Drain: an online log parsing approach with fixed depth tree
Abstract
Logs, which record valuable system runtime information, have been widely employed in Web service management by service providers and users. A typical log analysis based Web service management procedure is to first parse raw log messages because of their unstructured format; and then apply data mining models to extract critical system behavior information, which can assist Web service management. Most of the existing log parsing methods focus on offline, batch processing of logs. However, as the volume of logs increases rapidly, model training of offline log parsing methods, which employs all existing logs after log collection, becomes time consuming. To address this problem, we propose an online log parsing method, namely Drain, that can parse logs in a streaming and timely manner. To accelerate the parsing process, Drain uses a fixed depth parse tree, which encodes specially designed rules for parsing. We evaluate Drain on five real-world log data sets with more than 10 million raw log messages. The experimental results show that Drain has the highest accuracy on four data sets, and comparable accuracy on the remaining one. Besides, Drain obtains 51.85%~81.47% improvement in running time compared with the state-of-the-art online parser. We also conduct a case study on an anomaly detection task using Drain in the parsing step, which determines the effectiveness of Drain in log analysis.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The evidence trace makes the agent's reasoning inspectable: a reviewer can see which logs, metrics, traces, tickets, configurations, validators, or simulators were queried, and whether the resulting evidence was sufficient for the proposed diagnosis or action.
“This makes the agent's reasoning inspectable: a reviewer can see which logs, metrics, traces, tickets, configurations, validators, or simulators were queried, and whether the resulting evidence was sufficient for the proposed diagnosis or action [77], [60], [78], [61], [25].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [78]
Modern production diagnosis is fundamentally query-driven, and good teams treat incident response as repeated hypothesis testing under partial observability.
“First, modern production diagnosis is fundamentally query-driven, and good teams treat incident response as repeated hypothesis testing under partial observability [4], [78], [84].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [78]
Production debugging systems are used in practice through writing a discriminating query, refining the candidate set, and then writing the next query.
“This framing aligns well with how production debugging systems are used in practice, through writing discriminating query, refine the candidate set, and then write the next query [78], [61], [53], [54].”
From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [78]
Log processing faces high computing overhead from template conversion via parsing algorithms like Drain, and real-time processing pressure from explosive log volume during fault concurrency.
“they face two key challenges: high computing overhead from template conversion via parsing algorithms like Drain, and real-time processing pressure from explosive log volume during fault concurrency, making processing efficiency the system bottleneck.”
From A Survey of Anomaly Detection and Root Cause Analysis Techniques for Artificial Intelligence for IT Operations (AIOps) in Large-Scale Software Systems (2026) · cites this paper as [9]
Industry widely adopts online clustering algorithms based on parse trees such as Drain, which compress data dimensions efficiently but have insufficient discrimination for templates with high semantic similarity.
“The industry widely adopts online clustering algorithms based on parse trees such as Drain [9] , which can compress data dimensions efficiently but has insufficient discrimination for templates with high semantic similarity.”
From A Survey of Anomaly Detection and Root Cause Analysis Techniques for Artificial Intelligence for IT Operations (AIOps) in Large-Scale Software Systems (2026) · cites this paper as [9]
Traditional rule-based approaches struggle to adapt to evolving workloads and often suffer from high false-positive rates on complex, real-world clusters.
“While computationally lightweight, these methods struggle to adapt to evolving workloads and often suffer from high false-positive rates when applied to complex, real-world clusters.”
From LINEADAPTER: Parameter-Efficient Fine-Tuning for Log Anomaly Detection and Root Cause Analysis (2025) · cites this paper as [4]
The frequency-ratio-based heuristic has been widely adopted in prior work on log anomaly detection, particularly in template blacklisting and rule construction.
“This frequencyratio-based heuristic has been widely adopted in prior work on log anomaly detection, particularly in template blacklisting and rule construction [4], [5].”
From LINEADAPTER: Parameter-Efficient Fine-Tuning for Log Anomaly Detection and Root Cause Analysis (2025) · cites this paper as [4]
LogBERT uses the Drain algorithm for parsing logs in real time, showing superior performance across benchmarks like HDFS and Thunderbird.
