Efficient Online Log Parsing with Log Punctuations Signature
Source abstract
Abstract
Logs, recording the system runtime information, are frequently used to ensure software system reliability. As the first and foremost step of typical log analysis, many data-driven methods have been proposed for automated log parsing. Most existing log parsers work offline, requiring a time-consuming training progress and retraining as the system upgrades. Meanwhile, the state of the art online log parsers are tree-based, which still have defects in robustness and efficiency. To overcome such limitations, we abandon the tree structure and propose a hash-like method. In this paper, we propose LogPunk, an efficient online log parsing method. The core of LogPunk is a novel log signature method based on log punctuations and length features. According to the signature, we can quickly find a small set of candidate templates. Further, the most suitable template is returned by traversing the candidate set with our log similarity function. We evaluated LogPunk on 16 public datasets from the LogHub comparing with five other log parsers. LogPunk achieves the best parsing accuracy of 91.9%. Evaluation results also demonstrate its superiority in terms of robustness and efficiency.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software System Performance and Reliability · Software Testing and Debugging Techniques · Software Engineering Research
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Software, Shanghai Jiao Tong University, Shanghai 200240, China
References (32)
Show source-provided references
1. Cito, J., Leitner, P., Fritz, T., and Gall, H.C. The Making of Cloud Applications: An Empirical Study on Software Development for the Cloud. Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering.10.1145/2786805.2786826 ↗
2. Barik, T., DeLine, R., Drucker, S., and Fisher, D. (2016, January 14–22). The bones of the system: A case study of logging and telemetry at microsoft. Proceedings of the 2016 IEEE/ACM 38th International Conference on Software Engineering Companion, Austin, TX, USA.10.1145/2889160.2889231 ↗
3. Forestiero, A., Mastroianni, C., Papuzzo, G., and Spezzano, G. (2010, January 17–20). A Proximity-Based Self-Organizing Framework for Service Composition and Discovery. Proceedings of the 2010 10th IEEE/ACM International Conference on Cluster, Cloud and Grid Computing, Melbourne, VIC, Australia.10.1109/CCGRID.2010.48 ↗
4. Forestiero, A., Mastroianni, C., Meo, M., Papuzzo, G., and Sheikhalishahi, M. (2014). Hierarchical approach for green workload management in distributed data centers. European Conference on Parallel Processing, Springer.10.1007/978-3-319-14325-5_28 ↗
5. Toward Fine-Grained, Unsupervised, Scalable Performance Diagnosis for Production Cloud Computing Systems10.1109/TPDS.2013.21 ↗
6. Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., and Li, Z. (2019, January 26–30). Robust Log-Based Anomaly Detection on Unstable Log Data. Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Tallinn, Estonia.10.1145/3338906.3338931 ↗
7. Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., and Sun, P. (2019, January 10–16). LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs. Proceedings of the International Joint Conferences on Artificial Intelligence Organization, Macao, China.10.24963/ijcai.2019/658 ↗
8. Zhou, X., Peng, X., Xie, T., Sun, J., Ji, C., Liu, D., Xiang, Q., and He, C. (2019). Latent Error Prediction and Fault Localization for Microservice Applications by Learning from System Trace Logs, Association for Computing Machinery.10.1145/3338906.3338961 ↗
9. Chen, Y., Yang, X., Lin, Q., Zhang, H., Gao, F., Xu, Z., Dang, Y., Zhang, D., Dong, H., and Xu, Y. (2019). Outage Prediction and Diagnosis for Cloud Service Systems. The World Wide Web Conference, San Francisco, CA, USA, 13–17 May 2019, Association for Computing Machinery.10.1145/3308558.3313501 ↗
10. Zaman, T.S., Han, X., and Yu, T. (2019, January 11–15). SCMiner: Localizing System-Level Concurrency Faults from Large System Call Traces. Proceedings of the 2019 34th IEEE/ACM International Conference on Automated Software Engineering, San Diego, CA, USA.10.1109/ASE.2019.00055 ↗
11. Cotroneo, D., De Simone, L., Liguori, P., Natella, R., and Bidokhti, N. (2019, January 26–30). How Bad Can a Bug Get? An Empirical Analysis of Software Failures in the OpenStack Cloud Computing Platform. Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Tallinn, Estonia.10.1145/3338906.3338916 ↗
12. Xu, W., Huang, L., Fox, A., Patterson, D., and Jordan, M.I. (2009, January 11–14). Detecting large-scale system problems by mining console logs. Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles, Big Sky, MT, USA.10.1145/1629575.1629587 ↗
13. Lou, J.G., Fu, Q., Yang, S., Xu, Y., and Li, J. (2010, January 23–25). Mining Invariants from Console Logs for System Problem Detection. Proceedings of the USENIX Annual Technical Conference, Boston, MA, USA.
