Tools and Benchmarks for Automated Log Parsing

By Jieming Zhu, Shilin He, Jinyang Liu, Pinjia He, Qi Xie, Zibin Zheng, Michael R. Lyu. 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), 2018

528 citations recorded by the source corpus.

Logs are imperative in the development and maintenance process of many software systems. They record detailed runtime information that allows developers and support engineers to monitor their systems and dissect anomalous behaviors and errors. The increasing scale and complexity of modern software systems, however, make the volume of logs explodes. In many cases, the traditional way of manual log inspection becomes impractical. Many recent studies, as well as industrial tools, resort to powerful text search and machine learning-based analytics solutions. Due to the unstructured nature of logs, a first crucial step is to parse log messages into structured data for subsequent analysis. In recent years, automated log parsing has been widely studied in both academia and industry, producing a series of log parsers by different techniques. To better understand the characteristics of these log parsers, in this paper, we present a comprehensive evaluation study on automated log parsing and further release the tools and benchmarks for easy reuse. More specifically, we evaluate 13 log parsers on a total of 16 log datasets spanning distributed systems, supercomputers, operating systems, mobile systems, server applications, and standalone software. We report the benchmarking results in terms of accuracy, robustness, and efficiency, which are of practical importance when deploying automated log parsing in production. We also share the success stories and lessons learned in an industrial application at Huawei. We believe that our work could serve as the basis and provide valuable guidance to future research and deployment of automated log parsing.

Subfields: Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/97224dfaa9517c51e86250cd4443958d37c17220

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

1. Hongyu Zhang
2. Van-Hoang Le
3. Michael R. Lyu
4. Haixuan Guo
5. Shuhan Yuan
6. Xintao Wu
7. Pinjia He
8. Shilin He

In Information Systems

1. Hongyu Zhang
2. Van-Hoang Le
3. Xintao Wu
4. Haixuan Guo
5. Shuhan Yuan
6. Michael R. Lyu
7. Pinjia He
8. Shilin He

Citations in the corpus

• A Survey on Automated Log Analysis for Reliability Engineering (2020, background): “ches. To provide a clear glimpse of these parsers, we focus on three main characteristics: mode, coverage, and preprocessing. We follow the definition of these characteristics introduced by Zhuet al. [166]. Note different from their work, which was an evaluation study providing benchmarks and open-s”
• Log-based Anomaly Detection Without Log Parsing (2021, methodology): “Log parsers could produce inconsistent results depend on the preprocessing step and the set of parameters [16], [15].”
• Robust log-based anomaly detection on unstable log data (2019, methodology): “In fact, it achieves the best performance compared with other related methods evaluated in [48].”
• LogBERT: Log Anomaly Detection via BERT (2021, methodology): “The traditional way of log parsing is based on handcrafted regular expressions [26] to match log keys and parameters in log messages.”
• Benchmarking Small Language Models and Small Reasoning Language Models on System Log Severity Classification (2026, unknown): “The massive volume of system logs produced is impossible to manually traverse, complicating efforts to uncover patterns and nuanced faults that contribute to system failures [26].”