一句话:实证揭示日志解析器对参数敏感,并提出基于熵的参数不敏感解析器PILAR。
日志在软件工程任务中日益重要,许多日志分析技术依赖结构化日志,而原始日志通常非结构化,自动日志解析因此用于将其转换为日志模板。现有解析器虽有较好准确率,但需用户大量调参才能达到最优。本文先对六种先进日志解析器开展实证研究,从相同数据集变参数、相同参数换数据集、同数据集不同采样三方面分析配置影响,发现它们均对参数敏感,阻碍实践采用。为缓解该问题,作者提出基于熵的日志解析方法PILAR。在相同三方面与现有解析器比较,PILAR参数不敏感性最佳,且解析准确率和效率在先进解析器中排名第二,为降低日志分析落地门槛提供了路径。
The significance of logs has been widely acknowledged with the adoption of various log analysis techniques that assist in software engineering tasks. Many log analysis techniques require structured logs as input while raw logs are typically unstructured. Automated log parsing is proposed to convert unstructured raw logs into structured log templates. Some log parsers achieve promising accuracy, yet they rely on significant efforts from the users to tune the parameters to achieve optimal results. In this paper, we first conduct an empirical study to understand the influence of the configurable parameters of six state-of-the-art log parsers on their parsing results on three aspects: 1) varying the parameters while using the same dataset, 2) keeping the same parameters while using different datasets, and 3) using different samples from the same dataset. Our results show that all these parsers are sensitive to the parameters, posing challenges to their adoption in practice. To mitigate such challenges, we propose PILAR (Parameter Insensitive Log Parser), an entropy-based log parsing approach. We compare PILAR with the existing log parsers on the same three aspects and find that PILAR is the most parameter-insensitive one. In addition, PILAR achieves the second highest parsing accuracy and efficiency among all the state-of-the-art log parsers. This paper paves the road for easing the adoption of log analysis in software engineer practices.