MoniLog: An Automated Log-Based Anomaly Detection System for Cloud Computing Infrastructures

Within today's large-scale systems, one anomaly can impact millions of users. Detecting such events in real-time is essential to maintain the quality of services. It allows the monitoring team to prevent or diminish the impact of a failure. Logs are a core part of software development and maintenance, by recording detailed information at runtime. Such log data are universally available in nearly all computer systems. They enable developers as well as system maintainers to monitor and dissect anomalous events. For Cloud computing companies and large online platforms in general, growth is linked to the scaling potential. Automatizing the anomaly detection process is a promising way to ensure the scalability of monitoring capacities regarding the increasing volume of logs generated by modern systems. In this paper, we will introduce MoniLog, a distributed approach to detect real-time anomalies within large-scale environments. It aims to detect sequential and quantitative anomalies within a multi-source log stream. MoniLog is designed to structure a log stream and perform the monitoring of anomalous sequences. Its output classifier learns from the administrator's actions to label and evaluate the criticality level of anomalies.

Automatisation de la structuration des logs pour le Cloud Computing

Logs are a fundamental component of modern computer systems. They enable the analysis and monitoring teams to understand any abnormal or malicious behavior that may have occurred. The continuous increase in the volume of logs generated by these systems made it unsuitable for manual inspection and represents a real challenge with regard to process automation. In order to process these data, several log-structuring solutions have been developed. In this article, we analyze the capabilities of two solutions in order to meet the challenges of Cloud Computing in terms of efficiency and effectiveness. Our work focuses on the impact of parameterization and preprocessing on the performance of these methods -- two important steps as they require human intervention, which is incompatible with with the automation of the log-structuring process.

USTEP: Structuration des logs en flux gr{â}ce {à} un arbre de recherche {é}volutif

Logs record valuable system information at runtime. They are widely used by data-driven approaches for development and monitoring purposes. Parsing log messages to structure their format is a classic preliminary step for log-mining tasks. As they appear upstream, parsing operations can become a processing time bottleneck for downstream applications. The quality of parsing also has a direct influence on their efficiency. Here, we propose USTEP, an online log parsing method based on an evolving tree structure. Evaluation results on a wide panel of datasets coming from different real-world systems demonstrate USTEP superiority in terms of both effectiveness and robustness when compared to other online methods.