Availability Assessment of SunOS/Solaris Unix Systems based on Syslogd and wtmpx log files: A case study

Abstract

This paper presents a measurement-based availability assessment study using field data collected during a 4-year period from 373 SunOS/Solaris Unix workstations and servers interconnected through a local area network. We focus on the estimation of machine uptimes, downtimes and availability based on the identification of failures that caused total service loss. Data corresponds to syslogd event logs that contain a large amount of information about the normal activity of the studied systems as well as their behavior in the presence of failures. It is widely recognized that the information contained in such event logs might be incomplete or imperfect. The solution investigated in this paper to address this problem is based on the use of auxiliary sources of data obtained from wtmpx files maintained by the SunOS/Solaris Unix operating system. The results obtained suggest that the combined use of wtmpx and syslogd log files provides more complete information on the state of the target systems that is useful to provide availability estimations that better reflect reality.

What Logs Should You Look at When an Application Fails? Insights from an Industrial Case Study

“…For example in [5] the authors recognized that logs might be incomplete and ambiguous. Consequently, they analyzed the possibility of combining wtmpx 1 and syslog log files to achieve a better understanding of the target system.…”

“…Understanding system failures through event logs is an important activity in many types of systems, to avoid severe consequences, such data and economical loss, damage to the environment. Event logs have been used over the past decades for either post-mortem [3], [4], [5], [6], [7] and on-line [8], [9] failure analysis and, more importantly, for characterizing the runtime behavior of industrial and critical systems [10], [11]. Moreover, the increasing use of Off-The-Shelf components, even in safety-critical domains, introduces new dependability challenges, due to unforeseen components interactions or wrong execution of operations processes [12].…”

SYNCEYE: An Availability Measurement Tool for Embedded Systems

“…For measuring availability of machines, Cristina Simache and Mohamed Kaaniche used event logs and wtmpx files [4]. The event log includes information about the normal activity of the system and their behavior in the presence of failures.…”

“…However, past methods put in too much time measuring availability. Cristina Simache and Mohamed Kaaniche measured availability of 373 machines with event logs during a 45 month observation period [4]. Another study, conducted by Marc Haberkorn and Kishor Trivedi, measured availability of complex system with their monitoring method in 5 days [5].…”

Establishing Hypothesis for Recurrent System Failures from Cluster Log Files

“…Correlated events in both the current and previous log files. 3. Correlated events in the previous log file but not in the current log file.…”