Systems and methods are disclosed for detecting periodic event behaviors from machine generated logging by: capturing heterogeneous log messages, each log message including a time stamp and text content with one or more fields; recognizing log formats from log messages; transforming the text content into a set of time series data, one time series for each log format; during a training phase, analyzing the set of time series data and building a category model for each periodic event type in heterogeneous logs; and during live operation, applying the category model to a stream of time series data from live heterogeneous log messages and generating a flag on a time series data point violating the category model and generating an alarm report for the corresponding log message.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method for detecting periodic event behaviors from machine generated logging, comprising: capturing heterogeneous log messages, each log message including a time stamp and text content with one or more fields; transforming the text content into a set of time series data; during a training phase, analyzing the set of time series data and building a category model for each periodic event type in heterogeneous logs; and during live operation, applying the category model to a stream of time series data from live heterogeneous log messages and generating a flag on a time series data point violating the category model and generating an alarm report on the corresponding log message. 2. The method of claim 1, wherein the heterogeneous log messages are from unknown systems or applications. 3. The method of claim 1, comprising applying one or more management applications onto the heterogeneous log messages based on a category models output 4. The method of claim 1, comprising applying one or more management applications onto the heterogeneous log messages based on a category model checking output. 5. The method of claim 1, comprising applying log based fault management by discovering missing log messages, messages not shown up on expected time points, or detecting abnormal log messages shown up on unexpected time points output. 6. The method of claim 1, comprising processing a tokenization to generate semantically meaningful tokens from log messages; after the heterogeneous logs are tokenized, a similarity measurement on heterogeneous logs is applied; and once similarities among logs are captured, applying a log hierarchical clustering method to generate and output a log cluster hierarchy. 7. The method of claim 1, comprising aligning the log messages within each cluster on the lowest level in the log cluster hierarchy to preserve unknown layouts of heterogeneous logs and help log pattern recognition. 8. The method of claim 7, comprising conducting log motif discovery to find representative layouts and log fields. 9. The method of claim 8, comprising recognizing pattern from the motifs by recognizing time stamps, Internet Protocol (IP) addresses and universal resource locators (URLs); recognizing fields conserved in the logs and organizing the fields in a data structure in the cluster hierarchy; and back propagating information up in a hierarchy, and fusing the back-propagated information with local patterns to provide format pattern representations from the logs. 10. The method of claim 1, comprising order matched messages based on the time stamps and for K ordered messages, marking their time stamps as X={X1, X2, . . . , XK} and outputting inter-arrival time series as Y={Y1=X2−X1, Y2=X3−X2, . . . , YK−1=XK−Xk−1}. 11. The method of claim 10, comprising estimating the categories by counting appearance times of unique values in the time series Y, sort unique values in an increasing order, and recording in an ordered list Cestimated=[C1, C2, . . . CU}, and Nestimated=[N1, N2, . . . Nu}, where u is a number of unique values, and Ni is appearance time of the unique value Ci in Y. 12. The method of claim 11, comprising clusterizing the estimated categories. 13. The method of claim 12, comprising generating a final category model Cfinal={C′1, C′2, . . . , C′F}, determining a model parameter (Center(C′k), Error(C′k)) for each C′k={Ci, Ci+1, . . . , Ci+j}, 1≦k≦F, and a fitness score for a category model Cfinal. 14. The method of claim 13, comprising determining C′m: Center(C′m)=min{|T−Center(C′j)|, , 1≦j≦F}, where T is an inter-arrival time of log i and a previous log matching format fi with category model Cf={C′1, C′2, . . . , C′F}. 15. The method of claim 14, comprising determining a periodicity behavior violation if |T−Center(C′m))|>Error(C′m)). 16. The method of claim 1, wherein the machine comprises a motor and a digitizer to capture movement driven by the motor. 17. A system, comprising a mechanical actuator; a digitizer coupled to the actuator to log data; a module for detecting periodic event behaviors from machine generated logging, including code for: capturing heterogeneous log messages, each log message including a time stamp and text content with one or more fields; transforming the text content into a set of time series data; during a training phase, analyzing the set of time series data and building a category model for each periodic event type in heterogeneous logs; and during live operation, applying the category model to a stream of time series data from live heterogeneous log messages and generating a flag on a time series data point violating the category model and generating corresponding log messages. 18. The system of claim 17, wherein the actuator comprises a motor. 19. The system of claim 17, wherein the actuator is an engine. 20. The system of claim 17, comprising code for: aligning the log messages within each cluster on the lowest level in the log cluster hierarchy to preserve unknown layouts of heterogeneous logs and help log pattern recognition; conducting log motif discovery to find representative layouts and log fields; and recognizing pattern from the motifs by recognizing time stamps, Internet Protocol (IP) addresses and universal resource locators (URLs); recognizing fields conserved in the logs and organizing the fields in a data structure in the cluster hierarchy; and back propagating information up in a hierarchy, and fusing the back-propagated information with local patterns to provide format pattern representations from the logs.