority.

[00014] According to another aspect, a computer program comprising computer readable code means is provided which when run in a system for prioritization of stored log data, the log data generated by nodes in a communications network, wherein a first log data piece has been stored with a default priority. The computer program causes the system to perform the method of receiving a priority trigger for the first log data piece from a priority trigger unit. The computer program causes the system to perform the method of determining a new priority for the first log data piece, which new priority is different from the default priority, based on the received priority trigger for the first log data piece. The computer program causes the system to perform the method of storing an entry with the new priority for the first log data piece, the entry associated with the first log data piece, in a

prioritization database. The computer program causes the system to perform the method of initiating handling of the first log data piece according to the stored new priority.

[00015] According to another aspect, a system is provided for prioritization of stored log data, the log data generated by nodes in a communications network, wherein a first log data piece has been stored with a default priority. The system comprises a communication unit for receiving a priority trigger for the first log data piece from a priority trigger unit. The system comprises a priority determination unit for determining a new priority for the first log data piece, which new priority is different from the default priority, based on the received priority trigger for the first log data piece. The system comprises a prioritization database for storing an entry with the new priority for the first log data piece, the entry associated with the first log data piece, in a prioritization database. The system comprises the communication unit for initiating handling of the first log data piece according to the stored new priority.

[00016] The above method, system and computer program may be configured and implemented according to different optional embodiments. One possible embodiment may comprise resolving an effected second log data piece, based on a relation between the first log data piece and the second log data piece, which relation is stored as an entry in the prioritization database. One possible embodiment may comprise determining a priority for the second log data piece, based on the relation between the first log data piece and the second log data piece. One possible embodiment may comprise storing an entry with the new priority for the second log data piece associated with the second log data piece in the prioritization database.

[00017] One possible embodiment may comprise that the new priority for the first log data piece is based on a relation between the first data piece and the second log data piece. One possible embodiment may comprise that the stored entry for the priority for the first log data piece comprises a priority indicator indicating the new priority and at least one of: data entry ID, node ID, user ID, time period, log data type, and trigger function. One possible embodiment may comprise determining the relation between the first log data piece and the second log data piece by mapping the first log data piece with the second log data piece based on communication network configuration data, node configuration data, user ID, or traffic type information.

[00018] One possible embodiment may comprise that the priority trigger from the priority trigger unit comprises at least one of: priority trigger unit ID, priority trigger reason, log data type, and maximum number of steps for resolution of serial relations. One possible embodiment may comprise that the priority trigger is issued by monitoring of a log data source from a node or an Application

Programming Interface. One possible embodiment may comprise the log data source is at least one of: database entry, data file, data stream. One possible embodiment may comprise receiving a priority request for the first and/or the second log data piece from a data priority enforcement unit, foregoing the initiating of handling of the log data piece. One possible embodiment may comprise transmitting the priority for the first and/or the second log data piece to the data priority enforcement unit. One possible embodiment may comprise the handling of the first log data piece comprises at least one of: maintenance, removal, deletion, compression or storage in an archive.

[00019] Further possible features and benefits of this solution will become apparent from the detailed description below.

Brief description of drawings

[00020] The solution will now be described in more detail by means of exemplary embodiments and with reference to the accompanying drawings, in which:

[00021 ] Fig. 1 is a block diagram illustrating communication overview of the solution.

[00022] Fig 2 is a flow chart illustrating a procedure in a block diagram system.

[00023] Fig. 3 is a flow chart illustrating a procedure in the system, according to further possible embodiments.

[00024] Fig. 4 is a block diagram illustrating further possible embodiments.

[00025] Fig. 5 is a block diagram illustrating the system in more detail, according to further possible embodiments.

[00026] Fig. 6 is illustrating a network scenario.

[00027] Fig. 7 is illustrating embodiments of the solution in a cloud computing solution.

[00028] Fig. 8 is illustrating further embodiments of the solution in a cloud computing solution. [00029] Fig. 9 is illustrating embodiments of the system in more detail.

