一句话:提出 LogPPT,用提示调优和自适应采样实现少样本日志解析,提升模板与参数识别效果。
大规模软件系统日志对状态理解与故障诊断至关重要,日志解析旨在将原始日志转为结构化数据,是自动化日志分析的第一步。现有解析器多依赖统计特征抽取模板,常忽略日志语义且需针对不同数据集定制领域知识,导致模板与参数识别不准。为此,论文提出 LogPPT,利用基于提示的少样本学习捕获模板模式:通过新颖的提示调优方法,在少量标注日志上识别关键词与参数,并设计自适应随机采样算法选取小而多样的训练集。在 16 个公开日志数据集上的大量实验表明,LogPPT 在日志解析上兼具有效性与高效性。
Logs generated by large-scale software systems provide crucial information for engineers to understand the system status and diagnose problems of the systems. Log parsing, which converts raw log messages into structured data, is the first step to enabling automated log analytics. Existing log parsers extract the common part as log templates using statistical features. However, these log parsers often fail to identify the correct templates and parameters because: 1) they often overlook the semantic meaning of log messages, and 2) they require domain-specific knowledge for different log datasets. To address the limitations of existing methods, in this paper, we propose LogPPT to capture the patterns of templates using prompt-based few-shot learning. LogPPT utilises a novel prompt tuning method to recognise keywords and parameters based on a few labelled log data. In addition, an adaptive random sampling algorithm is designed to select a small yet diverse training set. We have conducted extensive experiments on 16 public log datasets. The experimental results show that LogPPT is effective and efficient for log parsing.