“It uses the Drain algorithm for parsing logs in real time, showing superior performance across benchmarks like HDFS and Thunderbird [19].”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [19]
Cites
Introduction to information retrieval
(2009) · Choice Reviews Online · doi:10.5860/choice.46-2715 · Cited by 12,278 · see citing works
Term-Weighting Approaches in Automatic Text Retrieval
Salton, G., & Buckley, C. (1988) · Information Processing & Management · doi:10.1016/0306-4573(88)90021-0 · Cited by 11,421 · see citing works
Introduction to Information Retrieval
Manning, C. D., Raghavan, P., & Schütze, H. (2008) · doi:10.1017/cbo9780511809071 · Cited by 11,288 · see citing works
Detecting large-scale system problems by mining console logs
Xu, W., Huang, L., Fox, A., Patterson, D., & Jordan, M. I. (2009) · Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles · doi:10.1145/1629575.1629587 · Cited by 1,332 · see citing works
What Supercomputers Say: A Study of Five System Logs
Oliner, A., & Stearley, J. (2007) · Dependable Systems and Networks · doi:10.1109/dsn.2007.103 · Cited by 721 · see citing works
Execution Anomaly Detection in Distributed Systems through Unstructured Log Analysis
Fu, Q., Lou, J., Wang, Y., & Jiang, L. (2009) · Proceedings · doi:10.1109/icdm.2009.60 · Cited by 555 · see citing works
Spell: Streaming Parsing of System Event Logs
Du, M., & Li, F. (2016) · 2016 IEEE 16th International Conference on Data Mining (ICDM) · doi:10.1109/icdm.2016.0103 · Cited by 423 · see citing works
An Evaluation Study on Log Parsing and Its Use in Log Mining
He, P., Zhu, J., He, S., Li, J., & Lyu, M. R.-T. (2016) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2016.66 · Cited by 245 · see citing works
Self-citationLogSig: generating system events from raw textual logs
Tang, L., Li, T., & Perng, C.-S. (2011) · Proceedings of the 20th ACM international conference on Information and knowledge management · doi:10.1145/2063576.2063690 · Cited by 244 · see citing works
Learning to Log: Helping Developers Make Informed Logging Decisions
Zhu, J., He, P., Fu, Q., Zhang, H., Lyu, M. R.-T., & Zhang, D. (2015) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse.2015.60 · Cited by 217 · see citing works
Self-citationEverything as a Service (XaaS) on the Cloud: Origins, Current and Future Trends
Duan, Y., Fu, G., Zhou, N., Sun, X., Narendra, N. C., & Hu, B. (2015) · IEEE ... International Conference on Cloud Computing · doi:10.1109/cloud.2015.88 · Cited by 198 · see citing works
Effective Software Fault Localization Using an RBF Neural Network
Wong, W. E., Debroy, V., Golden, R. M., Xu, X., & Thuraisingham, B. M. (2011) · IEEE Transactions on Reliability · doi:10.1109/tr.2011.2172031 · Cited by 189 · see citing works
Mi, H., Wang, H., Zhou, Y., Lyu, M. R.-T., & Cai, H. (2013) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2013.21 · Cited by 176 · see citing works
Self-citationA Lightweight Algorithm for Message Type Extraction in System Application Logs
Makanju, A., Zincir-Heywood, N., & Milios, E. (2011) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2011.138 · Cited by 147 · see citing works
Incremental Mining of System Log Format
Mizutani, M. (2013) · IEEE International Conference on Services Computing · doi:10.1109/scc.2013.73 · Cited by 145 · see citing works
Reliable QoS monitoring based on client feedback
Jurca, R., Faltings, B. V., & Binder, W. (2007) · International World Wide Web Conference (WWW) · doi:10.1145/1242572.1242708 · Cited by 137 · see citing works
Performance prediction of component-based applications
Chen, S., Liu, Y., Gorton, I., & Liu, A. (2004) · Journal of Systems and Software · doi:10.1016/j.jss.2003.05.005 · Cited by 91 · see citing works
Log 2 : a cost-aware logging mechanism for performance diagnosis
Ding, R. F., Zhou, H., Lou, J., Zhang, H., Lin, Q., Fu, Q., Zhang, D., & Xie, T. (2015) · NOVA (University of Newcastle Australia) · Cited by 70 · see citing works
Business Process Mining from E-Commerce Web Logs
Poggi, N., Muthusamy, V., Carrera, D., & Khalaf, R. Y. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-40176-3_7 · Cited by 64 · see citing works
UiLog: Improving Log-Based Fault Diagnosis by Log Analysis
Zou, D., Qin, H., & Jin, H. (2016) · Journal of Computer Science and Technology · doi:10.1007/s11390-016-1678-7 · Cited by 60 · see citing works
Process mining on noisy logs — Can log sanitization help to improve performance?
