LogMaster: Mining Event Correlations in Logs of Large scale Cluster Systems

摘要

This paper presents a methodology and a system, named LogMaster, for miningcorrelations of events that have multiple attributions, i.e., node ID,application ID, event type, and event severity, in logs of large-scale clustersystems. Different from traditional transactional data, e.g., supermarketpurchases, system logs have their unique characteristic, and hence we proposeseveral innovative approaches to mine their correlations. We present a simplemetrics to measure correlations of events that may happen interleavedly. On thebasis of the measurement of correlations, we propose two approaches to mineevent correlations; meanwhile, we propose an innovative abstraction: eventcorrelation graphs (ECGs) to represent event correlations, and present an ECGsbased algorithm for predicting events. For two system logs of a productionHadoop-based cloud computing system at Research Institution of China Mobile anda production HPC cluster system at Los Alamos National Lab (LANL), we evaluateour approaches in three scenarios: (a) predicting all events on the basis ofboth failure and non-failure events; (b) predicting only failure events on thebasis of both failure and non-failure events; (c) predicting failure eventsafter removing non-failure events.