Detailed description

[00030] Briefly described, a solution is provided to prioritize log data generated in a communication network or mobile communication network, which log data that should be maintained and optionally how the log data should be handled. In a communications network operated by an operator, large amounts of log data is generated from the network. Various nodes in the network generate , for example, data logs about traffic behaviors, faults, statistics, user or subscriber behavior, service usage, service performance. The log data may be useful for network monitoring, network operation and maintenance, alarm handling, or for future planning of a network. However, to save all data may not be the best way to use data storage capacity. In a regular mobile operator network, just the event logging may correspond to 10 to 50 terra byte (TB) of data per day.

[00031 ] In future mobile networks, it is expected that many billions of devices will be connected and may generate a massive amount of data every hour. Thus, the notion of data per subscriber or node may be extended to a much higher order of magnitude. In addition to this increase in number of data sources, one should have in mind that analytics applications may need to process similar data sources over longer and longer time intervals to capture changes and trends over time of subscribers, devices, geographical areas and nodes. Moreover, after processing, new information might be generated and has to be stored.

[00032] The described solution provides a way to prioritize which log data to keep and which log data to be deleted or archived. A trigger from a data source may be utilized to enable prioritization of pieces of log data, log data pieces, such that important log data pieces may be kept as long as necessary. Non-prioritized log data pieces may be handled according to any normal procedure. The normal procedure may lead to premature deletion of log data pieces, or the normal procedure may cause unnecessary use of storage due to unreasonable long storage time of log data pieces. [00033] Relations between different log data pieces may be taken into

consideration. Log data pieces related to each other may be kept, such that better analysis may be performed, based on a more complete set of data.

[00034] Fig. 1 shows an overview of the solution used with a communications network 50. A system 60 for log data prioritization comprises a data prioritization master 100 for prioritization of log data with a prioritization database 1 10 for storage of priorities. The figure further shows a priority trigger unit 120 for provision of triggers to the data prioritization master 100 and a first log data piece 105:A. The figure also shows nodes 75 comprised by the communications network 50. In the figure the prioritization database 1 10 is illustrated comprised by the data prioritization master 100, though it should be understood that the prioritization database 1 10 may be located on a different physical or virtual node, than the data prioritization master 100.

[00035] The communications network 50 may be a mobile communications network. Examples of such mobile communication networks are Global System for Mobile Communications, GSM , 3rd generation of mobile telecommunications technology, 3G, Long Term Evolution, LTE, 5th generation mobile networks, 5G or similar future networks, or WiFi network, e.g. according to IEEE 802.1 1 , not limiting to other similar wireless networks.

[00036] The communications network 50 may be a fixed line communications network, carried by wire or optical fiber. The communication may be carried by Transmission Control Protocol/Internet Protocol, TCP/IP, Ethernet, e.g. according to IEEE 802.3, Synchronous Digital Hierarchy, SDH, Synchronous Optical

Networking, SONET, not limiting the solution to be used in other similar or suitable wireline of optical network solutions.

[00037] Fig 2. illustrates a method according to an embodiment, performed by a system 60 for prioritization of stored log data. The log data is generated by nodes 75 in the communications network 50, where the first log data piece 105:A has been stored with a default priority. The method comprises receiving S100 a priority trigger for the first log data piece 105: A from a priority trigger unit 120. The method comprises determining S1 10 a new priority for the first log data piece 105: A, which new priority is different from the default priority, based on the received priority trigger for the first log data piece 105:A. The method comprises storing S120 an entry with the new priority for the first log data piece 105:A, the entry being associated with the first log data piece 105:A, in the prioritization database 1 10. The method comprises initiating S130 handling of the first log data piece 105:A according to the stored new priority.

[00038] The nodes 75 may be different kinds of network elements in the communications network 50. The nodes 75 may be hardware based equipment such as optic filters, optic switches, radio units, base band units, physical interfaces for optical or electrical communication, switches for circuit switched communication, switches for packet based communication, routers, servers, or other types of hardware based nodes 75 in a communications network 50. The nodes 75 may alternatively be software based virtualized nodes, such as mobility management entity, MME, serving gateway, serving GPRS support node, SGSN, home subscriber server, HSS, IP Multimedia Subsystem (IMS) server, application server, or other types of software based nodes used in a communications network 50.