Cheng, H.-J., & Kumar, A. (2015) · Decision Support Systems · doi:10.1016/j.dss.2015.08.003 · Cited by 55 · see citing works
Deriving Protocol Models from Imperfect Service Conversation Logs
Motahari‐Nezhad, H. R., Saint-Paul, R., Benatallah, B., & Casati, F. (2008) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2008.87 · Cited by 44 · see citing works
Automotive Cloud Service Systems Based on Service-Oriented Architecture and Its Evaluation
Iwai, A., & Aoyama, M. (2011) · IEEE ... International Conference on Cloud Computing · doi:10.1109/cloud.2011.119 · Cited by 40 · see citing works
System problem detection by mining console logs
Patterson, D. A., & Xu, W. (2010) · Cited by 38 · see citing works
Zhang, J., Iannucci, B., Hennessy, M., Gopal, K., Xiao, S., Kumar, S., Pfeffer, D., Aljedia, B., Ren, Y., Griss, M., et al. (2013) · IEEE International Conference on Services Computing · doi:10.1109/scc.2013.34 · Cited by 34 · see citing works
A Temporal-Aware Hybrid Collaborative Recommendation Method for Cloud Service
Meng, S., Zhou, Z., Huang, T., Li, D., Wang, S., Fei, F., Wang, W., & Dou, W. (2016) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws.2016.40 · Cited by 23 · see citing works
Personalized ranking for digital libraries based on log analysis
Sun, Y., Li, H., Councill, I. G., Huang, J. L., Lee, W.-C., & Giles, C. L. (2008) · ACM International Workshop on Web Information and Data Management (WIDM) · doi:10.1145/1458502.1458524 · Cited by 20 · see citing works
Modelling Collaborative Services for Business and QoS Compliance
Yao, J., Chen, S., Wang, C., Levy, D., & Žic, J. (2011) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws.2011.44 · Cited by 14 · see citing works
Prediction of Web User Behavior by Discovering Temporal Relational Rules from Web Log Data
Yu, X., Li, M., Paik, I., & Ryu, K. H. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-32597-7_3 · Cited by 12 · see citing works
Real-Time Anomaly Detection in Streams of Execution Traces
Zhang, W., Bastani, F., Yen, I., Hulin, K. J., Bastani, F., & Khan, L. R. (2012) · IEEE International Symposium on High Assurance Systems Engineering (HASE) · doi:10.1109/hase.2012.13 · Cited by 8 · see citing works
Web Services Selection in Support of Reliable Web Service Choreography
Hwang, S., Liao, W.-P., & Lee, C.-H. (2010) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws.2010.79 · Cited by 8 · see citing works
Reconfiguration of Service Failures in DAMASCo Using Dynamic Software Product Lines
Cubo, J., Gámez, N., Pimentel, E., & Fuentes, L. (2015) · IEEE International Conference on Services Computing · doi:10.1109/scc.2015.25 · Cited by 4 · see citing works
Flagged first, then by citations
1 of the 33 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Robust log-based anomaly detection on unstable log data
Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., et al. (2019) · Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3338906.3338931 · Cited by 761 · see citing works
Tools and benchmarks for automated log parsing
Zhu, J., He, S., Liu, J., He, P., Xie, Q., Zheng, Z., & Lyu, M. R. (2019) · 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip.2019.00021 · Cited by 574 · see citing works
Self-citationLogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · 2021 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534113 · Cited by 454 · see citing works
A Survey on Automated Log Analysis for Reliability Engineering
He, S., He, P., Chen, Z., Yang, T., Su, Y., & Lyu, M. R. (2022) · ACM Computing Surveys · doi:10.1145/3460345 · Cited by 334 · see citing works
Self-citationLoghub: a large collection of system log datasets for AI-driven log analytics
Zhu, J., He, S., He, P., Liu, J., & Lyu, M. R. (2023) · 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre59848.2023.00071 · Cited by 302 · see citing works
Self-citationLog-based Anomaly Detection Without Log Parsing
Le, V.-H., & Zhang, H. (2021) · 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase51524.2021.9678773 · Cited by 289 · see citing works
“Table I shows examples of wrongly parsed log templates by the Drain parser [24].”
BackgroundMethodInfluentialSemi-Supervised Log-Based Anomaly Detection via Probabilistic Label Estimation
Yang, L., Chen, J., Wang, Z., Wang, W., Jiang, J., Dong, X., & Zhang, W. (2021) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse43902.2021.00130 · Cited by 276 · see citing works
Log-based anomaly detection with deep learning: how far are we?
