Proactive Failure Detection Learning Generation Patterns of Large-Scale Network Logs

Tatsuaki KIMURA  Akio WATANABE  Tsuyoshi TOYONO  Keisuke ISHIBASHI  

Publication
IEICE TRANSACTIONS on Communications   Vol.E102-B   No.2   pp.306-316
Publication Date: 2019/02/01
Online ISSN: 1745-1345
DOI: 10.1587/transcom.2018EBP3103
Type of Manuscript: PAPER
Category: Network Management/Operation
Keyword: 
syslog,  network management,  failure detection,  machine learning,  

Full Text: PDF(1.3MB)
>>Buy this Article


Summary: 
Recent carrier-grade networks use many network elements (switches, routers) and servers for various network-based services (e.g., video on demand, online gaming) that demand higher quality and better reliability. Network log data generated from these elements, such as router syslogs, are rich sources for quickly detecting the signs of critical failures to maintain service quality. However, log data contain a large number of text messages written in an unstructured format and contain various types of network events (e.g., operator's login, link down); thus, genuinely important log messages for network operation are difficult to find automatically. We propose a proactive failure-detection system for large-scale networks. It automatically finds abnormal patterns of log messages from a massive amount of data without requiring previous knowledge of data formats used and can detect critical failures before they occur. To handle unstructured log messages, the system has an online log-template-extraction part for automatically extracting the format of a log message. After template extraction, the system associates critical failures with the log data that appeared before them on the basis of supervised machine learning. By associating each log message with a log template, we can characterize the generation patterns of log messages, such as burstiness, not just the keywords in log messages (e.g. ERROR, FAIL). We used real log data collected from a large production network to validate our system and evaluated the system in detecting signs of actual failures of network equipment through a case study.