The DOI matches its Crossref record.
Execution Anomaly Detection in Distributed Systems through Unstructured Log Analysis
Abstract
Detection of execution anomalies is very important for the maintenance, development, and performance refinement of large scale distributed systems. Execution anomalies include both work flow errors and low performance problems. People often use system logs produced by distributed systems for troubleshooting and problem diagnosis. However, manually inspecting system logs to detect anomalies is unfeasible due to the increasing scale and complexity of distributed systems. Therefore, there is a great demand for automatic anomalies detection techniques based on log analysis. In this paper, we propose an unstructured log analysis technique for anomalies detection. In the technique, we propose a novel algorithm to convert free form text messages in log files to log keys without heavily relying on application specific knowledge. The log keys correspond to the log-print statements in the source code which can provide cues of system execution behavior. After converting log messages to log keys, we learn a Finite State Automaton (FSA) from training log sequences to present the normal work flow for each system component. At the same time, a performance measurement model is learned to characterize the normal execution performance based on the log messages' timing information. With these learned models, we can automatically detect anomalies in newly input log files. Experiments on Hadoop and SILK show that the technique can effectively detect running anomalies.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cited by
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
Drain: an online log parsing approach with fixed depth tree
He, P., Zhu, J., Zheng, Z., & Lyu, M. R. (2017) · 2017 IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws.2017.13 · Cited by 943
Robust log-based anomaly detection on unstable log data
Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., et al. (2019) · Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3338906.3338931 · Cited by 761
Self-citationTools and benchmarks for automated log parsing
Zhu, J., He, S., Liu, J., He, P., Xie, Q., Zheng, Z., & Lyu, M. R. (2019) · 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip.2019.00021 · Cited by 574
Spell: Streaming Parsing of System Event Logs
Du, M., & Li, F. (2016) · 2016 IEEE 16th International Conference on Data Mining (ICDM) · doi:10.1109/icdm.2016.0103 · Cited by 423
Log-based Anomaly Detection Without Log Parsing
Le, V.-H., & Zhang, H. (2021) · 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase51524.2021.9678773 · Cited by 361
“He et al [16] evaluated four widely used log parsers, including SLCT [57], IPLoM [26], LKE [58] and LogSig [20].”
MethodLoghub: a large collection of system log datasets for AI-driven log analytics
Zhu, J., He, S., He, P., Liu, J., & Lyu, M. R. (2023) · 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre59848.2023.00071 · Cited by 302
A Survey on Automated Log Analysis for Reliability Engineering
He, S., He, P., Chen, Z., Yang, T., Su, Y., & Lyu, M. R. (2022) · ACM Computing Surveys · doi:10.1145/3460345 · Cited by 334
Unsupervised Detection of Microservice Trace Anomalies through Service-Level Deep Bayesian Networks
Liu, P., Xu, H., Ouyang, Q., Jiao, R., Chen, Z., Zhang, S., Yang, J., Mo, L., Zeng, J., Xue, W., et al. (2020) · 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre5003.2020.00014 · Cited by 252
Towards Automated Log Parsing for Large-Scale Log Data Analysis
He, P., Zhu, J., He, S., Li, J., & Lyu, M. R. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2017.2762673 · Cited by 230
MicroHECL: High-Efficient Root Cause Localization in Large-Scale Microservice Systems
Liu, D., He, C., Peng, X., Lin, F., Zhang, C., Gong, S., Li, Z., Ou, J., & Wu, Z. (2021) · 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip52600.2021.00043 · Cited by 192