Le, V.-H., & Zhang, H. (2022) · Proceedings of the 44th International Conference on Software Engineering · doi:10.1145/3510003.3510155 · Cited by 257 · see citing works
Deep learning for anomaly detection in log data: A survey
Landauer, M., Onder, S., Skopik, F., & Wurzenberger, M. (2023) · Machine Learning with Applications · doi:10.1016/j.mlwa.2023.100470 · Cited by 244 · see citing works
HitAnomaly: Hierarchical Transformers for Anomaly Detection in System Log
Huang, S., Liu, Y., Fung, C., He, R., Zhao, Y., Yang, H., & Luan, Z. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3034647 · Cited by 234 · see citing works
Zhang, C., Peng, X., Sha, C., Zhang, K., Fu, Z., Wu, X., Lin, Q., & Zhang, D. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510180 · Cited by 214 · see citing works
Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs
Nedelkoski, S., Bogatinovski, J., Acker, A., Cardoso, J., & Kao, O. (2020) · 2020 IEEE International Conference on Data Mining (ICDM) · doi:10.1109/icdm50108.2020.00148 · Cited by 176 · see citing works
Logram: Efficient Log Parsing Using n-Gram Dictionaries
Dai, H., Li, H., Chen, C. S., Shang, W., & Chen, T.-H. P. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3007554 · Cited by 175 · see citing works
A search-based approach for accurate identification of log message formats
Messaoudi, S., Panichella, A., Bianculli, D., Briand, L., & Sasnauskas, R. (2018) · IEEE International Conference on Program Comprehension (ICPC) · doi:10.1145/3196321.3196340 · Cited by 168 · see citing works
SwissLog: Robust and Unified Deep Learning Based Log Anomaly Detection for Diverse Faults
Li, X., Chen, P., Jing, L., He, Z., & Yu, G. (2020) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre5003.2020.00018 · Cited by 158 · see citing works
Eadro: An End-to-End Troubleshooting Framework for Microservices on Multi-source Data
Lee, C., Yang, T., Chen, Z., Su, Y., & Lyu, M. R. (2023) · 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) · doi:10.1109/icse48619.2023.00150 · Cited by 149 · see citing works
Self-citationLILAC: Log Parsing using LLMs with Adaptive Parsing Cache
Jiang, Z., Liu, J., Chen, Z., Li, Y., Huang, J., Huo, Y., He, P., Gu, J., & Lyu, M. R.-T. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3643733 · Cited by 148 · see citing works
Self-citationYu, G., Chen, P., Li, Y., Chen, H., Li, X., & Zheng, Z. (2023) · Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3611643.3616249 · Cited by 140 · see citing works
Self-citationLAnoBERT: System log anomaly detection based on BERT masked language model
Lee, Y., Kim, J., & Kang, P. (2023) · Applied Soft Computing · doi:10.1016/j.asoc.2023.110689 · Cited by 139 · see citing works
UniParser: A Unified Log Parser for Heterogeneous Log Data
Liu, Y., Zhang, X., He, S., Zhang, H., Li, L., Kang, Y., Xu, Y. D., Ma, M., Lin, Q., Dang, Y., et al. (2022) · International World Wide Web Conference (WWW) · doi:10.1145/3485447.3511993 · Cited by 134 · see citing works
Experience Report: Deep Learning-based System Log Analysis for Anomaly DetectionPreprint
Chen, Z., Liu, J., Gu, W., Su, Y., & Lyu, M. R.-T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.05908 · Cited by 134 · see citing works
Self-citationLog Parsing with Prompt-based Few-shot Learning
Le, V.-H., & Zhang, H. (2023) · 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) · doi:10.1109/icse48619.2023.00204 · Cited by 129 · see citing works
Robust Failure Diagnosis of Microservice System Through Multimodal Data
Zhang, S., Jin, P., Lin, Z., Sun, Y., Zhang, B., Xia, S., Li, Z., Zhong, Z., Ma, M., Jin, W., et al. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3290018 · Cited by 118 · see citing works
Spell: Online Streaming Parsing of Large Unstructured System Logs
Du, M., & Li, F. (2018) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2018.2875442 · Cited by 118 · see citing works
System log clustering approaches for cyber security applications: A survey
Landauer, M., Skopik, F., Wurzenberger, M., & Rauber, A. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101739 · Cited by 118 · see citing works
LogGPT: Exploring ChatGPT for Log-Based Anomaly Detection
Qi, J., Huang, S., Luan, Z., Yang, S., Fung, C., Yang, H., Qian, D., Shang, J., Xiao, Z., & Wu, Z. (2023) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys60770.2023.00045 · Cited by 114 · see citing works
LogTransfer: Cross-System Log Anomaly Detection for Software Systems with Transfer Learning
Chen, R., Zhang, S., Li, D., Zhang, Y., Guo, F., Meng, W., Pei, D., Zhang, Y., Chen, X., & Liu, Y. (2020) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre5003.2020.00013 · Cited by 112 · see citing works
LogFiT: Log Anomaly Detection Using Fine-Tuned Language Models
Almodovar, C., Sabrina, F., Karimi, S., & Azad, S. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3358730 · Cited by 111 · see citing works
LogEvent2vec: LogEvent-to-Vector Based Anomaly Detection for Large-Scale Logs in Internet of Things
Wang, J., Tang, Y., He, S., Zhao, C., Sharma, P. K., Alfarraj, O., & Tolba, A. K. R. (2020) · Sensors · doi:10.3390/s20092451 · Cited by 109 · see citing works
Logzip: Extracting Hidden Structures via Iterative Clustering for Log Compression
Liu, J., Zhu, J., He, S., He, P., Zheng, Z., & Lyu, M. R.-T. (2019) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase.2019.00085 · Cited by 102 · see citing works
Self-citationBrain: Log Parsing With Bidirectional Parallel Tree
Yu, S., He, P., Chen, N., & Wu, Y. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3270566 · Cited by 102 · see citing works
Self-citationLLMParser: An Exploratory Study on Using Large Language Models for Log Parsing
Ma, Z.-Y., Chen, A.-R., Kim, D. J., Chen, T., & Wang, S.-W. (2024) · International Conference on Software Engineering · doi:10.1145/3597503.3639150 · Cited by 151 · see citing works
A Large-Scale Evaluation for Log Parsing Techniques: How Far Are We?
