Landscape of Automated Log Analysis: A Systematic Literature Review and Mapping Study

Abstract

Logging is a common practice in software engineering to provide insights into working systems. The main uses of log files have always been failure identification and root cause analysis. In recent years, novel applications of logging have emerged that benefit from automated analysis of log files, for example, real-time monitoring of system health, understanding users' behavior, and extracting domain knowledge. Although nearly every software system produces log files, the biggest challenge in log analysis is the lack of a common standard for both the content and format of log data. This paper provides a systematic review of recent literature (covering the period between 2000 and June 2021, concentrating primarily on the last five years of this period) related to automated log analysis. Our contribution is threefold: we present an overview of various research areas in the field; we identify different types of log files that are used in research, and we systematize the content of log files. We believe that this paper serves as a valuable starting point for new researchers in the field, as well as an interesting overview for those looking for other ways of utilizing log information.

Making Sense of Failure Logs in an Industrial DevOps Environment

“…They concluded that present log parsers are unsuitable for huge datasets, and the majority of them lack the requisite execution time efficiency. Korzeniowskiet al [20] conducted a systematic mapping study on the log analysis research. They presented their findings in the form of a landscape of automated log analysis, defining each discipline and highlighting recent research trends.…”

Knowledge Extraction and Discovery about Web System Based on the Benchmark Application of Online Stock Trading System

“…In recent years, novel applications have emerged and it benefited from automated log-file analysis, for example, real-time monitoring of system health, understanding user behavior, and extracting domain knowledge. In [ 2 , 3 ], we can find a systematic review of recent literature (covering the period between 2000 and June 2021) related to automated log analysis. Application logs record the behavior of a system during its runtime, and their analysis can provide useful information.…”

Discovering interactions between applications with log analysis

“…The authors identify two specific types of interactions: composition (one service orchestrates a series of calls to other services) and substitution (service is called as part of an error-handling scenario after a failed call to another service). The authors assume the availability of IP address information in service logs, which (according to [1]) is true mostly for access logs and network logs that may not be available for applications other than web services. Additionally, basing the analysis on IP address correlation may be very challenging in cloudhosted applications, where services are replicated, and IP addresses can change dynamically.…”

“…Because of our focus on automation of knowledge discovery about systems, we are only interested in automated log analysis. According to [1], automated analysis of application logs is a widely studied discipline with growing interest among researchers in recent years. The most obvious usage of log analysis lies in the operations area (intrusion detection, monitoring) but its potential in reasoning about the business domain or the design of the software is also explored.…”

“…In this paper, we try to derive knowledge about enterprise systems (specifically about interactions between applications) from application logs. Our work fits in the design/ component dependency inference area of the landscape of automated log analysis proposed by the authors of [1]. We perform experiments on a real-life system from the banking industry, hosted at Nordea Bank.…”