14. Lou, J.G., Fu, Q., Yang, S., Li, J., and Wu, B. (2010, January 25–28). Mining program workflow from interleaved traces. Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Washington, DC, USA.10.1145/1835804.1835883 ↗
15. Zhu, J., He, S., Liu, J., He, P., Xie, Q., Zheng, Z., and Lyu, M.R. (2019, January 25–31). Tools and benchmarks for automated log parsing. Proceedings of the 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice, Montreal, QC, Canada.10.1109/ICSE-SEIP.2019.00021 ↗
16. Beschastnikh, I., Brun, Y., Ernst, M.D., and Krishnamurthy, A. (2014, January 31). Inferring models of concurrent systems from logs of their behavior with CSight. Proceedings of the 36th International Conference on Software Engineering, Hyderabad, India.10.1145/2568225.2568246 ↗
17. He, P., Zhu, J., Zheng, Z., and Lyu, M.R. (2017, January 25–30). Drain: An online log parsing approach with fixed depth tree. Proceedings of the 2017 IEEE International Conference on Web Services, Honolulu, HI, USA.10.1109/ICWS.2017.13 ↗
18. Dai, H., Li, H., Chen, C.S., Shang, W., and Chen, T.H. (2020). Logram: Efficient log parsing using n-gram dictionaries. IEEE Trans. Softw. Eng.10.1109/TSE.2020.3007554 ↗
19. Vaarandi, R. (2003, January 3). A data clustering algorithm for mining patterns from event logs. Proceedings of the 3rd IEEE Workshop on IP Operations & Management, Kansas City, MO, USA.
20. Nagappan, M., and Vouk, M.A. (2010, January 2–3). Abstracting log lines to log event types for mining software system logs. Proceedings of the 2010 7th IEEE Working Conference on Mining Software Repositories, Cape Town, South Africa.10.1109/MSR.2010.5463281 ↗
21. Tang, L., Li, T., and Perng, C.S. (2011, January 24–28). LogSig: Generating system events from raw textual logs. Proceedings of the 20th ACM International Conference on Information and Knowledge Management, Glasgow, UK.10.1145/2063576.2063690 ↗
22. Hamooni, H., Debnath, B., Xu, J., Zhang, H., Jiang, G., and Mueen, A. (2016, January 24–28). Logmine: Fast pattern recognition for log analytics. Proceedings of the 25th ACM International on Conference on Information and Knowledge Management, Indianapolis, IN, USA.10.1145/2983323.2983358 ↗
23. Makanju, A.A., Zincir-Heywood, A.N., and Milios, E.E. (2009–1, January 28). Clustering event logs using iterative partitioning. Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Paris, France.10.1145/1557019.1557154 ↗
24. Mizutani, M. (July, January 28). Incremental mining of system log format. Proceedings of the 2013 IEEE International Conference on Services Computing, Santa Clara, CA, USA.10.1109/SCC.2013.73 ↗
25. Shima, K. (2016). Length matters: Clustering system log messages using length of words. arXiv.
26. Du, M., and Li, F. (2016, January 12–15). Spell: Streaming parsing of system event logs. Proceedings of the 2016 IEEE 16th International Conference on Data Mining (ICDM), Barcelona, Spain.10.1109/ICDM.2016.0103 ↗
27. Spell: Online Streaming Parsing of Large Unstructured System Logs10.1109/TKDE.2018.2875442 ↗
28. He, S., Zhu, J., He, P., and Lyu, M.R. (2020). Loghub: A large collection of system log datasets towards automated log analytics. arXiv.
29. Jiang, Z.M., Hassan, A.E., Flora, P., and Hamann, G. (2008, January 12–13). Abstracting execution logs to execution events for enterprise applications (short paper). Proceedings of the 2008: The Eighth International Conference on Quality Software, Oxford, UK.10.1109/QSIC.2008.50 ↗
30. Huang, S., Liu, Y., Fung, C., He, R., Zhao, Y., Yang, H., and Luan, Z. (2020, January 20–24). Paddy: An event log parsing approach using dynamic dictionary. Proceedings of the NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium, Budapest, Hungary.10.1109/NOMS47738.2020.9110435 ↗
31. Vaarandi, R., and Pihelgas, M. (2015, January 9–13). Logcluster—A data clustering and pattern mining algorithm for event logs. Proceedings of the 2015 11th International Conference on Network and Service Management, Barcelona, Spain.10.1109/CNSM.2015.7367331 ↗
32. Fu, Q., Lou, J.G., Wang, Y., and Li, J. (2009, January 6–9). Execution anomaly detection in distributed systems through unstructured log analysis. Proceedings of the 2009 Ninth IEEE International Conference on Data Mining, Miami Beach, FL, USA.10.1109/ICDM.2009.60 ↗