Extract anomalies from log files
Project description
Based on success logs, logreduce highlights useful text in failed logs. The goal is to save time in finding a failure’s root cause.
On average, learning run at 2000 lines per second, and testing run at 1300 lines per seconds.
How it works
logreduce uses a model to learn successful logs and detect novelties in failed logs:
Random words are manually removed using regular expression
Then lines are converted to a matrix of token occurrences (using HashingVectorizer),
An unsupervised learner implements neighbor searches (using NearestNeighbors).
Caveats
This method doesn’t work when debug content is only included in failed logs. To successfully detect anomalies, failed and success logs needs to be similar, otherwise the extra informations in failed logs will be considered anomalous.
For example this happens with testr where success logs only contains ‘SUCCESS’.
Install
Fedora:
sudo dnf install -y python3-scikit-learn
git clone https://softwarefactory-project.io/r/logreduce
pushd logreduce
python3 setup.py develop --user
popdPip:
pip install --user logreduceUsage
Logreduce needs a baseline for success log training, and a target for the log to reduce.
Logreduce prints anomalies on the console, the log files are not modified:
"%(distance)f | %(log_path)s:%(line_number)d: %(log_line)s"Local file usage
Compare two files or directories without building a model:
$ logreduce diff testr-nodepool-01/output.good testr-nodepool-01/output.fail
0.232 | testr-nodepool-01/output.fail:0677: File "voluptuous/schema_builder.py", line 370, in validate_mapping
0.462 | testr-nodepool-01/output.fail:0678: raise er.MultipleInvalid(errors)
0.650 | testr-nodepool-01/output.fail:0679: voluptuous.error.MultipleInvalid: required key not provided @ data['providers'][2]['cloud']Compare two files or directories:
$ logreduce dir preprod-logs/ /var/log/Or build a model first and run it separately:
$ logreduce dir-train sosreport.clf old-sosreport/ good-sosreport/
$ logreduce dir-run sosreport.clf new-sosreport/Zuul job usage
Logreduce can query Zuul build database to train a model.
Extract novelty from a job logs:
$ logreduce job http://logs.openstack.org/...
# Reduce comparaison to a single project (e.g. for tox jobs)
$ logreduce job --project openstack/nova http://logs.openstack.org/...
# Compare using many baselines
$ logreduce job --count 10 http://logs.openstack.org/...
# Include job artifacts
$ logreduce job --include-path logs/ http:/logs.openstack.org/...Or build a model first and run it separately:
$ logreduce job-train --job job_name job_name.clf
$ logreduce job-run job_name.clf http://logs.openstack.org/.../Journald usage
Logreduce can look for anomaly in journald, comparing the last day/week/month to the previous one:
Extract novelty from last day journal:
$ logreduce journal --range dayBuild a model using journal of last month and look for novelty in last week:
$ logreduce journal-train --range month good-journal.clf
$ logreduce journal-run --range week good-journal.clflogreduce-tests
This package contains tests data for different type of log such as testr or syslog. Each tests includes a pre-computed list of the anomalies in log failures.
This package also includes a command line utility to run logreduce against all tests data and print a summary of its performance.
Test format
Each tests case is composed of:
A .good file (or directory) that holds the baseline
A .fail file (or directory)
A info.yaml file that describe expected output:
threshold: float # set the distance threshold for the test
anomalies:
- optional: bool # to define minor anomalies not considered false positive
lines: | # the expected lines to be highlighted
Traceback...
RuntimeError...Evaluate
To run the evaluation, first install logreduce-tests:
git clone https://softwarefactory-project.io/r/logreduce-tests
pushd logreduce-tests
python3 setup.py develop --userlogreduce-tests expect tests directories as argument:
$ logreduce-tests tests/testr-zuul-[0-9]*
[testr-zuul-01]: 100.00% accuracy, 5.00% false-positive
[testr-zuul-02]: 80.00% accuracy, 0.00% false-positive
...
Summary: 90.00% accuracy, 2.50% false-positiveAdd –debug to display false positive and missing chunks.
TODOs
Add terminal colors output
Add progress bar
Better differentiate training debug from testing debug
Add a starting log line and report written
Add tarball traversal in utils.files_iterator
Add logstash filter module
Improve tokenization tests
Roadmap
Add daemon worker mode with MQTT event listener
Discard files that are 100% anomalous
Report mean diviation instead of absolute distances
Investigate second stage model
Contribute
Contribution are most welcome, use git-review to propose a change. Setup your ssh keys after sign in https://softwarefactory-project.io/auth/login
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file logreduce-0.1.3.tar.gz.
File metadata
- Download URL: logreduce-0.1.3.tar.gz
- Upload date:
- Size: 35.6 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 74ae79e40d422b21a0a1f9ed1cbfe06b2236a22bfe47e2ccab9f023c4f2d1e32 |
|
| MD5 | 1cc11d18a4baf9f03ee216a005c76098 |
|
| BLAKE2b-256 | d713c5b3f61a5ed3b217b80f135d6e1276ce48bdc9cde18b5393e054f69bc474 |
File details
Details for the file logreduce-0.1.3-py2.py3-none-any.whl.
File metadata
- Download URL: logreduce-0.1.3-py2.py3-none-any.whl
- Upload date:
- Size: 29.5 kB
- Tags: Python 2, Python 3
- Uploaded using Trusted Publishing? No
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 889bff4f3b035a465957b3333c24e780752c82f6bfec478b86c2c4b21ccc6309 |
|
| MD5 | 7553cf7d07b34e4c1bf67c7e39bfe06c |
|
| BLAKE2b-256 | 66cfabfc9d386e3bcc9048584cea1883d805ff0e6033b57ffa9ed37fa2867669 |
