WT-Parser:一种有效的在线日志解析方法  

WT-Parser:An effective online log parsing method

作　　者：李修远 朱国胜 孙文和 杨少龙 LI Xiuyuan;ZHU Guosheng;SUN Wenhe;YANG Shaolong(School of Computer and Information Engineering,Hubei University,Wuhan Hubei 430062,China)

机构地区：[1]湖北大学,计算机与信息工程学院,湖北武汉430062

出　　处：《长江信息通信》2023年第5期145-149,共5页Changjiang Information & Communications

摘　　要：系统日志是用于记录系统运行情况的重要数据,通过分析日志可以有效监测系统运行状态、检测系统异常。随着大数据,云计算等技术的兴起,系统日志随着系统规模的扩大也不断增加,如何实现日志自动化分析成为当前研究热点,将非结构化日志文本解析为结构化数据是日志分析的基础。针对大多数日志解析方法难以有效分离日志状态变量的问题,文章提出在线日志解析方法(WT-Parser),方法通过日志单词构成来筛选模板单词用于日志聚类,并采用前缀树的思想提取日志模板。实验使用五个真实的日志数据集对方法进行评估,结果表明,WT-Parser能有效区分日志的状态变量,并且在大多数数据集上都显示了更加优异的性能。The system log is an important data used to record the system running condition.By analyzing the log,it can effectively monitor the systemoperation status and detect systemabnormalities.With the rise of big data,cloud computing and other technologies,the system log is also increasing with the expansion of the system scale.How to achieve automatic log analysis has become a current research hotspot.Parsing unstructured log text into structured data is the basis of log analysis.Aiming at the problem that most log parsing methods are difficult to effectively separate log state variables,this paper proposes an online log parsing method(WT-Parser),which filters template words for log clustering through the composition of log words,and extracts log templates using the idea of prefix tree.The experiment uses five real log data sets to evaluate the method.The results show that WT-Parser can effectively distinguish the log state variables,and shows better performance on most data sets.

关 键 词：智能运维 日志解析 异常检测 在线聚类 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]