Analyzing Burstiness and Causality of System logs
Kazuki Otomo

Satoru Kobayashi

Kensuke Fukuda

Hiroshi Esaki

Univ. Tokyo
otomo@hongo.wide.ad.jp

Univ. Tokyo
sat@hongo.wide.ad.jp

NII
kensuke@nii.ac.jp

1

INTRODUCTION

Analyzing network logs is one of the most useful methods for
network operators to understand network problems. With
these logs, we investigate detailed status and events for eachdevices in network system. However, there are two issues toanalyze system logs. First, a large scale network generates
a huge amount and kind of log messages and it makes thelog analysis to be a hard task. Second, the important logs
related to system fault are usually hidden in the majority ofones that report daily routine processes. Because of these
two issues, manual inspection is an unrealistic method andautomatic method is highly required. To overcome these issues, there have been a lot of literature on automated system
log analysis [1],[3],[5]. One of e�cient log analysis methods
is to extract time series relations, especially causal inference.
Causal inference is a statistical technique to identify a causal
relationship between events. A popular causal inference algorithm is called PC algorithm [8], [4] that is based on directed
acyclic graphs (DAG). Chen et al. [2] apply the PC algorithm
to a set of time series (e.g., RTT, TCP window size) for identifying the source of network tra�c delay. Kobayashi et al. [7]apply the PC algorithm to log time series and extract causal
relationships.
In this work, we focus on log burstiness, which is one of
the most popular time series characteristics, and its causality,
for the problem. A simple question arose in this work is how
the burstiness is meaningful and how pairs of burstiness represent a causal relationship. To detect burstiness, we rely on
a Kleinberg’s burst detection method [6] and conduct burstiness analysis to single time series and burst cooccurrence
analysis to pairwise time series. To combine burst detection
and causal inference, we can �nd some meaningful pairs ofbursts for troubleshooting and these cases have relatively
high frequency of burst cooccurrence.

CoNEXT’17, December 2017, Seoul/Incheon, South Korea© 2017 Copyright held by the owner/author(s).
ACM ISBN 123-4567-24-567/08/06. . . $15.00
https://doi.org/10.475/123_4

Univ. Tokyo
hiroshi@wide.ad.jp

2DATASET AND PREPROCESSING

We use a set of network logs collected at SINET [9], which
is a Japanese research and education network. This network
connects over 800 academic organizations in Japan and consists of eight core routers, 50 edge routers, and 100 layer-2
switches. This dataset is same with [7]. In this work, we�rst generate log templates from dataset and classify theminto each templates. We call this group as an event. We use
the pre-processed dataset for removing frequent logs, byapplying Fourier analysis and linear regression analysis aspreprocessing, which is the same preprocessing with [7].

3 BURSTINESS AND CAUSALITY
3.1 Methodology

To detect burstiness of log messages, we employ the burst
detection algorithm by Kleinberg[6]. We convert raw log
messages to time series data and divide the dataset to one-day
long per event per device and detect burstiness in seconds,
for each events.
Next, we intend to extract meaningful burst event pairs
for troubleshooting from results of single burst detection using the cooccurrence of bursts and causality between events.
First, we analyze event cooccurrence related to burstiness using single burst detection results. Then, to analyze causalityof burstiness, we compare cooccurrence of bursts and causalinference results.
Here, we de�ne Co-burst and burst cooccurrence ratio toevaluate relevance between two bursts. Co-burst is a pairof two co-occurred burst in two event time series. Co-burstevent pair is a pair of two events which include at least one coburst. We de�ne the cooccurrence of two bursts if they startin the same 1-min bin. We calculate the cooccurrence ratioof events A and B as Jaccard similarity coe�cient (A, B) =|A\B ||A[B | . The higher (A, B), the more frequent bursts occur atthe same time between event A and B. To calculate (A, B),
we de�ne |A \ B| and |A [ B|. First, A and B are events thatare sets of time series data classi�ed by each log templates.
|A| or |B| means the total number of bursts detected in 456days. |A \ B| is the total number of co-bursts between event
A and B in 456 days. |A [ B| is a disjunction of A and B.

CoNEXT’17, December 2017, Seoul/Incheon, South Korea

K. Otomo et al.

Use these de�nitions, we can calculate and compare burst
cooccurrence ratio.

