Preprocessing is All You Need: Boosting the Performance of Log Parsers With a General Preprocessing Framework

• URL: http://arxiv.org/abs/2412.05254v1
• Date: Fri, 06 Dec 2024 18:39:34 GMT
• Title: Preprocessing is All You Need: Boosting the Performance of Log Parsers With a General Preprocessing Framework
• Abstract summary: Prior work has proposed many statistic-based logs (e.g., Drain) which are highly efficient.<n>We developed a general preprocessing framework with our findings and evaluated its impact on existing parsings.<n>Our experiments show that the preprocessing framework significantly boosts the performance of four state-of-the-art statistic-baseds.
• Score: 2.342181121922312
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Log parsing has been a long-studied area in software engineering due to its importance in identifying dynamic variables and constructing log templates. Prior work has proposed many statistic-based log parsers (e.g., Drain), which are highly efficient; they, unfortunately, met the bottleneck of parsing performance in comparison to semantic-based log parsers, which require labeling and more computational resources. Meanwhile, we noticed that previous studies mainly focused on parsing and often treated preprocessing as an ad hoc step (e.g., masking numbers). However, we argue that both preprocessing and parsing are essential for log parsers to identify dynamic variables: the lack of understanding of preprocessing may hinder the optimal use of parsers and future research. Therefore, our work studied existing log preprocessing approaches based on Loghub, a popular log parsing benchmark. We developed a general preprocessing framework with our findings and evaluated its impact on existing parsers. Our experiments show that the preprocessing framework significantly boosts the performance of four state-of-the-art statistic-based parsers. Drain, the best statistic-based parser, obtained improvements across all four parsing metrics (e.g., F1 score of template accuracy, FTA, increased by 108.9%). Compared to semantic-based parsers, it achieved a 28.3% improvement in grouping accuracy (GA), 38.1% in FGA, and an 18.6% increase in FTA. Our work pioneers log preprocessing and provides a generalizable framework to enhance log parsing.

