Length Matters: Clustering System Log Messages using Length of Words

2016/11/10 by Keiichi Shima, Shima, Keiichi · 9 citations
Computer Science · #C.2.0 #FOS: Computer and information sciences #H.3.3 #Network Security and Intrusion Detection #Other Computer Science (cs.OH) #Software Reliability and Analysis Research #Software System Performance and Reliability #cs.OH

paper · pdf · doi:10.48550/arxiv.1611.03213

arxiv created 2016/11/10 · openalex publication_date 2016/11/10 · arxiv updated 2016/11/11 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

The analysis techniques of system log messages (syslog messages) have a long history from when the syslog mechanism was invented. Typically, the analysis consists of two parts, one is a message template generation, and the other is finding something interesting using the messages classified by the inferred templates. It is important to generate better templates to achieve better, precise, or convincible analysis results. In this paper, we propose a classification methodology using the length of words of each message. Our method is suitable for online template generation because it does not require two-pass analysis to generate template messages, that is an important factor considering increasing amount of log messages produced by a large number of system components such as cloud infrastructure.

Cited by

• A Story About Cohesion and Separation: Label-Free Metric for Log Parser Evaluation
• Optimized Log Parsing with Syntactic Modifications
• SchemaCoder: Automatic Log Schema Extraction Coder with Residual Q-Tree Boosting
• Plug it and Play on Logs: A Configuration-Free Statistic-Based Log Parser
• InferLog: Accelerating LLM Inference for Online Log Parsing via ICL-oriented Prefix Caching
• Semantic-Aware Parsing for Security Logs
• A Word is Worth 4-bit: Efficient Log Parsing with Binary Coded Decimal Recognition
• Self-Supervised Log Parsing
• A Survey on Automated Log Analysis for Reliability Engineering
• System Log Parsing with Large Language Models: A Review

Related

• LogLSHD: Fast Log Parsing with Locality-Sensitive Hashing and Dynamic Time Warping
• Analyzing Logs of Large-Scale Software Systems using Time Curves Visualization
• Logram: Efficient Log Parsing Using n-Gram Dictionaries
• SemParser: A Semantic Parser for Log Analysis
• ClusterLog: Clustering Logs for Effective Log-based Anomaly Detection