SemParser: A Semantic Parser for Log Analysis

Abstract

Logs, being run-time information automatically generated by software, record system events and activities with their timestamps. Before obtaining more insights about the run-time status of the software, a fundamental step of log analysis, called log parsing, is employed to extract structured templates and parameters from the semi-structured raw log messages. However, current log parsers regard each message as a character string, ignoring the semantic information included in parameters and templates.Thus, we propose the semantic parser SemParser to unlock the critical bottleneck of mining semantics from log messages. It contains two steps, an end-to-end semantic miner and a joint parser. Specifically, the first step aims to identify explicit semantics inside a single log, and the second step is responsible for jointly inferring implicit semantics and computing structural outputs based on the contextual knowledge base. To analyze the effectiveness of our semantic parser, we first demonstrate that it can derive rich semantics from log messages collected from seven widely-applied systems with an average F1 score of 0.987. Then, we conduct two representative downstream tasks, showing that current downstream techniques improve their performance with appropriately extracted semantics by 11.7% and 8.65% in anomaly detection and failure diagnosis tasks, respectively. We believe these findings provide insights into semantically understanding log messages for the log analysis community.

Log-based Anomaly Detection Without Log Parsing

“…We observe that ChatGPT is able to not only extract the template associated with variables but also semantically identify the categories of variables (see Figure 2). This awareness of variables' semantics could improve the accuracy of downstream tasks such as anomaly detection [30], [40]. Although achieving good initial results, future studies should be conducted to comprehensively evaluate the ability of ChatGPT toward semantic-aware log parsing.…”

“…Thus, to repair the DL program, ChatGPT needs not only to parse the source code syntactically but also to understand the intention of DL programs to repair or optimize the resulting DNNs. Besides the di�erences in paradigms, our study di�ers from prior studies [13,40,48,49] in the selection of program subjects with signi�cantly more dependencies (6 times more libraries) and functionalities (more than the doubled number of lines). See Section 2.1 for more details.…”

Interactive Log Parsing via Light-weight User Feedbacks

“…Recently, a few works brings attention to the semantics of templates [15,16,18]. These methods apply deep learning to enrich the semantics of templates, which require a large amount of training data.…”

“…With the growing scale and complexity of Web applications such as cloud computing and micro-service systems [15,16,18], system event logs (we call them logs for brevity) provide first-hand information for engineers to monitor the health status of the system and troubleshoot [13]. The raw logs are of a vast volume containing much redundant information, making it difficult for engineers to analyze them.…”

Software Failure Log Analysis for Engineers—Review

“…To increase the accuracy, LogPunk [53] selects candidates based on punctuation marks; only then are templates extracted. There is also an effort to build a log parser taking semantic features into consideration [54] so that information about parameters is not omitted but is integrated into templates.…”