Summarizing Unstructured Logs in Online Services

Abstract

Logs are one of the most valuable data sources for managing large-scale online services. After a failure is detected/diagnosed/predicted, operators still have to inspect the raw logs to gain a summarized view before take actions. However, manual or rule-based log summarization has become inefficient and ineffective. In this work, we propose LogSummary, an automatic, unsupervised end-to-end log summarization framework for online services. LogSummary obtains the summarized triples of important logs for a given log sequence. It integrates a novel information extraction method taking both semantic information and domain knowledge into consideration, with a new triple ranking approach using the global knowledge learned from all logs. Given the lack of a publicly-available gold standard for log summarization, we have manually labelled the summaries of four open-source log datasets and made them publicly available. The evaluation on these datasets as well as the case studies on real-world logs demonstrate that LogSummary produces a highly representative (average ROUGE F1 score of 0.741) summaries. We have packaged LogSummary into an open-source toolkit and hope that it can benefit for future NLP-powered summarization works.

UniLog: Deploy One Model and Specialize it for All Log Analysis Tasks

“…We demonstrate the experimental results for log data summarization. We choose TextRank [41], a classic keyword extraction algorithm, and LogSummary [6] the state-of-the-art method design specifically to summarize log data. Table V reports the experimental results; it shows that the UniLog can significantly improve our log summarization performance: UniLog is improving the F1 score by 0.070 on BGL data, 0.031 on HPC data, and 0.036 on Proxifier over LogSummary.…”

“…In our case, it is necessary to keep the semantics presented in the logs for the output summary to be readable. Meng et al [6] present a log summarization dataset and designed a log summary framework by using the rule-based algorithm to produce a triplet for each log data. We extend their work to the deep learning approach, which is more general and practical for cross-service log data.…”

“…We use the dataset split strategy from the prior works for fair comparison. For anomaly detection, failure prediction, summarization and compression we follows the Loganomaly [3], PreFix [4], LogSummary [6], and LogParse [5], respectively. For the pretrained dataset, We utilize all log datasets mentioned above to pretrain UniLog, except test data which we used for evaluation.…”

An Online Parsing Framework for Semistructured Streaming System Logs of Internet of Things Systems

“…Another study by Meng et al [32] proposed an automated online streaming log model known as LogSummary, which is based on unsupervised algorithmic approaches and can be considered an end-to-end log summarization model that is far superior to that of the current heuristics' approaches. The study claimed that an efficient log parsing model should primarily consider three vital information-1) "entities"; 2) "events"; and 3) their "relationships."…”

“…The study claimed that an efficient log parsing model should primarily consider three vital information-1) "entities"; 2) "events"; and 3) their "relationships." The concept is stemmed from the idea of OpenIE to generate summarized triple-sets of all the vital log messages in a given log sequence [32]. The study avoided the ranking of log summaries that are traditional in OpenIE models and instead used "Log2Vec" to learn log semantics and train the word embedding representations.…”