[00039] The first log data piece 105:A, may be a specific piece of log data information comprising specific information about an event, activities, alarms, statistics, or similar. An example of a first log data piece 105:A may be an alarm or a series of specific alarms originating from a particular node, at a specified time or during a specific time period. Another example of a first log data piece 105:A may be an activity log at a specific traffic node, for example logging all voice sessions, specifying Mobile Station International Subscriber Directory Number, MSISDN of A- and B-parties, duration, speech codecs, speech quality, packet delay and packet jitter. Another example of a first log data piece 105:A may be traffic load counted at a specific Evolved Node B, eNB, at a specific point of time or during a specific time period. A log data piece 105:A may be represented by lines of log data in a relational database, or lines in a raw text file with log data. [00040] The default priority for a first log data piece 105:A, may be defining for how long a first log data piece 105:A should be stored, or when the first log data piece 105:A should be deleted, or when the first log data piece 105:A should be removed to an archive. Some types of first log data pieces 105:A may not demand large storage volumes, for example counters. Some types of first log data pieces 105:A may demand large storage volumes, for example data packet logs or service session logs. Default priorities may be different for different kinds of first log data pieces 105:A. Important alarms may have a higher priority than general traffic counters.

[00041 ] The priority trigger may be a trigger that a first log data piece 105:A should have a different priority than the default priority. The priority trigger may be a trigger that a first log data piece 105:A should have a higher priority than the default priority. The priority trigger may be a trigger that a first log data piece 105:A should have a lower priority than previously received priority trigger. The priority trigger may be a message, for example containing any of: the identity of the node 75, a user identity, type of log data piece 105 or priority, not limiting to other content. The priority trigger may be provided as SQL-messages, Extensible Markup Language-messages, XML, http get messages and http post messages, hypertext transfer protocol, user datagram event stream, UDP, not limiting to other formats for carrying priority triggers. The priority trigger may contain information that may enable the data prioritization master 100 to resolve which data pieces 105:A that should be prioritized based on priority trigger. The priority trigger is further exemplified in relation to Table 1 in this document.

[00042] The priority trigger unit 120 may be located as a function or a node with a database for log data. The priority trigger unit 120 may be located in a stream of log data, for example as a monitoring agent, monitoring received log data, or monitoring stored log data. The priority trigger unit 120 may be located at an application programming interface, API, for access by other applications, services or an operator of the system. When the priority trigger unit 120 is located at an API, the priority trigger unit 120 may be accessible via the API. A non-limiting example may be where the priority trigger unit 120 is installed at the same node as a log database 1 15, further described in relation to Fig. 4. The priority trigger unit 120 may be monitoring received log data, which is stored in the log database 1 15, as a monitoring agent.

[00043] The priority trigger unit 120 may provision triggers to the data

prioritization master 100 by transmission of the triggers one by one, or as batches of triggers. The priority trigger unit 120 may provision triggers to the data prioritization master 100 by storage of triggers, such that the data prioritization master 100 may collect the triggers with suitable time intervals. The

communication between the priority trigger unit 120 and the data prioritization master 100 may be conveyed as messages, for example, over Ethernet or TCP/UDP IP.

[00044] The stored entry in the prioritization database 1 10 with the new priority for the first log data piece 105:A, may contain a new priority for the first log data piece 105: A, determined by the received the priority trigger. The stored entry for the new priority for the first log data piece 105: A, may be associated with the first log data piece 105:A, a node 75 id, a user id, data type, or some other

identification method.

[00045] The prioritization database 1 10 may be a relational database, file system database, text file based database, not limiting to other similar databases. The database may also be based on a distributed database solution, such as Hadoop, open-source software framework written in Java for distributed storage and distributed processing of very large data sets on computer clusters, or HBase, open source, non-relational, distributed database, based on Hadoop Distributed Filesystem, HDFS. Although the database technology might be different, each data entry still could have columns like node id, timestamp, etc., or areas carrying information such as node id, timestamp, etc.

[00046] Initiation of handling of the first log data piece 105:A according to the stored new priority may comprise that the first log data piece 105:A is prevented from deletion according to its default priority, or the first log data piece 105:A is kept easily accessible and not stored in a dump of a database. Initiation of handling of the first log data piece 105:A according to the stored new priority may comprise that the first log data piece 105:A may be allowed to be deleted or moved to an archive.

