Cited by 575Software System Performance and ReliabilitySoftware Engineering ResearchSoftware Engineering Techniques and Practices

Tools and benchmarks for automated log parsing

Open access
Zhu, Jieming, He, Shilin, Liu, Jinyang, He, Pinjia, Xie, Qi, Zheng, Zibin, Lyu, Michael R.·2019·2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)

Abstract

Logs are imperative in the development and maintenance process of many software systems. They record detailed runtime information that allows developers and support engineers to monitor their systems and dissect anomalous behaviors and errors. The increasing scale and complexity of modern software systems, however, make the volume of logs explodes. In many cases, the traditional way of manual log inspection becomes impractical. Many recent studies, as well as industrial tools, resort to powerful text search and machine learning-based analytics solutions. Due to the unstructured nature of logs, a first crucial step is to parse log messages into structured data for subsequent analysis. In recent years, automated log parsing has been widely studied in both academia and industry, producing a series of log parsers by different techniques. To better understand the characteristics of these log parsers, in this paper, we present a comprehensive evaluation study on automated log parsing and further release the tools and benchmarks for easy reuse. More specifically, we evaluate 13 log parsers on a total of 16 log datasets spanning distributed systems, supercomputers, operating systems, mobile systems, server applications, and standalone software. We report the benchmarking results in terms of accuracy, robustness, and efficiency, which are of practical importance when deploying automated log parsing in production. We also share the success stories and lessons learned in an industrial application at Huawei. We believe that our work could serve as the basis and provide valuable guidance to future research and deployment of automated log parsing.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/icse-seip.2019.00021

Cites

48 of 48 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Traditional rule-based approaches struggle to adapt to evolving workloads and often suffer from high false-positive rates on complex, real-world clusters.

    “While computationally lightweight, these methods struggle to adapt to evolving workloads and often suffer from high false-positive rates when applied to complex, real-world clusters.”

    From LINEADAPTER: Parameter-Efficient Fine-Tuning for Log Anomaly Detection and Root Cause Analysis (2025) · cites this paper as [5]

    The Introduction (p. 2) says handcrafted log-parsing rules require regular revision as logging code changes, and Industrial Deployment (p. 8) describes rule maintenance becoming difficult as System X evolves. This supports the adaptation concern, but our copy does not report high false-positive rates for rule-based methods on complex, real-world clusters; it discusses log parsing rather than that claimed outcome. (LLM, conf=0.85)

    Experimental — accuracy not yet measured
  • Pretraining contamination can silently inflate benchmark performance.

    “pretraining contamination can silently inflate benchmark performance, and contamination checks are now part of mainstream LLM evaluation practice [147], [44], [139].”

    From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [147]

    The Evaluation section (p. 5) benchmarks automated log parsers, and Robustness of Log Parsers (p. 7) discusses accuracy changes with log-data volume. Neither those passages nor searches for pretraining contamination and training-data leakage address inflated LLM benchmark performance. (LLM, conf=0.76)

    Experimental — accuracy not yet measured
  • LLM graders are not a substitute for tool-grounded correctness and safety scoring.

    “LLM graders can help with structure and readability, but they are not a substitute for tool-grounded correctness and safety scoring.”

    From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [147]

    The Evaluation section (p. 5) assesses log parsers for accuracy, robustness, and efficiency; the Experimental Setup (p. 6) defines correctness against ground-truth log-message groupings. Searches for LLM graders, readability, tool-grounded scoring, and safety found no passage addressing whether LLM graders can substitute for correctness and safety scoring. (LLM, conf=0.78)

    Experimental — accuracy not yet measured
  • The frequency-ratio-based heuristic has been widely adopted in prior work on log anomaly detection, particularly in template blacklisting and rule construction.

    “This frequencyratio-based heuristic has been widely adopted in prior work on log anomaly detection, particularly in template blacklisting and rule construction [4], [5].”

    From LINEADAPTER: Parameter-Efficient Fine-Tuning for Log Anomaly Detection and Root Cause Analysis (2025) · cites this paper as [5]

    The Techniques of Log Parsers section (p. 4) describes frequency-based methods for extracting log templates, while Related Work (p. 9) lists anomaly detection as an application of log analysis. Neither passage addresses a frequency-ratio heuristic for anomaly detection or its adoption in template blacklisting and rule construction; searches for those terms found no supporting passage. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

1 of the 49 references couldn’t be matched to a known paper.

Research works printed but not linked: 1

  1. [5][5] D. Yuan, H. Mai, W. Xiong, L. Tan, Y. Zhou, and S. Pasupathy, 'Sherlog: error diagnosis by connecting clues from run-time logs,' in ASPLOS , 2010, pp. 143-154. -

Cited by

Sorted by citations

Authors
Zhu, J., He, S., Liu, J., He, P., Xie, Q., Zheng, Z., & Lyu, M. R.
Affiliations
  • Huawei Technologies (China) (CN)
  • Chinese University of Hong Kong (HK)
  • Sun Yat-sen University (CN)
  • ETH Zurich (CH)
  • Southwest Minzu University (CN)
Venue
2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)
Publisher
IEEE
Published
2019-05
Pages
121-130
OpenAlex
W2963999143
Cited by
574
References
49
Citations by year
2026: 57 · 2025: 86 · 2024: 108 · 2023: 92 · 2022: 62 · 2021: 89 · 2020: 65 · 2019: 15
FWCI
49.91
Type
conference paper
Language
en
Open access
Locations
  • IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • National Natural Science Foundation of China (61332010, 61502401, 61722214)
  • Chinese University of Hong Kong (14210717)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
Keywords
benchmarking, structured data extraction

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review