HETEROGENEOUS LOG ANALYSIS

• US 20150094959A1
• Filed: 10/01/2014
• Published: 04/02/2015
• Est. Priority Date: 10/02/2013
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Laboratories America Inc (NEC Corporation)
• Inventors: Jiang, Guofei, Chen, Haifeng, Yoshihira, Kenji, Ning, Xia
• Granted Patent: US 10,114,148 B2
• Time in Patent Office: Days
• US Class Current: 702/6
• CPC Class Codes: G01V 20/00 Geomodelling in general

Abstract

A method and system are provided for heterogeneous log analysis. The method includes performing hierarchical log clustering on heterogeneous logs to generate a log cluster hierarchy for the heterogeneous logs. The method further includes performing, by a log pattern recognizer device having a processor, log pattern recognition on the log cluster hierarchy to generate log pattern representations. The method also includes performing log field analysis on the log pattern representations to generate log field statistics. The method additionally includes performing log indexing on the log pattern representations to generate log indexes.

Claims

1. A method for heterogeneous log analysis, comprising:

performing hierarchical log clustering on heterogeneous logs to generate a log cluster hierarchy for the heterogeneous logs;

performing, by a log pattern recognizer device having a processor, log pattern recognition on the log cluster hierarchy to generate log pattern representations;

performing log field analysis on the log pattern representations to generate log field statistics; and

performing log indexing on the log pattern representations to generate log indexes.

2. The method of claim 1, further comprising searching the log cluster hierarchy based on the log indexes and the log field statistics responsive to a log query to generate log query results.

3. The method of claim 2, further comprising performing an analysis on the log query results to provide analytical results on the log query results.

4. The method of claim 1, wherein the step of performing hierarchical log clustering comprises:

performing log tokenization on the heterogeneous logs to generate semantic tokens therefrom; and

applying a log similarity measurement on the heterogeneous logs that leverages log layout information and log content information, at least some of which is derived from the semantic tokens, to generate log similarities amongst the heterogeneous logs.

5. The method of claim 3, wherein the log similarities comprise respective pairwise log similarity measures that respective encode at least some of the log layout information and the log content information for respective pairs of the heterogeneous logs.

6. The method of claim 1, wherein the step of performing log pattern recognition comprises:

performing log alignment on the heterogeneous logs located in each of a plurality of clusters of the log cluster hierarchy;

performing log motif discovery on the aligned heterogeneous logs to identify one or more log motifs responsive to log layouts and log fields;

performing pattern recognition on the aligned heterogeneous logs responsive to the one or more log motifs.

7. The method of claim 6, further comprising back-propagating information determined from the log pattern recognition step into respective levels of the log cluster hierarchy.

8. The method of claim 1, wherein the step of performing log pattern recognition further comprises organizing the log fields in a data structure comprised in the log cluster hierarchy.

9. The method of claim 1, wherein the step of performing log indexing on the log pattern representations generates the log indexes responsive to respective formats and locations of the heterogeneous logs in the log cluster hierarchy.

10. The method of claim 1, wherein the step of performing log indexing on the log pattern representations comprises:

performing pattern field indexing on the log pattern representations to generate pattern field indexing results; and

performing log indexing on the heterogeneous logs responsive to fields in the heterogeneous logs and respective positions of the fields in the log cluster hierarchy to generate log indexing results.

11. The method of claim 10, wherein the step of performing log indexing on the heterogeneous logs comprises generating a searchable indexing structure in the log cluster hierarchy responsive to the pattern field indexing results and the log indexing results.

12. The method of claim 1, wherein the heterogeneous logs comprise a plurality of logs at least some of which having different formats, different purposes, and different content with respect to each other.

13. The method of claim 1, wherein the log indexes are generated responsive to global log data density.

14. A non-transitory article of manufacture tangibly embodying a computer readable program which when executed causes a computer to perform the steps of claim 1.

15. A system for heterogeneous log analysis, comprising:

a hierarchical log clusterer for performing hierarchical log clustering on heterogeneous logs to generate a log cluster hierarchy for the heterogeneous logs;

a log pattern recognizer device having a processor for performing log pattern recognition on the log cluster hierarchy to generate log pattern representations;

a log field analyzer for performing log field analysis on the log pattern representations to generate log field statistics; and

a log indexer for performing log indexing on the log pattern representations to generate log indexes.

16. The system of claim 15, further comprising a heterogeneous log analyzer for searching the log cluster hierarchy based on the log indexes and the log field statistics responsive to a log query to generate log query results.

17. The system of claim 16, wherein the heterogeneous log analyzer performs an analysis on the log query results to provide analytical results on the log query results.

18. The system of claim 15, wherein the hierarchical log clusterer generates the log cluster hierarchy by performing log tokenization on the heterogeneous logs to generate semantic tokens therefrom, and applying a log similarity measurement on the heterogeneous logs that leverages log layout information and log content information, at least some of which is derived from the semantic tokens, to generate log similarities amongst the heterogeneous logs.

19. The system of claim 18, wherein the log similarities comprise respective pairwise log similarity measures that respective encode at least some of the log layout information and the log content information for respective pairs of the heterogeneous logs.

20. The method of claim 15, wherein the log indexes are generated responsive to respective formats and locations of the heterogeneous logs in the log cluster hierarchy.