pair, representing how often these bursts happen. Each pointshows a co-burst event pair. Red dots in Figure 1 illustratesuch causal co-burst events and gray dots illustrate not causal
but co-burst events.
Our results highlight two �ndings. First, we �nd a relationship between causal co-burst events and burst coe�cientratio. In Figure 1, most part of red dots located at an upper part of the graphs and from Table 1; over 89% of causal
co-burst events have over 0.1 coe�cient ratio. Focus on horizontal distribution of causal co-burst (red points), we cansee there are two clusters; a small burst disjunction cluster(A [ B < 500) and large one (A [ B > 500). To investigate
the detail of the large one, it includes a lot of daily process
such as logs related to “show interface"" command. On thecontrary, the small cluster has many meaningful pairs ofburst. Thus, we conclude that causal co-burst event pairs
have relatively high coe�cient ratio. Second, we con�rm
the e�ectiveness to combine causal inference results andburst detection. There are about 22K co-burst event pairs
by applying the burst detection. However, combining thecausal inference, only 1% of them remain. Therefore, 99% of
co-burst event pairs are coincident and we have to focus 1%of them for extracting meaningful bursts. Combining causal
inference results is very e�ective to reduce trivial bursts.
Checking the details of log events, we �nd some usefulcases for network operation. A case is that outage of a L2
switch introduces enabling a bypass event, which meanschange of network routes in order to avoid outage devices
and keep network availability. Figure 2 shows the cumulative
time series of two events. The horizontal line shows time andthe vertical one shows one-day cumulative time-series of anevent. Generally, system down and enabling bypass event are
not always appear at the same time because there are manycauses of the burst of the bypass enabling event. However,to combine burstiness and causality, we can automatically
pinpoint when and what event causally burst with the bypass
enabling event.

3.2

4Figure 1: Jaccard coe�cient and causal co-burst event
pair distribution

Figure 2: Causal co-burst example
Co-burst Causal Co-burst
all
22,756241 (1.06 %)(A, B) 0.1
17,541215 (1.23 %)Table 1: The number of co-burst events and causal
ones

Results

We calculate the burst cooccurrence ratio using single burst
detection result and then compare all the co-burst event
pairs to all the causal event pairs in causality DB obtained in[7] (see also Table 1). The number of all the co-burst event
pairs is 22,756 and 2,776 causal event pairs are recorded in
the causality DB. If the same event pair of co-burst eventsis recorded in causality DB, we consider that the co-burst
is not a coincident but a causal cooccurrence. We call such
event pair as a causal co-burst. With this comparison, we�nd 241 causal co-burst pairs from all 22,756 co-burst pairs.
The distribution of the cooccurrence ratio is shown in Figure
1. The vertical line shows the cooccurrence ratio in log-scale
and the horizontal one the size of the union set of each event

CONCLUSION

We focused on burstiness and causality appeared in network
log messages to extract meaningful information from log data
for troubleshooting. First, we conduct single burst detection.
After that, we analyze pairwise time series burstiness withsingle burst detection results. To combine burst detection
results and causal inference results, and we �nd some usefulcases for troubleshooting from remained burst results.
We are analyzing causality from a non-burst event to aburst event (and vice versa) to highlight the root cause of
the burst (and to predict further events after the burst). We
plan to extend our results in this study to an automated log
analysis system.

Analyzing Burstiness and Causality of System logs

REFERENCES[1] E. Baseman, S. Blanchard, and E. Zongzelimyuntedu. Relational Synthesis of Text and Numeric Data for Anomaly Detection on Computing
System Logs. in Proc. IEEE ICMLA’16, 1:2–5, 2016.
[2] P. Chen, Y. Qi, P. Zheng, and D. Hou. CauseInfer: Automatic anddistributed performance diagnosis with hierarchical causality graph inlarge distributed systems. in Proc. IEEE INFOCOM’14, pages 1887–1895,2014.
[3] E. Chuah, S. H. Kuo, P. Hiew, W. C. Tjhi, G. Lee, J. Hammond, M. T.
Michalewicz, T. Hung, and J. C. Browne. Diagnosing the root-causes offailures from cluster log �les. in Proc. HiPC’10, pages 1–10, 2010.
[4] M. Kalisch and P. Buehlmann. Estimating high-dimensional directed
acyclic graphs with the PC-algorithm. Journal of Machine Learning
Research, 8:613–636, 2005.
[5] T. Kimura, A. Watanabe, T. Toyono, and K. Ishibashi. Proactive Failure
Detection Learning Generation Patterns of Large-scale Network Logs.
pages 8–14, 2015.
[6] J. Kleinberg. Bursty and Hierarchichal structure in streams. Data Mining
and Knowledge Discovery, 7(4):373–397, 2003.
[7] S. Kobayashi. Mining causes of network events in log data with causal
inference. in Proc. IEEE IM’17, pages 45–53, 2017.
[8] P. Spirtes and C. Glymour. An Algorithm for Fast Recovery of Sparse
Causal Graphs. Social Science Computer Review, 9(1):62–72, 1991.
[9] S. Urushidani, M. Aoki, K. Fukuda, S. Abe, M. Nakamura, M. Koibuchi,
Y. Ji, and S. Yamada. Highly available network design and resource
management of SINET4. Telecommunication Systems, 56(1):33–47, 2014.

CoNEXT’17, December 2017, Seoul/Incheon, South Korea