Abstract:
A method is provided that is performed in a network having nodes that generate heterogeneous logs including performance logs and text logs. The method includes performing, during a heterogeneous log training stage, (i) a log-to-time sequence conversion process for transforming clustered ones of training logs, from among the heterogeneous logs, into a set of time sequences that are each formed as a plurality of data pairs of a first configuration and a second configuration based on cluster type, (ii) a time series generation process for synchronizing particular ones of the time sequences in the set based on a set of criteria to output a set of fused time series, and (iii) an invariant model generation process for building invariant models for each time series data pair in the set of fused time series. The method includes controlling an anomaly-initiating one of the plurality of nodes based on the invariant models.

Description:
RELATED APPLICATION INFORMATION 
       [0001]    This application claims priority to provisional application Ser. No. 62/312,035 filed on Mar. 23, 2016, incorporated herein by reference. 
     
    
     BACKGROUND 
       [0002]    Technical Field 
         [0003]    The present invention relates to data processing, and more particularly to invariant modeling and detection for heterogeneous logs. 
         [0004]    Description of the Related Art 
         [0005]    Information Technology (IT) systems include a large number of functional components, and these components have dependencies between each other. In such complex systems, heterogeneous log data is generated from individual components, where dependencies between components remain hidden. While invariant analysis has been widely adopted to discover hidden relations in time series data, it is difficult to apply existing tools over heterogeneous logs that are generated from multiple log sources. The key problem is the set of time series derived by logs from different sources are not synchronized. For example, (1) time periods covered by different time series are not aligned; and (2) different time series employ different sampling frequency. Therefore, there is a need for an approach for invariant modeling and detection for heterogeneous logs. 
       SUMMARY 
       [0006]    These and other drawbacks and disadvantages of the prior art are addressed by the present invention. 
         [0007]    According to an aspect of the present invention, a method is provided that is performed in a network having a plurality of nodes that generate heterogeneous logs including performance logs and text logs. The method includes performing, by a processor during a heterogeneous log training stage, (i) a log-to-time sequence conversion process for transforming clustered ones of training logs, from among the heterogeneous logs, into a set of time sequences that are each formed as a plurality of data pairs of a first configuration and a second configuration based on cluster type, (ii) a time series generation process for synchronizing particular ones of the time sequences in the set based on a set of criteria to output a set of fused time series, and (iii) an invariant model generation process for building invariant models for each time series data pair in the set of fused time series. The method further includes controlling, by the processor, an anomaly-initiating one of the plurality of nodes based on an output of the invariant models. 
         [0008]    According to another aspect of the present invention, a computer program product is provided for invariant model formation for a network having a plurality of nodes that generate heterogeneous logs including performance logs and text logs. The computer program product includes a non-transitory computer readable storage medium having program instructions embodied therewith. The program instructions are executable by a computer to cause the computer to perform a method. The method includes performing, by a processor during a heterogeneous log training stage, (i) a log-to-time sequence conversion process for transforming clustered ones of training logs, from among the heterogeneous logs, into a set of time sequences that are each formed as a plurality of data pairs of a first configuration and a second configuration based on cluster type, (ii) a time series generation process for synchronizing particular ones of the time sequences in the set based on a set of criteria to output a set of fused time series, and (iii) an invariant model generation process for building invariant models for each time series data pair in the set of fused time series. The method further includes controlling, by the processor, an anomaly-initiating one of the plurality of nodes based on an output of the invariant models. 
         [0009]    According to yet another aspect of the present invention, a computer processing system is provided for invariant model formation for a network having a plurality of nodes that generate heterogeneous logs including performance logs and text logs. The computer processing includes a processor. The processor is configured to perform, during a heterogeneous log training stage, (i) a log-to-time sequence conversion process for transforming clustered ones of training logs, from among the heterogeneous logs, into a set of time sequences that are each formed as a plurality of data pairs of a first configuration and a second configuration based on cluster type, (ii) a time series generation process for synchronizing particular ones of the time sequences in the set based on a set of criteria to output a set of fused time series, and (iii) an invariant model generation process for building invariant models for each time series data pair in the set of fused time series. The processor is further configured to control an anomaly-initiating one of the plurality of nodes based on an output of the invariant models. 