Jiang, Z., Liu, J., Huang, J., Li, Y., Huo, Y., Gu, J., Chen, Z., Zhu, J., & Lyu, M. R.-T. (2024) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3650212.3652123 · Cited by 99 · see citing works
Self-citationIdentifying bad software changes via multimodal anomaly detection for online service systems
Zhao, N., Chen, J., Yu, Z., Wang, H., Li, J., Qiu, B., Hong-yu, X., Zhang, W., Sui, K., & Pei, D. (2021) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3468264.3468543 · Cited by 97 · see citing works
DivLog: Log Parsing with Prompt Enhanced In-Context Learning
Xu, J., Yang, R., Huo, Y., Zhang, C., & He, P. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3639155 · Cited by 96 · see citing works
Self-citationBERT-Log: Anomaly Detection for System Logs Based on Pre-trained Language Model
Chen, S., & Liao, H. (2022) · Applied Artificial Intelligence · doi:10.1080/08839514.2022.2145642 · Cited by 94 · see citing works
Guidelines for assessing the accuracy of log message template identification techniques
Khan, Z. A., Shin, D., Bianculli, D., & Briand, L. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510101 · Cited by 91 · see citing works
Log-Based Anomaly Detection With Robust Feature Extraction and Online Learning
Han, S., Wu, Q., Zhang, H., Qin, B., Hu, J., Shi, X., Liu, L., & Yin, X. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3053371 · Cited by 88 · see citing works
DeepAG: Attack Graph Construction and Threats Prediction With Bi-Directional Deep Learning
Li, T., Jiang, Y. L., Lin, C., Obaidat, M. S., Shen, Y., & Ma, J. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3143551 · Cited by 88 · see citing works
Root-Cause Metric Location for Microservice Systems via Log Anomaly Detection
Wang, L., Zhao, N., Chen, J., Li, P., Zhang, W., & Sui, K. (2020) · 2020 IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws49710.2020.00026 · Cited by 84 · see citing works
Zhang, T., Qiu, H., Castellano, G., Rifai, M., Chen, C. S., & Pianese, F. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2022.3222417 · Cited by 82 · see citing works
Robust Multimodal Failure Detection for Microservice Systems
Zhao, C., Ma, M., Zhong, Z., Zhang, S., Tan, Z., Xiong, X., Yu, L., Feng, J., Sun, Y., Zhang, Y., et al. (2023) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3580305.3599902 · Cited by 81 · see citing works
SwissLog: Robust Anomaly Detection and Localization for Interleaved Unstructured Logs
Li, X., Chen, P., Jing, L., He, Z., & Yu, G. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3162857 · Cited by 79 · see citing works
LogGPT: Log Anomaly Detection via GPT
Han, X., Yuan, S., & Trabelsi, M. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386543 · Cited by 80 · see citing works
Nedelkoski, S., Bogatinovski, J., Acker, A., Cardoso, J., & Kao, O. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-67667-4_8 · Cited by 78 · see citing works
An empirical investigation of practical log anomaly detection for online service systems
Zhao, N., Wang, H., Li, Z., Peng, X., Wang, G., Pan, Z., Wu, Y., Feng, Z., Wen, X., Zhang, W., et al. (2021) · Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3468264.3473933 · Cited by 77 · see citing works
LogFormer: A Pre-train and Tuning Pipeline for Log Anomaly Detection
Guo, H., Yang, J., Liu, J., Bai, J., Wang, B., Li, Z., Zheng, T., Zhang, B., Peng, J., & Tian, Q. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i1.27764 · Cited by 77 · see citing works
Heterogeneous Anomaly Detection for Software Systems via Semi-supervised Cross-modal Attention
Lee, C. Q. E., Yang, T., Chen, Z., Su, Y., Yang, Y., & Lyu, M. R.-T. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00148 · Cited by 75 · see citing works
Self-citationA systematic literature review on automated log abstraction techniques
El-Masri, D., Petrillo, F. D. S., Guéhéneuc, Y., Hamou‐Lhadj, A., & Bouziane, A. (2020) · Information and Software Technology · doi:10.1016/j.infsof.2020.106276 · Cited by 74 · see citing works
PLELog: Semi-Supervised Log-Based Anomaly Detection via Probabilistic Label Estimation
Yang, L., Chen, J., Wang, Z., Wang, W., Jiang, J., Dong, X., & Zhang, W. (2021) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion52605.2021.00106 · Cited by 72 · see citing works