Related papers

• VarParser: Unleashing the Neglected Power of Variables for LLM-based Log Parsing [10.173320661352257]
  Logs serve as a primary source of information for engineers to diagnose failures in large-scale online service systems.<n>With advances in large language models (LLMs), leveraging their strong text understanding capabilities has proven effective for accurate log parsing.<n>Existing LLM-based logs all focus on the constant part of logs, ignoring the potential contribution of the variable part to log parsing.
  arXiv  Detail & Related papers  (2026-01-30T07:49:54Z)
• Optimized Log Parsing with Syntactic Modifications [2.2917707112773593]
  We compare syntax- and semantic-based log parsing architectures.<n>We propose SynLog+, a template identification module that acts as the second phase in a two-phase log parsing architecture.
  arXiv  Detail & Related papers  (2025-10-30T17:59:22Z)
• Plug it and Play on Logs: A Configuration-Free Statistic-Based Log Parser [2.342181121922312]
  Log parsing is an essential task in log analysis, and many tools have been designed to accomplish it.<n>In comparison to semantic-baseds, existing statistic-baseds tend to be more efficient, require lower computational costs, and be more privacy-preserving thanks to on-premise deployment.<n>It became a common belief that statistic-baseds cannot be as effective as semantic-baseds.<n>Our work challenges this belief with a novel statistic-based, PIPLUP.
  arXiv  Detail & Related papers  (2025-08-12T21:47:27Z)
• Log-Augmented Generation: Scaling Test-Time Reasoning with Reusable Computation [80.69067017594709]
  Large language models (LLMs) and their agentic counterparts struggle to retain reasoning from previous tasks.<n>We propose a novel framework, log-augmented generation (LAG) that directly reuses prior computation and reasoning from past logs at test time.<n>Our method significantly outperforms standard agentic systems that do not utilize logs.
  arXiv  Detail & Related papers  (2025-05-20T14:14:38Z)
• LogParser-LLM: Advancing Efficient Log Parsing with Large Language Models [19.657278472819588]
  We introduce Log-LLM, a novel log integrated with LLM capabilities. We address the intricate challenge of parsing granularity, proposing a new metric to allow users to calibrate granularity to their specific needs. Our method's efficacy is empirically demonstrated through evaluations on the Loghub-2k and the large-scale LogPub benchmark.
  arXiv  Detail & Related papers  (2024-08-25T05:34:24Z)
• HELP: Hierarchical Embeddings-based Log Parsing [0.25112747242081457]
  Logs are a first-hand source of information for software maintenance and failure diagnosis. Log parsing is a prerequisite for automated log analysis tasks such as anomaly detection, troubleshooting, and root cause analysis. Existing online parsing algorithms are susceptible to log drift, where slight log changes create false positives that drown out real anomalies.
  arXiv  Detail & Related papers  (2024-08-15T17:54:31Z)
• LibreLog: Accurate and Efficient Unsupervised Log Parsing Using Open-Source Large Language Models [3.7960472831772774]
  This paper introduces LibreLog, an unsupervised log parsing approach that enhances privacy and reduces operational costs while achieving state-of-the-art parsing accuracy. Our evaluation on LogHub-2.0 shows that LibreLog achieves 25% higher parsing accuracy and processes 2.7 times faster compared to state-of-the-art LLMs.
  arXiv  Detail & Related papers  (2024-08-02T21:54:13Z)
• Token Interdependency Parsing (Tipping) -- Fast and Accurate Log Parsing [0.09208007322096533]
  Most automated analysis tools include a component designed to separate log templates from their parameters, commonly referred to as a "log" "Tipping" combines rule-based tokenizers, interdependency token graphs, strongly connected components, and various techniques to ensure rapid, scalable, and precise log parsing. Tipping can parse 11 million lines of logs in less than 20 seconds on a laptop machine.
  arXiv  Detail & Related papers  (2024-08-01T15:37:22Z)
• Stronger, Cheaper and Demonstration-Free Log Parsing with LLMs [18.240096266464544]
  We propose LogBatcher, a cost-effective LLM-based log that requires no training process or labeled data. We have conducted experiments on 16 public log datasets and the results show that LogBatcher is effective for log parsing.
  arXiv  Detail & Related papers  (2024-06-10T10:39:28Z)
• LogFormer: A Pre-train and Tuning Pipeline for Log Anomaly Detection [73.69399219776315]
  We propose a unified Transformer-based framework for Log anomaly detection (LogFormer) to improve the generalization ability across different domains. Specifically, our model is first pre-trained on the source domain to obtain shared semantic knowledge of log data. Then, we transfer such knowledge to the target domain via shared parameters.
  arXiv  Detail & Related papers  (2024-01-09T12:55:21Z)
• Log Parsing Evaluation in the Era of Modern Software Systems [47.370291246632114]
  We focus on one integral part of automated log analysis, log parsing, which is the prerequisite to deriving any insights from logs. Our investigation reveals problematic aspects within the log parsing field, particularly its inefficiency in handling heterogeneous real-world logs. We propose a tool, Logchimera, that enables estimating log parsing performance in industry contexts.
  arXiv  Detail & Related papers  (2023-08-17T14:19:22Z)
• X2Parser: Cross-Lingual and Cross-Domain Framework for Task-Oriented Compositional Semantic Parsing [51.81533991497547]
  Task-oriented compositional semantic parsing (TCSP) handles complex nested user queries. We present X2 compared a transferable Cross-lingual and Cross-domain for TCSP. We propose to predict flattened intents and slots representations separately and cast both prediction tasks into sequence labeling problems.
  arXiv  Detail & Related papers  (2021-06-07T16:40:05Z)
• Fast semantic parsing with well-typedness guarantees [78.76675218975768]
  AM dependency parsing is a principled method for neural semantic parsing with high accuracy across multiple graphbanks. We describe an A* and a transition-based for AM dependency parsing which guarantee well-typedness and improve parsing speed by up to 3 orders of magnitude.
  arXiv  Detail & Related papers  (2020-09-15T21:54:01Z)
• Towards Instance-Level Parser Selection for Cross-Lingual Transfer of Dependency Parsers [59.345145623931636]
  We argue for a novel cross-lingual transfer paradigm: instance-level selection (ILPS) We present a proof-of-concept study focused on instance-level selection in the framework of delexicalized transfer.
  arXiv  Detail & Related papers  (2020-04-16T13:18:55Z)
• Self-Supervised Log Parsing [59.04636530383049]
  Large-scale software systems generate massive volumes of semi-structured log records. Existing approaches rely on log-specifics or manual rule extraction. We propose NuLog that utilizes a self-supervised learning model and formulates the parsing task as masked language modeling.
  arXiv  Detail & Related papers  (2020-03-17T19:25:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.