         [0010]    These and other features and advantages will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0011]    The disclosure will provide details in the following description of preferred embodiments with reference to the following figures wherein: 
           [0012]      FIG. 1  is a block diagram illustrating an exemplary processing system  100  to which the present principles may be applied, according to an embodiment of the present principles; 
           [0013]      FIGS. 2-3  show exemplary heterogeneous logs  200  to which the present invention can be applied, in accordance with an embodiment of the present invention; 
           [0014]      FIGS. 4-5  show an exemplary detected anomaly  401  from heterogeneous logs  400  to which the present invention can be applied, in accordance with an embodiment of the present invention; 
           [0015]      FIG. 6  shows an exemplary system/method  600  for Invariant Model based Correlation Analysis over Heterogeneous Logs (IMCAHL), in accordance with an embodiment of the present invention; 
           [0016]      FIG. 7  further shows the logs-to-time sequence conversion block  602  of  FIG. 6 , in accordance with an embodiment of the present invention; 
           [0017]      FIG. 8  shows time sequences  800  for the logs in  FIG. 2  that match the log schemas, in accordance with an embodiment of the present invention; 
           [0018]      FIG. 9  further shows the time series generation block  603  of  FIG. 6 , in accordance with an embodiment of the present invention; 
           [0019]      FIG. 10  shows the time series  1000  obtained from the time sequences in  FIG. 8 , in accordance with an embodiment of the present invention; 
           [0020]      FIG. 11  further shows the invariant model generation block  604  of  FIG. 6 , in accordance with an embodiment of the present invention; 
           [0021]      FIG. 12  shows an invariant model  1200  for the pair of log clusters shown in  FIG. 10 , in accordance with an embodiment of the present invention; 
           [0022]      FIG. 13  further shows the logs-to-time sequence conversion block  606  of  FIG. 6 , in accordance with an embodiment of the present invention; 
           [0023]      FIG. 14  further shows the time series generation block  607  of  FIG. 6 , in accordance with an embodiment of the present invention; 
           [0024]      FIG. 15  further shows the time series generation block  608  of  FIG. 6 , in accordance with an embodiment of the present invention; and 
           [0025]      FIG. 16  shows a block diagram of an exemplary environment  1600  to which the present invention can be applied, in accordance with an embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0026]    The present invention is directed to invariant modeling and detection for heterogeneous logs. 
         [0027]    The present invention provides an approach that fuses heterogeneous logs into synchronized time series data so that the following can be performed: invariant analysis; uncover hidden component dependencies; and enable outlier detection. 
         [0028]    To perform invariant analysis over heterogeneous logs in, for example, IT systems and so forth, the present invention addresses the issue that log data is typically encoded in diverse formats with multiple data types. Therefore, the present invention provides a principled approach that integrates heterogeneous logs into a standard data structure for invariant analysis. 
         [0029]    In an embodiment, the present invention provides a principled approach to discover (i) underlying invariants across time series extracted from heterogeneous text logs and system performance time series from multiple log sources, and (ii) detect any system anomalies based on the invariant analysis through machine learning methods. The present invention transforms heterogeneous logs into multi-dimensional time series, and performs fast and robust invariant analysis among the time series. In an embodiment, to address the time series synchronization problem in heterogeneous logs, the present invention first provides a time window generation method that creates a common set of sampling time points shared among all of the time series, and then applies a resampling procedure that fills reasonable values for the sampling time points. The correlation analysis mechanism is based on an invariant model with a fitness score as the parameter, where both modeling and testing are performed by linear algorithms given a pair of time series. 
         [0030]    Referring now in detail to the figures in which like numerals represent the same or similar elements and initially to  FIG. 1 , a block diagram illustrating an exemplary processing system  100  to which the present principles may be applied, according to an embodiment of the present principles, is shown. The processing system  100  includes at least one processor (CPU)  104  operatively coupled to other components via a system bus  102 . A cache  106 , a Read Only Memory (ROM)  108 , a Random Access Memory (RAM)  110 , an input/output (I/O) adapter  120 , a sound adapter  130 , a network adapter  140 , a user interface adapter  150 , and a display adapter  160 , are operatively coupled to the system bus  102 . 
         [0031]    A first storage device  122  and a second storage device  124  are operatively coupled to system bus  102  by the I/O adapter  120 . The storage devices  122  and  124  can be any of a disk storage device (e.g., a magnetic or optical disk storage device), a solid state magnetic device, and so forth. The storage devices  122  and  124  can be the same type of storage device or different types of storage devices. 
         [0032]    A speaker  132  is operatively coupled to system bus  102  by the sound adapter  130 . A transceiver  142  is operatively coupled to system bus  102  by network adapter  140 . A display device  162  is operatively coupled to system bus  102  by display adapter  160 . 
         [0033]    A first user input device  152 , a second user input device  154 , and a third user input device  156  are operatively coupled to system bus  102  by user interface adapter  150 . The user input devices  152 ,  154 , and  156  can be any of a keyboard, a mouse, a keypad, an image capture device, a motion sensing device, a microphone, a device incorporating the functionality of at least two of the preceding devices, and so forth. Of course, other types of input devices can also be used, while maintaining the spirit of the present principles. The user input devices  152 ,  154 , and  156  can be the same type of user input device or different types of user input devices. The user input devices  152 ,  154 , and  156  are used to input and output information to and from system  100 . 