Anomaly Detection Using Program Control Flow Graph Mining From Execution Logs
Nandi, A., Mandal, A., Atreja, S., Dasgupta, G. B., & Bhattacharya, S. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939712 · Cited by 154
A survey of AIOps methods for failure management
Notaro, P., Cardoso, J., & Gerndt, M. (2021) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3483424 · Cited by 142
Log Parsing with Prompt-based Few-shot Learning
Le, V.-H., & Zhang, H. (2023) · 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) · doi:10.1109/icse48619.2023.00204 · Cited by 129
Towards intelligent incident management: why we need it and how we make it
Chen, Z., Kang, Y., Li, L., Zhang, X., Zhang, H., Xu, H., Zhou, Y., Yang, L., Sun, J., Xu, Z., et al. (2020) · Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3368089.3417055 · Cited by 99
An Approach for Anomaly Diagnosis Based on Hybrid Graph Model with Logs for Distributed Services
Jia, T., Chen, P., Yang, L., Li, Y., Meng, F., & Xu, J. (2017) · 2017 IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws.2017.12 · Cited by 78
An empirical investigation of practical log anomaly detection for online service systems
Zhao, N., Wang, H., Li, Z., Peng, X., Wang, G., Pan, Z., Wu, Y., Feng, Z., Wen, X., Zhang, W., et al. (2021) · Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3468264.3473933 · Cited by 77
A survey on outlier explanations
Panjei, E., Gruenwald, L., Leal, E., Nguyen, C., & Silvia, S. (2022) · The VLDB Journal · doi:10.1007/s00778-021-00721-1 · Cited by 67
Mining causality of network events in log data
Kobayashi, S., Otomo, K., Fukuda, K., & Esaki, H. (2018) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2017.2778096 · Cited by 63
Jia, T., Wu, Y., Hou, C., & Li, Y. (2021) · 2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre52982.2021.00021 · Cited by 55
Jin, M., Lv, A., Zhu, Y., Wen, Z., Zhong, Y., Zhao, Z., Wu, J., Li, H., He, H., & Chen, F. (2020) · IEEE Access · doi:10.1109/access.2020.3044610 · Cited by 50
Impact of log parsing on deep learning-based anomaly detection
Khan, Z. A., Shin, D., Bianculli, D., & Briand, L. C. (2024) · Empirical Software Engineering · doi:10.1007/s10664-024-10533-w · Cited by 49
Zhang, C., Wang, X., Zhang, H., Zhang, H., & Han, P. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3125967 · Cited by 49
LogAssist: Assisting Log Analysis Through Log Summarization
Locke, S., Li, H., Chen, T.-H., Shang, W., & Liu, W. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2021.3083715 · Cited by 45
Huang, L., & Zhu, T. (2021) · Proceedings of the ACM Symposium on Cloud Computing · doi:10.1145/3472883.3486994 · Cited by 37
Anomaly Detection in Microservice-Based Systems
Nobre, J., Pires, E. J. S., & Reis, A. (2023) · Applied Sciences · doi:10.3390/app13137891 · Cited by 34
LogOnline: A Semi-Supervised Log-Based Anomaly Detector Aided with Online Learning Mechanism
Wang, X., Song, J., Zhang, X., Tang, J., Gao, W., & Lin, Q. (2023) · 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00043 · Cited by 18
Analysis of Log Files to Enable Smart-Troubleshooting in Industry 4.0: A Systematic Mapping Study
Partovian, S., Bucaioni, A., Flammini, F., & Thornadtsson, J. (2024) · IEEE Access · doi:10.1109/access.2023.3342365 · Cited by 16
MADDC: Multi-Scale Anomaly Detection, Diagnosis and Correction for Discrete Event Logs
Wang, X., Yang, L., Li, D., Ma, L., He, Y., Xiao, J., Liu, J., & Yang, Y. (2022) · Proceedings of the 38th Annual Computer Security Applications Conference · doi:10.1145/3564625.3567972 · Cited by 16
Metadata
- Authors
- Fu, Q., Lou, J.-G., Wang, Y., & Li, J.
- Venue
- 2009 Ninth IEEE International Conference on Data Mining
- Publisher
- IEEE
- Published
- 2009-12
- Pages
- 149-158
- ISSN
- 1550-4786 (ISSN-L)
- OpenAlex
- W2102632804
- Cited by
- 542
- References
- 0
- FWCI
- 7.29
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