Benchmarking Large Language Models for Log Analysis, Security, and Interpretation
Karlsen, E., Luo, X., Zincir-Heywood, N., & Heywood, M. (2024) · Journal of Network and Systems Management · doi:10.1007/s10922-024-09831-x · Cited by 71 · see citing works
Deep Learning or Classical Machine Learning? An Empirical Study on Log-Based Anomaly Detection
Yu, B., Yao, J., Fu, Q., Zhong, Z., Xie, H., Wu, Y., Ma, Y., & He, P. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3623308 · Cited by 70 · see citing works
Self-citationAnomaly Detection in Operating System Logs with Deep Learning-Based Sentiment Analysis
Studiawan, H., Sohel, F. A., & Payne, C. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3037903 · Cited by 69 · see citing works
A Semantic-aware Representation Framework for Online Log Analysis
Meng, W., Liu, Y., Huang, Y., Zhang, S., Zaiter, F., Chen, B. J., & Pei, D. (2020) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn49398.2020.9209707 · Cited by 68 · see citing works
Log Parsing: How Far Can ChatGPT Go?
Le, V.-H., & Zhang, H. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00206 · Cited by 68 · see citing works
Interpretable Online Log Analysis Using Large Language Models with Prompt Strategies
Liu, Y., Tao, S., Meng, W., Wang, J., Ma, W., Chen, Y., Zhao, Y., Yang, H., & Jiang, Y. (2024) · IEEE International Conference on Program Comprehension (ICPC) · doi:10.1145/3643916.3644408 · Cited by 68 · see citing works
Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection
Wang, Z., Chen, Z., Ni, J., Liu, H., Chen, H., & Tang, J. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467125 · Cited by 67 · see citing works
LogEncoder: Log-Based Contrastive Representation Learning for Anomaly Detection
Qi, J., Luan, Z., Huang, S., Fung, C., Yang, H., Li, H., Zhu, D., & Qian, D. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2023.3239522 · Cited by 67 · see citing works
LogParser-LLM: Advancing Efficient Log Parsing with Large Language Models
Zhong, A., Mo, D., Liu, G., Liu, J., Lu, Q., Zhou, Q., Wu, J., Li, Q., & Wen, Q. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671810 · Cited by 66 · see citing works
Automatic Programming: Large Language Models and Beyond
Lyu, M. R.-T., Ray, B., Roychoudhury, A., Tan, S. H., & Thongtanunam, P. (2024) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3708519 · Cited by 65 · see citing works
Self-citationA Survey on Log Anomaly Detection using Deep Learning
Yadav, R. B., Kumar, P., & Dhavale, S. (2020) · International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO) · doi:10.1109/icrito48877.2020.9197818 · Cited by 64 · see citing works
SemParser: A Semantic Parser for Log Analytics
Huo, Y., Su, Y., Lee, C. Q. E., & Lyu, M. R.-T. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00082 · Cited by 62 · see citing works
Self-citationLandauer, M., Skopik, F., & Wurzenberger, M. (2024) · Proceedings of the ACM on Software Engineering · doi:10.1145/3660768 · Cited by 61 · see citing works
DeepSyslog: Deep Anomaly Detection on Syslog Using Sentence Embedding and Metadata
Zhou, J., Qian, Y., Zou, Q., Liu, P., & Xiang, J. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3201379 · Cited by 61 · see citing works
LogGD: Detecting Anomalies from System Logs with Graph Neural Networks
Xie, Y., Zhang, H., & Babar, M. A. (2022) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs57517.2022.00039 · Cited by 61 · see citing works
Onion: identifying incident-indicating logs for cloud systems
Zhang, X., Xu, Y. D., Qin, S., He, S., Qiao, B., Li, Z., Zhang, H., Li, X., Dang, Y., Lin, Q., et al. (2021) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3468264.3473919 · Cited by 59 · see citing works
Improving Log-Based Anomaly Detection by Pre-Training Hierarchical Transformers
Huang, S., Liu, Y., Fung, C., Wang, H., Yang, H., & Luan, Z. (2023) · IEEE Transactions on Computers · doi:10.1109/tc.2023.3257518 · Cited by 58 · see citing works
Jia, T., Wu, Y., Hou, C., & Li, Y. (2021) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre52982.2021.00021 · Cited by 56 · see citing works
