Mining logs files for data-driven system management

ABSTRACT

With advancement in science and technology, computing systems are becoming increasingly more complex with an increasing variety of heterogeneous software and hardware components. They are thus becoming increasingly more difficult to monitor, manage and maintain. Traditional approaches to system management have been largely based on domain experts through a knowledge acquisition process that translates domain knowledge into operating rules and policies. This has been well known and experienced as a cumber-some, labor intensive, and error prone process. In addition, this process is difficult to keep up with the rapidly changing environments. There is thus a pressing need for automatic and efficient approaches to monitor and manage complex computing systems.A popular approach to system management is based on analyzing system log files. However, some new aspects of the log files have been less emphasized in existing methods from data mining and machine learning community. The various formats and relatively short text messages of log files, and temporal characteristics in data representation pose new challenges. In this paper, we will describe our research efforts on mining system log files for automatic management. In particular, we apply text mining techniques to categorize messages in log files into common situations, improve categorization accuracy by considering the temporal characteristics of log messages, and utilize visualization tools to evaluate and validate the interesting temporal patterns for system management.

REFERENCES

• 1: Rakesh Agrawal , Ramakrishnan Srikant, Mining Sequential Patterns, Proceedings of the Eleventh International Conference on Data Engineering, p.3-14, March 06-10, 1995
• 2: Dana H. Ballard, An introduction to natural computation, Massachusetts Institute of Technology, Cambridge, MA, 1997
• 3: M. Chessell. Specification: Common base event, 2003. http://www-106.ibm.com/developerworks/webservices/library/ws-cbe/.
• 4: Mark Derthick , John Kolojejchick , Steven F. Roth, An interactive visual query environment for exploring data, Proceedings of the 10th annual ACM symposium on User interface software and technology, p.189-198, October 14-17, 1997, Banff, Alberta, Canada [doi>10.1145/263407.263545]
• 5: Dayne Freitag , Andrew McCallum, Information Extraction with HMM Structures Learned by Stochastic Optimization, Proceedings of the Seventeenth National Conference on Artificial Intelligence and Twelfth Conference on Innovative Applications of Artificial Intelligence, p.584-589, July 30-August 03, 2000
• 6: J. Goldstein, S. F. Roth, J. Kolojejchick, and J. Mattis. A framework for knowledge-based, interactive data exploration. Journal of visual languages and computing, 5:339--363, 1994.
• 7: Joseph L. Hellerstein, Sheng Ma, and Chang shing Perng. Discover actionable patterns in event data. IBM System Journal, 41(3):475--493, 2002.
• 8: Anil K. Jain , Richard C. Dubes, Algorithms for clustering data, Prentice-Hall, Inc., Upper Saddle River, NJ, 1988
• 9: Thorsten Joachims, Text Categorization with Suport Vector Machines: Learning with Many Relevant Features, Proceedings of the 10th European Conference on Machine Learning, p.137-142, April 21-23, 1998
• 10: Jeffrey O. Kephart , David M. Chess, The Vision of Autonomic Computing, Computer, v.36 n.1, p.41-50, January 2003 [doi>10.1109/MC.2003.1160055]
• 11: Nicholas Kushmerick, Edward Johnston, and Stephen McGuinness. Information extraction by text classification. Proceedings of the IJCAI-01 Workshop on Adaptive Text Extraction and Mining, 2001.
• 12: T. R. Leek. Information extraction using hidden markov models. Master's thesis, UC San Diego, 1997.
• 13: Cen Li , Gautam Biswas, Temporal Pattern Generation Using Hidden Markov Model Based Unsupervised Classification, Proceedings of the Third International Symposium on Advances in Intelligent Data Analysis, p.245-256, August 01, 1997
• 14: Tao Li , Sheng Ma, Mining Temporal Patterns Without Predefined Time Windows, Proceedings of the Fourth IEEE International Conference on Data Mining (ICDM'04), p.451-454, November 01-04, 2004
• 15: Sheng Ma , Joseph L. Hellerstein, EventBrowser: A Flexible Tool for Scalable Analysis of Event Data, Proceedings of the 10th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management: Active Technologies for Network and Service Management, p.285-296, October 11-13, 1999
• 16: Heikki Mannila, Hannu Toivonen, and A. Inkeri Verkamo. Discovering frequent episodes in sequences. In Proceedings of the First International Conference on Knowledge Discovery and Data Mining (SIGKDD'95), pages 210--215. AAAI Press, 1995.
• 17: A. McCallum and K. Nigam. A comparison of event models for naive bayes text classification. In In AAAI-98 Workshop on Learning for Text Categorization, 1998.
• 18: Andrew McCallum , Ronald Rosenfeld , Tom M. Mitchell , Andrew Y. Ng, Improving Text Classification by Shrinkage in a Hierarchy of Classes, Proceedings of the Fifteenth International Conference on Machine Learning, p.359-367, July 24-27, 1998
• 19: Thomas M. Mitchell, Machine Learning, McGraw-Hill Higher Education, 1997
• 20: Mining Logs Files for Computing System Management, Proceedings of the Second International Conference on Automatic Computing, p.309-310, June 13-16, 2005 [doi>10.1109/ICAC.2005.40]
• 21: Lawrence R. Rabiner, A tutorial on hidden Markov models and selected applications in speech recognition, Readings in speech recognition, Morgan Kaufmann Publishers Inc., San Francisco, CA, 1990
• 22: IBM Market Research. Autonomic computing core technology study, 2003.
• 23: Irina Rish. An empirical study of the naive Bayes classifier. In Proceedings of IJCAI-01 workshop on Empirical Methods in Al, pages 41--46, 2001.
• 24: Fabrizio Sebastiani, Machine learning in automated text categorization, ACM Computing Surveys (CSUR), v.34 n.1, p.1-47, March 2002 [doi>10.1145/505282.505283]
• 25: J. Stearley, Towards informatic analysis of syslogs, Proceedings of the 2004 IEEE International Conference on Cluster Computing, p.309-318, September 20-23, 2004
• 26: Brad Topol, David Ogle, Donna Pierson, Jim Thoenscn, John Sweitzer, Marie Chow, Mary Ann Hoffmann, Pamela Durham, Ric Telford, Sulabha Sheth, and Thomas Studwell. Automating problem determination: A first step toward self-healing computing systems. IBM White Paper, October 2003. http://www-106.ibm.com/developerworks/autonomic/library/acsummary/ac-prob.html.
• 27: Matthew O. Ward, XmdvTool: integrating multiple methods for visualizing multivariate data, Proceedings of the conference on Visualization '94, October 17-21, 1994, Washinton, D.C.
• 28: Andreas S. Weigend , Erik D. Wiener , Jan O. Pedersen, Exploiting Hierarchy in Text Categorization, Information Retrieval, v.1 n.3, p.193-216, October 1999 [doi>10.1023/A:1009983522080]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.4 System Management

Additional Classification:
  G. Mathematics of Computing
  G.3 PROBABILITY AND STATISTICS
      Subjects: Probabilistic algorithms (including Monte Carlo)

  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.8 Database applications
          Subjects: Data mining

  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
      I.2.7 Natural Language Processing
          Subjects: Text analysis
  I.5 PATTERN RECOGNITION
      I.5.2 Design Methodology
          Subjects: Classifier design and evaluation
      I.5.4 Applications
          Subjects: Text processing

  J. Computer Applications
  J.1 ADMINISTRATIVE DATA PROCESSING
      Subjects: Business

General Terms:
Experimentation, Management, Performance

Keywords:
categorization, hidden markov model, naive bayes, system log, temporal information, visualization