A search-based approach for accurate identification of log message formats

Abstract

Many software engineering activities process the events contained in log files. However, before performing any processing activity, it is necessary to parse the entries in a log file, to retrieve the actual events recorded in the log. Each event is denoted by a log message, which is composed of a fixed part-called (event) template-that is the same for all occurrences of the same event type, and a variable part, which may vary with each event occurrence. The formats of log messages, in complex and evolving systems, have numerous variations, are typically not entirely known, and change on a frequent basis; therefore, they need to be identified automatically.The log message format identification problem deals with the identification of the different templates used in the messages of a log. Any solution to this problem has to generate templates that meet two main goals: generating templates that are not too general, so as to distinguish different events, but also not too specific, so as not to consider different occurrences of the same event as following different templates; however, these goals are conflicting.In this paper, we present the MoLFI approach, which recasts the log message identification problem as a multi-objective problem. MoLFI uses an evolutionary approach to solve this problem, by tailoring the NSGA-II algorithm to search the space of solutions for a Pareto optimal set of message templates. We have implemented MoLFI in a tool, which we have evaluated on six real-world datasets, containing log files with a number of entries ranging from 2K to 300K. The experiments results show that MoLFI extracts by far the highest number of correct log message templates, significantly outperforming two state-of-the-art approaches on all datasets. CCS CONCEPTS• Software and its engineering → Search-based software engineering;

Tools and Benchmarks for Automated Log Parsing

“…For example, if a log sequence [E1, E2, E2] is parsed to [E1, E4, E5], we get PA=1/3, since the 2nd and 3rd messages are not grouped together. In contrast to standard evaluation metrics that are used in previous studies, such as precision, recall, and F1-measure [9], [22], [28], PA is a more rigorous metric. In PA, partially matched events are considered incorrect.…”

“…For example, Spell [24] utilizes the longest common subsequence algorithm to parse logs in a stream manner. Recently, Messaoudi et al [28] propose MoLFI, which models log parsing as a multipleobjective optimization problem and solves it using evolutionary algorithms.…”

Tracing Back Log Data to its Log Statement: From Research to Practice

“…Although beneficial to the effectiveness of the log parsing, this is a manual process. Messaoudi et al [18] capture the template of a message by applying an evolutionary algorithm. This first of a kind approach significantly outperforming other approaches ( [14], [17]).…”

“…As there is no direct connection between log messages and source code in the produced (raw) log data, the link must be created afterwards. Previous works propose several approaches based on clustering [10], [23], heuristics [17], [24], longest common sequence method [9], textual similarities [14], evolutionary search [18], and static analysis [28] to solve this challenge.…”

Priolog: Mining Important Logs via Temporal Analysis and Prioritization

“…In this work we assume that we have already prepared such set of log templates for a given application using existing techniques. Accurately discovering the log templates from the given set of log data is an active field of research and there are several techniques available for us to use [20][21][22][23]. It is not the goal of this work to design new log template discovery techniques.…”