[00047] Fig. 3 shows alternative embodiments where steps are performed in addition to the embodiments described in conjunction to Fig 2. In an embodiment, the method may comprise resolving S140 an effected second log data piece 105:B (see Fig 4), based on a relation between the first log data piece 105:A and the second log data piece 105:B, which relation is stored as an entry in the

prioritization database 1 10.

[00048] The second log data piece 105:B may be a specific piece of log data information comprising specific information about an event, activities, alarms, statistics, or similar. The first log data piece 105:A and the second log data piece 105:B may be different types of log data. The first log data piece 105: A and the second log data piece 105:B may alternatively be the same types of log data. The first log data piece 105: A and the second log data piece 105:B may be the same types of log data and originating from the same node 75, however originating from different sections of the log data, e.g. different time periods.

[00049] The first log data piece 105: A and the second log data piece 105:B may be related to each other in different ways. The first log data piece 105:A and the second log data piece 105:B may for example be related to each other as different types of log data but originating from the same node 75. The first log data piece 105: A and the second log data piece 105:B may for example be related to each other as different type's identities but associated with the same user. .

[00050] Resolving the effected second log data piece 105:B based on the second log data piece 105:B's relation with the first log data piece 105: A, may be performed through a procedure where the relation or association is determined between the first log data piece 105: A and the second log data piece 105:B.

[00051 ] In an embodiment, the method may comprise determining S150 a priority for the second log data piece 105:B, based on the relation between the first log data piece 105: A and the second log data piece 105:B. Further, an entry may be stored with the new priority for the second log data piece 105:B associated with the second log data piece 105:B in the prioritization database 1 10.

[00052] An example may be, when a first log data piece 105:A concerns an important alarm and is determined a new priority. A second log data piece 105:B may concern a user ID appearing in a log which has been affected by the reason for the important alarm, thereby the second log data piece 105:B may be determined the same new priority as the first log data piece 105: A. Thereby it may be possible to follow-up and analyze a situation of a problem in an operators network, by having access to log data pieces which otherwise partially may have been deleted due to default priorities.

[00053] In an embodiment of the solution, the new priority for the first log data piece 105:A may be based on a relation between the first data piece 105:A and the second log data piece 105:B. An example may be when a first log data piece 105: A is resolved to be related to a second log data piece 105:B and the second log data piece 105:B has been determined a priority e.g. "7". Then the related first log data piece 105:A may consequently also be determined to a priority "7", which might have been different from the priority the first log data piece 105:A would have, as if the first data piece 105: A had been determined without taking the relation into account.

[00054] In an embodiment of the solution, the stored entry for the priority for the first log data piece 105:A may comprise a priority indicator indicating the new priority and at least one of: data entry ID, node ID, user ID, time period, log data type, and trigger function.

[00055] In an embodiment, the solution may comprise determining S160 the relation between the first log data piece 105:A and the second log data piece 105:B by mapping the first log data piece 105: A with the second log data piece 105:B based on communication network 50 configuration data, node 75 configuration data, user ID, or traffic type information. Further embodiments and illustrating examples will be provided in conjunction with Fig. 6. [00056] In an embodiment of the solution, the priority trigger from the priority trigger unit 120 may comprise at least one of: priority trigger unit ID, priority trigger reason, log data type, and maximum number of steps for resolution of serial relations.

[00057] In an embodiment of the solution, the priority trigger may be issued by monitoring of a log data source from a node 75 or an Application Programming Interface, API 170.

[00058] In an embodiment of the solution, the log data source is at least one of: database entry, data file, data stream.

[00059] In an embodiment, the solution may comprise receiving S170 a priority request for the first and/or the second log data piece 105 from a data priority enforcement unit 130, foregoing the initiating of handling of the log data piece 105.

[00060] In an embodiment, the solution may comprise transmitting S180 the priority for the first and/or the second log data piece 105 to the data priority enforcement unit 130.

[00061 ] The priority request may be a message, for example containing any of: the identity of the node 75, a user identity, type of log data piece 105 or priority, not limiting to other content. The priority request may be provided as SQL- messages, Extensible Markup Language-messages, XML, http get messages and http post messages, UDP event stream, not limiting to other formats for carrying priority requests.