Did We Miss Something Important? Studying and Exploring Variable-Aware Log Abstraction
Li, Z., Luo, C., Chen, T.-H. P., Shang, W., He, S., Lin, Q., & Zhang, D. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00078 · Cited by 56 · see citing works
LogClass: Anomalous Log Identification and Classification With Partial Labels
Meng, W., Liu, Y., Zhang, S., Zaiter, F., Zhang, Y., Huang, Y., Yu, Z., Zhang, Y., Song, L., Zhang, M., et al. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3055425 · Cited by 56 · see citing works
An empirical study of log analysis at Microsoft
He, S., Zhang, X., He, P., Xu, Y. D., Li, L., Kang, Y., Ma, M., Wei, Y., Dang, Y., Rajmohan, S., et al. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3558963 · Cited by 53 · see citing works
Self-citationSelf-Supervised Anomaly Detection from Distributed Traces
Bogatinovski, J., Nedelkoski, S., Cardoso, J., & Kao, O. (2020) · 2020 IEEE/ACM 13th International Conference on Utility and Cloud Computing (UCC) · doi:10.1109/ucc48980.2020.00054 · Cited by 50 · see citing works
Twin Graph-Based Anomaly Detection via Attentive Multi-Modal Learning for Microservice System
Huang, J., Yang, Y., Yu, H., Li, J., & Zheng, X. (2023) · 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00138 · Cited by 50 · see citing works
Zhang, C., Wang, X., Zhang, H., Zhang, H., & Han, P. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3125967 · Cited by 50 · see citing works
Impact of log parsing on deep learning-based anomaly detection
Khan, Z. A., Shin, D., Bianculli, D., & Briand, L. C. (2024) · Empirical Software Engineering · doi:10.1007/s10664-024-10533-w · Cited by 49 · see citing works
SPINE: a scalable log parser with feedback guidance
Wang, X., Zhang, X., Li, L., He, S., Zhang, H., Liu, Y., Zheng, L., Kang, Y., Lin, Q., Dang, Y., et al. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3549176 · Cited by 49 · see citing works
LogParse: Making Log Parsing Adaptive through Word Classification
Meng, W., Liu, Y., Zaiter, F., Zhang, S., Chen, Y., Zhang, Y., Zhu, Y., Wang, E., Zhang, R., Tao, S., et al. (2020) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn49398.2020.9209681 · Cited by 49 · see citing works
MLog: Mogrifier LSTM-Based Log Anomaly Detection Approach Using Semantic Representation
Fu, Y., Liang, K., & Xu, J. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3289488 · Cited by 47 · see citing works
MoniLog: An Automated Log-Based Anomaly Detection System for Cloud Computing Infrastructures
Vervaet, A. (2021) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde51399.2021.00317 · Cited by 47 · see citing works
LLMeLog: An Approach for Anomaly Detection based on LLM-enriched Log Events
He, M., Jia, T., Duan, C., Cai, H., Li, Y., & Huang, G. (2024) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre62328.2024.00023 · Cited by 46 · see citing works
A LSTM-Based Anomaly Detection Model for Log Analysis
Zhao, Z., Xu, C., & Li, B. H. (2021) · Journal of Signal Processing Systems · doi:10.1007/s11265-021-01644-4 · Cited by 46 · see citing works
LogAssist: Assisting Log Analysis Through Log Summarization
Locke, S., Li, H., Chen, T.-H., Shang, W., & Liu, W. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2021.3083715 · Cited by 45 · see citing works
Tao, S., Meng, W., Cheng, Y., Zhu, Y., Liu, Y., Du, C., Han, T., Zhao, Y., Wang, X., & Yang, H. (2022) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/3543146.3543168 · Cited by 45 · see citing works
LayerLog: Log sequence anomaly detection based on hierarchical semantics
Zhang, C., Wang, X., Zhang, H., Zhang, J., Zhang, H., Liu, C., & Han, P. (2022) · Applied Soft Computing · doi:10.1016/j.asoc.2022.109860 · Cited by 45 · see citing works
Zeufack, V., Kim, D., Seo, D., & Lee, A. (2021) · High-Confidence Computing · doi:10.1016/j.hcc.2021.100030 · Cited by 45 · see citing works
Loader: A Log Anomaly Detector Based on Transformer
Xiao, T. Y., Quan, Z., Wang, Z.-J., Le, Y., Du, Y., Liao, X., Li, K., & Li, K. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3280575 · Cited by 43 · see citing works
MetaLog: Generalizable Cross-System Anomaly Detection from Logs with Meta-Learning
