tailieunhanh - SALSA: Analyzing Logs as StAte Machines

It is not our goal, either, to demonstrate complete use cases for SALSA. For example, while we demonstrate one application of SALSA for failure diagnosis, we do not claim that this failure-diagnosis technique is com- plete nor perfect. It is merely illustrative of the types of useful analyses that SALSA can support. Finally, while we can support an online version of SALSA that would analyze log entries generated as the system executes, the goal of this paper is not to describe such an online log-analysis technique or its runtime over- heads. In this paper, we use SALSA in an offline manner, to analyze logs incrementally | SALSA Analyzing Logs as StAte Machines1 Jiaqi Tan Xinghao Pan Soila Kavulya Rajeev Gandhi and Priya Narasimhan Electrical Computer Engineering Department Carnegie Mellon University jiaqit xinghaop spertet rgandhi priyan @ Abstract SALSA examines system logs to derive state-machine views of the sytem s execution along with controlflow data-flow models and related statistics. Exploiting SALSA s derived views and statistics we can effectively construct higher-level useful analyses. We demonstrate SALSA s np p t c iic h by analyzing system logs g r tai cl in a Hadoop cluster and then illustrate SALSA s value by developing visualization and failure-diagnosis techniques for three different Hadoop workloads based on our derived state-machine views and statistics. 1 Introduction Most software systems collect logs of programmergenerated messages for various uses such as troubleshooting tracking user requests . HTTP access logs etc. These logs typically contain unstructured freeform text making them relatively harder to analyze than numerical system-data . CPU usage . However logs often contain semantically richer information than numerical system resource utilization statistics since the log messages often capture the intent of the programmer of the system to record events of interest. SALSA our approach to automated system-log analysis involves examining logs to trace control-flow and data-flow execution in a distributed system and to derive state-machine-like views of the system s execution on each node. Figure 1 depicts the core of SALSA s approach. As log data is only as accurate as the programmer who implemented the logging points in the system we can only infer the state-machines that execute within the target system. We cannot from the logs and do not attempt to verify whether our derived state-machines faithfully capture the actual ones executing within the system. Instead we leverage these derived state-machines to support different kinds of .