[00062] The data enforcement unit 130 may be located at or near a log database 1 15. The log database 1 15 is further illustrated in conjunction with Fig. 4. The data enforcement unit 130 may perform enforcements of stored first log data pieces 105:A and second log data pieces 105:B. When the first and/or second log data piece 105 is stored with a default priority, the data enforcement unit 130 may perform enforcement according to the default priority. When the first and/or second log data piece 105 is stored with a new priority, the data enforcement unit 130 may perform enforcement according to the new priority. A non-limiting illustrating example may be, when the first and/or second log data piece 105 is stored with a default priority, the data enforcement unit 130 may perform deletion or archiving of the data. However, when the first and/or second log data piece 105 is stored with a new priority, the data enforcement unit 130 may let the data stay in the log database 1 15.

[00063] In an embodiment of the solution, the handling of the first log data piece 105:A comprises at least one of: maintenance, removal, deletion, compression or storage in an archive.

[00064] Fig. 4 in conjunction with Fig. 9 illustrates an embodiment of the solution with a system 60 for prioritization of stored log data. The log data is generated by nodes 75 in a communications network 50, where a first log data piece 105:A has been stored with a default priority. The system 60 comprising at least one processor 350 and at least one memory 360, where the memory contains instructions executable by said processor. The system 60 is operative to receive a priority trigger for the first log data piece 105:A from a priority trigger unit 120. The system 60 is operative to determine a new priority for the first log data piece 105:A, which new priority is different from the default priority, based on the received priority trigger for the first log data piece 105: A. The system 60 is operative to store an entry with the new priority for the first log data piece 105: A, the entry associated with the first log data piece 105:A, in a prioritization database 1 10. The system 60 is operative to initiate handling of the first log data piece 105:A according to the stored new priority.

[00065] In a scenario where the solution is distributed, the solution may comprise a plurality of processors 350 and a plurality of memories 360, where the

instructions may be divided between the memories 360 or stored in parallel.

[00066] The figure illustrates the log database 1 15 as separated from the nodes 75 as an example. However, the log database 1 15 may be co-located with the nodes 75, or the log database 1 15 may be integrated with a single node 75. The figure further shows a communication unit 140 for communication with the priority trigger unit 120 and the data priority enforcement unit 130. The figure further shows a priority determination unit 150 for determination of priorities and a relation mapping unit for resolving relations between a first log data piece 105:A and second data piece 105:B. The log database 1 15 may have a role as an alarm database, for storage of alarms occurred in the network. The log database 1 15 may be based on a relational database, e.g. Structured Query Language, SQL database, file system database, text file based database, not limiting to other similar databases. The database may also be based on a distributed database solution, such as HDFS or HBase.

[00067] In different embodiments of the solution, access to the data prioritization master 100, log database 1 15, priority trigger unit 120, data priority enforcement unit 130 and other nodes and units in the solution, may be carried out via

REpresentational State Transfer, RESTful API's, or other suitable interfaces.

[00068] Communication between the different nodes and units may be carried by for example Hyper Text Transfer Protocol, HTTP, get and post messages. The HTTP communication may be carried by Transmission Control Protocol or User Datagram Protocol on top of Internet Protocol, TCP, UDP, IP.

[00069] Access to data in databases may be performed by Open Database Connectivity, ODBC, Hadoop, HDFS, or Spark, open-source cluster computing framework originally developed in the AMPLab at UC Berkeley.

[00070] As an example of the prioritization database 1 10, a table 1 is shown illustrating different examples of entries stored in the prioritization database 1 10.

11003. .. . 12:00 - 10:00 l srs?

Table 1

[00071 ] Node ID may indicate the node which this entry applies to. It could be cell, base station or other nodes from various domains.

[00072] User ID may indicate to which users this entry applies. The identity type of the user may depend on the type of data that the entry corresponds to.

Examples are IMSI for MME event data, or IP address for user plane probe data. Further non-limiting examples of identities are MSISDN, IMSI (International Mobile Subscriber Identity), IMEI (International Mobile Station Equipment Identity) SIP URI (Session Initiation Protocol Uniform Resource Identifier), and IP-address (Internet Protocol address).