Zhang, C., Jia, T., Shen, G., Zhu, P., & Li, Y. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3639205 · Cited by 43 · see citing works
Advanced Persistent Threat Attack Detection Systems: A Review of Approaches, Challenges, and Trends
Buchta, R., Gkoktsis, G., Heine, F., & Kleiner, C. (2024) · Digital Threats Research and Practice · doi:10.1145/3696014 · Cited by 43 · see citing works
Temporal Logical Attention Network for Log-Based Anomaly Detection in Distributed Systems
Liu, Y., Ren, S., Wang, X., & Zhou, M. (2024) · Sensors · doi:10.3390/s24247949 · Cited by 43 · see citing works
LLM-LADE: Large language model-based log anomaly detection with explanation
Zhang, Z., Li, S., Zhang, L., Ye, J., Hu, C., & Yan, L. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.114064 · Cited by 42 · see citing works
Robust and Transferable Anomaly Detection in Log Data using Pre-Trained Language Models
Ott, H., Bogatinovski, J., Acker, A., Nedelkoski, S., & Kao, O. (2021) · IEEE/ACM International Workshop on Cloud Intelligence (CloudIntelligence) · doi:10.1109/cloudintelligence52565.2021.00013 · Cited by 42 · see citing works
LogGT: Cross-system log anomaly detection via heterogeneous graph feature and transfer learning
Wang, P., Zhang, X., Cao, Z., Xu, W., & Li, W. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124082 · Cited by 41 · see citing works
PredictDeep: Security Analytics as a Service for Anomaly Detection and Prediction
Elsayed, M. A., & Zulkernine, M. (2020) · IEEE Access · doi:10.1109/access.2020.2977325 · Cited by 41 · see citing works
Improving Log-Based Anomaly Detection with Component-Aware Analysis
Yin, K., Yan, M. L., Xu, L., Xu, Z., Li, Z., Yang, D., & Zhang, X. (2020) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme46990.2020.00069 · Cited by 41 · see citing works
LogKG: Log Failure Diagnosis Through Knowledge Graph
Sui, Y., Zhang, Y., Sun, J., Xu, T., Zhang, S., Li, Z., Sun, Y., Guo, F., Shen, J., Zhang, Y., et al. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3293890 · Cited by 40 · see citing works
GLAD-PAW: Graph-Based Log Anomaly Detection by Position Aware Weighted Graph Attention Network
Wan, Y., Liu, Y., Wang, D., & Wen, Y. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-75762-5_6 · Cited by 39 · see citing works
An empirical study of the impact of log parsers on the performance of log-based anomaly detection
Fu, Y., Yan, M. L., Xu, Z., Xia, X., Zhang, X., & Yang, D. (2022) · Empirical Software Engineering · doi:10.1007/s10664-022-10214-6 · Cited by 38 · see citing works
On the effectiveness of log representation for log-based anomaly detection
Wu, X., Li, H., & Khomh, F. (2023) · Empirical Software Engineering · doi:10.1007/s10664-023-10364-1 · Cited by 38 · see citing works
Improving Performances of Log Mining for Anomaly Prediction Through NLP-Based Log Parsing
Aussel, N., Petetin, Y., & Chabridon, S. (2018) · Proceedings - International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems · doi:10.1109/mascots.2018.00031 · Cited by 38 · see citing works
Aarohi: Making Real-Time Node Failure Prediction Feasible
Das, A., Mueller, F., & Rountree, B. (2020) · IEEE International Parallel and Distributed Processing Symposium (IPDPS) · doi:10.1109/ipdps47924.2020.00115 · Cited by 38 · see citing works
- Authors
- He, P., Zhu, J., Zheng, Z., & Lyu, M. R.
- Affiliations
- Chinese University of Hong Kong (HK)
- Sun Yat-sen University (CN)
- Venue
- 2017 IEEE International Conference on Web Services (ICWS)
- Publisher
- IEEE
- Published
- 2017-06
- Pages
- 33-40
- OpenAlex
- W2754665629
- Cited by
- 943
- References
- 33
- Citations by year
- 2026: 164 · 2025: 184 · 2024: 184 · 2023: 157 · 2022: 84 · 2021: 91 · 2020: 52 · 2019: 18 · 2018: 7 · 2017: 2
- FWCI
- 17.22
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Conference on Web Services (ICWS) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Database Systems and Queries
- Physical Sciences › Computer Science › Information Systems › Cloud Computing and Resource Management
- Keywords
- log parsing, online parsing, log analysis, web service management, anomaly detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
