Due to the sheer size of software logs, developers rely on automated log analysis. Log parsing, which parses semi-structured logs into a structured format, is a prerequisite of automated log analysis. However, existing log parsers are unsatisfactory when applied in practice because: 1) they ignore categories of variables, and 2) have poor generalization ability. To address the limitations of existing approaches, we propose LogPTR, the first end-to-end variable-aware log parser that can extract the static and dynamic parts in logs, and further identify the categories of variables. The key of LogPTR is using pointer network to copy words from the log message. We have performed extensive experiments on 16 public log datasets and the results show that LogPTR outperforms state-of-the-art log parsers both on general log parsing that extracts the log template and variable-aware log parsing that further identifies the category of variables.
翻译:由于软件日志规模庞大,开发者依赖自动化日志分析。日志解析作为自动化日志分析的前提,将半结构化日志解析为结构化格式。然而,现有日志解析器在实际应用中存在不足:1)忽略变量类别,2)泛化能力较差。针对现有方法的局限性,我们提出LogPTR——首个端到端可感知变量的日志解析器,能够提取日志中的静态与动态部分,并进一步识别变量类别。LogPTR的核心在于利用指针网络从日志消息中复制词语。我们在16个公开日志数据集上进行了大量实验,结果表明,无论是提取日志模板的通用日志解析,还是进一步识别变量类别的可感知变量的日志解析,LogPTR均优于当前最先进的日志解析器。