[00073] The time period may indicate which time period of data this entry applies to. It may be e.g. a whole hour, 30 minute intervals, and a period defined as "night", for example 23:01 - 06:00, "morning", for example 06:01 -12:00,

"afternoon", for example 12:01 - 17:00 and "evening", for example 17:01 -23:00.

[00074] The data type column may indicate which type of data this prioritization entry relates to. For example it can be all log data pieces from the user plane probe that should be prioritized, user_plane_probe.all, or only the

INTERNAL_PER events from the eNB, cell_trace.internal_per_event. [00075] Triggering function may indicate which priority trigger unit 120 triggered this priority entry. It could be API request, occurrences of data in some database tables, or arrival of data streams and files.

[00076] The priority column may indicate the priority of the data pieces matching this entry.

[00077] In the table, the first row may indicate that for data pieces of type celljrace.all of cell 1 1001 , at time 9 AM-10 AM, the priority is set to 9. The triggering function for this entry is from the alarm table, where the alarm ID 1034 triggered this priority request.

[00078] The second row of the table may indicate that for data pieces of type user_plane_probe.all, all the entries for users {1001 , 1003, 1 1 15, 1009... } should have priority 8. This applies to all entries starting from 9 AM on 1 September 2013. As the end time is set to NULL, it means all future entries from the table belonging to these users should also have priority 8. The source for this entry is through API by external program. For example, the operator may lawfully want or be lawfully requested to track these users in more detail.

[00079] The third row may indicate a use case where a web session of a VIP user with poor Quality of Experience, QoE, has resulted in increased priority for all cell counters and the INTERNAL_PER events of the cell of the web session, to enable later root cause analysis.

[00080] The fourth row may indicate a case where a weather storm at a certain time results in increased priorities for all data around the time when the storm occurred, for later analysis on the storm's impact on the network and over-the-top services.

[00081 ] Table 1 is a non-limiting example of content in the priority trigger. In addition to the table, additional information may be included in a priority trigger. An example is a field specifying how "far" the data prioritization master 100 should search for related data log pieces 105:A to prioritize as an effect of this priority trigger. E.g. the priority request is for a specific cell, but in the request there is also a field stating that also all cell neighbors' data of the same type should be prioritized in the same way.

[00082] In an embodiment of the solution, the system may be operative to resolve an effected second log data piece 105:B, based on a relation between the first log data piece 105:A and the second log data piece 105:B, which relation is stored as an entry in the prioritization database 1 10.

[00083] In an embodiment of the solution, the system may be operative to determine a priority for the second log data piece 105:B, based on the relation between the first log data piece 105:A and the second log data piece 105:B, and store an entry with the new priority for the second log data piece 105:B, where the entry may be associated with the second log data piece 105:B, in the prioritization database 1 10.

[00084] In an embodiment of the solution, the new priority for the first log data piece 105:A may be based on a relation between the first data piece 105:A and the second log data piece 105:B.

[00085] In an embodiment of the solution, the stored entry for the priority for the first log data piece 105:A comprises a priority indicator indicating the new priority and at least one of: data entry ID, node ID, user ID, time period, log data type, and trigger function.

[00086] In an embodiment of the solution, the system may be operative to determine the relation between the first log data piece 105: A and the second log data piece 105:B by mapping the first log data piece 105: A with the second log data piece 105:B based on communication network 50 configuration data, node 75 configuration data, user ID, or traffic type information.

[00087] In an embodiment of the solution, the priority trigger from the priority trigger unit 120 may comprise at least one of: priority trigger unit ID, priority trigger reason, log data type, and maximum number of steps for resolution of serial relations. [00088] In an embodiment of the solution, the priority trigger may be issued by monitoring of a log data source from a node 75 or an Application Programming Interface, API 170.

[00089] In an embodiment of the solution, the log data source may be at least one of: database entry, data file, data stream.

[00090] In an embodiment of the solution, the system may be operative to receive a priority request for the first and/or the second log data piece 105 from a data priority enforcement unit 130, foregoing the initiation of handling of the log data piece 105.

