Root cause analysis of logs generated by execution of a system
A system stores logs representing events that occur in the system based on executable instructions executed by the system, for example, by processes executing within the system or by applications. The system analyzes the logs to determine the root cause of the error or event that resulted in generation of the log. The system clusters logs to determine clusters of logs. The system analyzes logs of each cluster to determine a root cause of errors resulting in logs belonging to the cluster. For any new error log that is received, the system determines the cluster to which the error log belongs and takes action based on the root cause associated with the cluster, for example, sending an alert message or performing automatic remediation.
1. A computer-implemented method for analyzing error logs generated by a system, the method comprising:
clustering error logs generated by the system to generate a plurality of clusters;
selecting a cluster from the plurality of clusters;
determining a cluster characterization score of terms of error logs of the cluster, wherein a cluster characterization score of a term represents a likelihood of the term occurring in the cluster but not in remaining clusters of the plurality of clusters;
selecting a window of consecutive terms of an error log of the cluster, wherein the window maximizes an aggregate value of cluster characterization scores of terms across a plurality of windows obtained from the cluster; and
generating a summary from the window for storing in association with metadata describing the cluster.
2. The computer-implemented method of claim 1 , further comprising:
filtering error logs of the cluster by excluding words having high likelihood of occurrence in the error log but low likelihood of occurrence in the cluster.
3. The computer-implemented method of claim 2 , wherein filtering error logs of the cluster comprises performing principal component analysis of the error logs.
4. The computer-implemented method of claim 1 , wherein selecting the window comprises, sliding a window across the error log, comprising:
identifying a first window of consecutive words of the error log; and
identifying a second window of consecutive words of the error log that overlaps the first window but excludes one or more words of the first window and includes one or more words from outside the first window.
5. The computer-implemented method of claim 1 , wherein clustering error logs comprises:
for each error log, generating a feature vector representing features of the error log; and
clustering feature vectors generated from the error logs to determine the plurality of clusters.
6. The computer-implemented method of claim 5 , wherein the feature vector representing features of the error log is extracted from a hidden layer of a neural network, wherein the neural network receives a representation of the error log as input.
7. The computer-implemented method of claim 1 , further comprising:
receiving a new error log;
determining a cluster of error logs to which the new error log belongs; and
performing an action based on the summary.
8. The computer-implemented method of claim 7 , wherein determining a cluster of error logs to which the new error log belongs comprises identifying the cluster of error logs that is closest to the new error log based on a distance between a feature vector representation of the new error log, and feature vector representations of error logs of clusters of error logs from the plurality of clusters of error logs.
9. The computer-implemented method of claim 7 , further comprising:
determining a class of errors based on the summary; and
sending an alert to a user associated with the class of errors.
10. The computer-implemented method of claim 7 , further comprising:
determining a class of errors based on the summary; and
sending instructions to perform an automatic remediation action associated with the class of errors.
11. A non-transitory computer readable storage medium for storing instructions that when executed by a computer processor cause the computer processor to perform steps for performing predictions, the steps comprising:
clustering error logs generated by a system to generate a plurality of clusters;
selecting a cluster from the plurality of clusters;
determining a cluster characterization score of terms of error logs of the cluster, wherein a cluster characterization score of a term represents a likelihood of the term occurring in the cluster but not in remaining clusters of the plurality of clusters;
selecting a window of consecutive terms of an error log of the cluster, wherein the window maximizes an aggregate value of cluster characterization scores of terms across a plurality of windows obtained from the cluster; and
generating a summary from the window for storing in association with metadata describing the cluster.
12. The non-transitory computer readable storage medium of claim 11 , wherein the instructions further cause the computer processor to perform steps comprising:
filtering error logs of the cluster by excluding words having high likelihood of occurrence in the error log but low likelihood of occurrence in the cluster.
13. The non-transitory computer readable storage medium of claim 11 , wherein selecting the window comprises, sliding a window across the error log, comprising:
identifying a first window of consecutive words of the error log; and
identifying a second window of consecutive words of the error log that overlaps the first window but excludes one or more words of the first window and includes one or more words from outside the first window.
14. The non-transitory computer readable storage medium of claim 11 , wherein clustering error logs comprises:
for each error log, generating a feature vector representing features of the error log; and
clustering feature vectors generated from the error logs to determine the plurality of clusters.
15. The non-transitory computer readable storage medium of claim 14 , wherein the feature vector representing features of the error log is extracted from a hidden layer of a neural network, wherein the neural network receives a representation of the error log as input.
16. The non-transitory computer readable storage medium of claim 11 , wherein the instructions further cause the computer processor to perform steps comprising:
receiving a new error log;
determining a cluster of error logs to which the new error log belongs; and
performing an action based on the summary.
17. The non-transitory computer readable storage medium of claim 16 , wherein determining a cluster of error logs to which the new error log belongs comprises identifying the cluster of error logs that is closest to the new error log based on a distance between a feature vector representation of the new error log, and feature vector representations of error logs of clusters of error logs from the plurality of clusters of error logs.
18. The non-transitory computer readable storage medium of claim 16 , wherein the instructions further cause the computer processor to perform steps comprising:
determining a class of errors based on the summary; and
sending an alert to a user associated with the class of errors.
19. The non-transitory computer readable storage medium of claim 16 , wherein the instructions further cause the computer processor to perform steps comprising:
determining a class of errors based on the summary; and
sending instructions to perform an automatic remediation action associated with the class of errors.
20. A computer system comprising:
a computer processor; and
a non-transitory computer readable storage medium for storing instructions that when executed by a computer processor cause the computer processor to perform steps for performing predictions, the steps comprising:
clustering error logs generated by a system to generate a plurality of clusters;
selecting a cluster from the plurality of clusters;
determining a cluster characterization score of terms of error logs of the cluster, wherein a cluster characterization score of a term represents a likelihood of the term occurring in the cluster but not in remaining clusters of the plurality of clusters;
selecting a window of consecutive terms of an error log of the cluster, wherein the window maximizes an aggregate value of cluster characterization scores of terms across a plurality of windows obtained from the cluster; and
generating a summary from the window for storing in association with metadata describing the cluster.