[00091 ] In an embodiment of the solution, the system may be operative to transmit the priority for the first and/or the second log data piece 105 to the data priority enforcement unit 130.

[00092] In an embodiment of the solution the handling of the first log data piece 105:A comprises at least one of: maintenance, removal, deletion, compression or storage in an archive.

[00093] Fig. 5 illustrates an embodiment of the system, comprising the data prioritization master 100, with a plurality of priority trigger units 120, a plurality of data priority enforcement units 130, a plurality of API's, Application Programming Interface 170. The figure further shows a plurality of log databases 1 15 with the first log data piece 105: A, the second log data piece 105:B and n log data pieces 105 for representation that a log data base 1 15 may be populated with a plurality log data pieces 105. A plurality of data streams 180 are shown in the figure. The data stream 180 may be received by the log database 1 15 and at least partially stored. The data stream 180 may be received by the API 170. The data stream 180 may be received as a syslog, for example according to Internet Engineering Task Force, RFC 5424. The data stream 180 may be received as an http or http secure stream. The data stream 180 may be received by a stream engine such as Storm or Spark streaming. The data stream 180 may be processed and

continuously stored, into a more permanent storage, for example a relational database, HDFS files, or High-performance Integrated Virtual Environment, HIVE. The data stream 180 may be received as binary files. The data stream 180 may be received as a binary or a test stream. The data stream 180 may be received as text files, where log data pieces 105 are written line by line, e.g. in CSV format (comma-separated values) or JSON (JavaScript Object Notation) format.

[00094] Fig. 6 illustrates a scenario of a communications network 50, as some further background information. The figure shows a domain with examples of network nodes 75, such as Mobility Management Entity, MME, Evolved Node B, eNB, Policy and Charging Rules Function, PRCF, mobile cell in a mobile network scenario, Cell, where each node has an identity, ID. Fig. 6 further shows an example of a domain with a service node, in this example an IMS node, accompanied by an identity. The figure further shows a domain with subscriber identities, in the figure exemplified by MSISDN, IMSI, SIP URI, IP address, Evolved Universal Terrestrial Radio Access Network (E-UTRAN); S1 Application Protocol, S1AP, and Identity, S1APID.

[00095] Each one of the nodes 75 in the network nodes domain are normally more or less interrelated. Each subscriber identity in the network nodes domain may be more or less interrelated. Identities and nodes may be interrelated with each other. By determination of the different relations, it may be possible to resolve how the second log data piece 105:B may be effected by the first log data piece 105:A. An example of an information source for such information, may be the Ericsson Expert Analytics solution, EEA.

[00096] Relations may be configuration based relations. For example cellA is neighbor of cellB, or cellA is connected to SGW:A, Signaling Gateway, while cellB is connected to SGW:B. This info may be obtained from the network configuration information, for example from the Ericsson Network Manager, ENM.

[00097] Relations may be dynamic relations. For example "user A has IP address X, is connected to cell B at time t using VoIP service through IMS node C". This type of relation is continuously changing. The EEA product may track and maintain such type of dynamic relations. [00098] Fig. 7 illustrates embodiments of the solution with the priority trigger unit 120, the data priority enforcement unit 130, and the log database 1 15 comprised by the system 60, which is adapted to be comprised in the communications network 50. The data prioritization master 100 may be based on a cloud

computing solution 300. Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable

computing resources, e.g., networks, servers, storage, applications, and services, that can be rapidly provisioned and released with minimal management effort or service provider interaction. Reference: "The NIST Definition of Cloud Computing", Special Publication 800-145, Peter Mell Timothy Grance, September 201 1 .

[00099] Fig. 8 illustrates embodiments of the solution implemented in cloud computing solution 300. The nodes 75 may be operated in one cloud computing solution 300:A. The log database 1 15 or log databases may be operated in another cloud computing solution 300: B. The priority trigger unit 120 and the data priority enforcement unit 130 may be operated in another cloud computing solution 300:C. The data prioritization master 100 may be operated in another cloud computing solution 300: D. These are illustrating examples of embodiments, however the solution may be implemented in other different combinations using a cloud computing solution.

[000100] Fig. 9 shows a system 60 for prioritization of stored log data, the log data generated by nodes 75 in a communications network 50, wherein a first log data piece 105:A has been stored with a default priority. The system 60 comprises at least one processor 350 and at least one memory 360, said memory containing instructions executable by said processor, whereby the system 60 is operative to receive a priority trigger for the first log data piece 105:A from a priority trigger unit 120. The memory 360 further contains instructions executable by said at least one processor whereby the system 60 is operative to determine a new priority for the first log data piece 105:A, which new priority is different from the default priority, based on the received priority trigger for the first log data piece 105:A. The memory 360 further contains instructions executable by said at least one processor whereby the system 60 is operative to store an entry with the new priority for the first log data piece 105:A, the entry associated with the first log data piece 105:A, in a prioritization database 1 10. The memory 360 further contains instructions executable by said at least one processor whereby the system 60 is operative to initiate handling of the first log data piece 105:A according to the stored new priority.

[000101 ] The system 60 may further comprise a communication interface 370, which may be considered to comprise conventional means for communicating from and/or to the other devices in the network, such as log databases 1 15 or other devices or nodes in the communication network 50. The conventional communication means may include at least one transmitter and at least one receiver. The communication interface may further comprise one or more repository 375 and further functionality 380 useful for the system 60 to serve its purpose as system for prioritization of stored log data, such as power supply, internal communications bus, internal cooling, database engine, operating system, not limiting to other functionalities.

[000102] The instructions executable by said processor may be arranged as a computer program 365 stored in said at least one memory 360. The at least one processor 350 and the at least one memory 360 may be arranged in an

arrangement 355. The arrangement 355 may alternatively be a micro processor and adequate software and storage therefore, a Programmable Logic Device, PLD, or other electronic component(s)/processing circuit(s) configured to perform the actions, or methods, mentioned above.

[000103] The computer program 365 may comprise computer readable code means, which when run in the system 60 causes the system 60 to perform the steps described in any of the methods described in relation to Fig. 2 or 3. The computer program may be carried by a computer readable storage medium 360 connectable to the at least one processor. The computer readable storage medium 360 may be the at least one memory. The at least one memory may be realized as for example a RAM (Random-access memory), ROM (Read-Only Memory) or an EEPROM (Electrical Erasable Programmable ROM). Further, the computer program may be carried by a separate computer-readable medium, such as a CD, DVD or flash memory, from which the program could be downloaded into the at least one memory.

[000104] Although the instructions described in the embodiments disclosed above are implemented as a computer program 365 to be executed by the at least one processor 350 at least one of the instructions may in alternative embodiments be implemented at least partly as hardware circuits. Alternatively, the computer program may be stored on a server or any other entity connected to the

communications network to which the system 60 has access via its

communications interface 370. The computer program may than be downloaded from the server into the at least one memory, carried by an electronic signal, optical signal, or radio signal.

[000105] In an embodiment of a solution, a system 60 for prioritization of stored log data, the log data generated by nodes 75 in a communications network 50, wherein a first log data piece 105:A has been stored with a default priority. The system 60 comprises a communication unit 140 for receiving a priority trigger for the first log data piece 105:A from a priority trigger unit 120. The system comprises a priority determination unit 150 for determining a new priority for the first log data piece 105:A, which new priority is different from the default priority, based on the received priority trigger for the first log data piece 105:A. The system comprises a prioritization database 1 10 for storing an entry with the new priority for the first log data piece 105: A, the entry associated with the first log data piece 105: A, in a prioritization database 1 10. The system comprises the communication unit 140 for initiating handling of the first log data piece 105:A according to the stored new priority. In one embodiment the communication unit 140, the priority determination unit 150, the relation mapping unit 160 and prioritization database 1 10 are implemented as hardware units. The prioritization database 1 10 may be

implemented as a hardware unit, however the information kept in the prioritization database 1 10 is based on software.

[000106] While the solution has been described with reference to specific exemplary embodiments, the description is generally only intended to illustrate the inventive concept and should not be taken as limiting the scope of the solution. For example, the terms "node", "first log data piece" and "data prioritization master" have been used throughout this description, although any other corresponding nodes, functions, and/or parameters could also be used having the features and characteristics described here. The solution is defined by the appended claims.