         [0034]    Of course, the processing system  100  may also include other elements (not shown), as readily contemplated by one of skill in the art, as well as omit certain elements. For example, various other input devices and/or output devices can be included in processing system  100 , depending upon the particular implementation of the same, as readily understood by one of ordinary skill in the art. For example, various types of wireless and/or wired input and/or output devices can be used. Moreover, additional processors, controllers, memories, and so forth, in various configurations can also be utilized as readily appreciated by one of ordinary skill in the art. These and other variations of the processing system  100  are readily contemplated by one of ordinary skill in the art given the teachings of the present principles provided herein. 
         [0035]      FIGS. 2-3  show exemplary heterogeneous logs  200  to which the present invention can be applied, in accordance with an embodiment of the present invention. The heterogeneous logs  200  include heterogeneous text logs  210  and heterogeneous performance logs  220  ( FIG. 2 ), as well as respective plots  210 A and  220 A ( FIG. 3 ) of the heterogeneous text logs  210  and heterogeneous performance logs  220 . 
         [0036]      FIGS. 4-5  show an exemplary detected anomaly  401  from heterogeneous logs  400  to which the present invention can be applied, in accordance with an embodiment of the present invention. The heterogeneous logs  400  include heterogeneous text logs  410  and heterogeneous performance logs  420  ( FIG. 4 ), as well as respective plots  410 A and  420 A ( FIG. 5 ) of the heterogeneous text logs  410  and heterogeneous performance logs  420 . 
         [0037]      FIG. 6  shows an exemplary system/method  600  for Invariant Model based Correlation Analysis over Heterogeneous Logs (IMCAHL), in accordance with an embodiment of the present invention. 
         [0038]    The system/method  600  includes a heterogeneous log collection for training block  601  and a heterogeneous log collection for testing block  605 , and a log management applications block  609 . 
         [0039]    Relating to the heterogeneous log collection for training block  601 , the system/method  600  includes a logs-to-time sequence conversion block  602 , a time series generation block  603 , and an invariant model generation block  604 . 
         [0040]    Relating to the heterogeneous log collection for testing block  605 , the system/method  600  includes a logs-to-time sequence conversion block  606 , a time series generation block  607 , and an invariant model checking block  608 . 
         [0041]    The heterogeneous log collection for training block  601  takes heterogeneous logs from arbitrary/unknown systems or applications. The heterogeneous logs can be obtained from one source (single source from single IT server), or can be obtained from multiple sources (multiple log sources from multiple IT servers). A log message includes a time stamp and the text content with one or multiple fields. 
         [0042]    The logs to time sequence conversion block  601  transforms original training text logs into a set of time sequence data. 
         [0043]    The time series generation block  603  synchronizes the set of time sequences output by  602  and outputs time series for the input time sequences. 
         [0044]    The invariant model generation block  604  analyzes the set of time series output by  603 , and builds invariant models for each pair of time series. 
         [0045]    The heterogeneous log collection for testing block  605  takes heterogeneous logs collected from the same system in block  601  for invariant model testing. A log message includes a time stamp and the text content with one or multiple fields. The testing data may come in one batch as a log file, or come in a stream process. 
         [0046]    The logs to time sequence conversion block  606  transforms original testing text logs into a set of time sequence data. 
         [0047]    The time series generation block  607  synchronizes the set of time sequences output by block  606  and output time series for input time sequences. 
         [0048]    The invariant model checking block  608  analyzes the set of time series data output by block  607  based on the corresponding invariant models output by block  604 , and outputs anomalies on any time series data point violating the invariant model and the related log messages. 
         [0049]    The log management application block  609  applies a set of management applications onto the heterogeneous logs from block  601  based on the invariant models output by block  603 , or onto the heterogeneous logs from block  604  based on the invariant model checking output by block  606 . For example, invariant models output by block  603  can be applied to analyze hidden dependency within a target system, and anomalies output by block  606  can be used to detect unexpected system workload or behavior changes. Moreover, based on the detection of an anomaly using an invariant model, an anomaly-initiating one of a plurality of nodes (e.g., a computer in a cluster of computers, and so forth) can be controlled. In an embodiment, the control can involve powering down a root cause computer processing device at the anomaly-initiating one of the plurality of nodes to mitigate an error propagation therefrom. In an embodiment, the control can involve terminating a root cause process executing on a computer processing device at the anomaly-initiating one of the plurality of nodes to mitigate an error propagation therefrom. 
         [0050]      FIG. 7  further shows the logs-to-time sequence conversion block  602  of  FIG. 6 , in accordance with an embodiment of the present invention. 
         [0051]    The logs-to-time sequence conversation block  602  includes a log schema recognition block  602 A and a per-cluster time sequence generation block  602 B. 
         [0052]    Regarding the log scheme recognition block  602 A, a set of log schemas matching the training logs can be provided by users directly, or generated automatically by a pattern recognition procedure on all the heterogeneous logs as follows in block  602 A 1 - 602 A 3 : 
         [0000]    Block  602 A 1 : tokenization, similarity, clustering;
 
Block  602 A 2 : alignment, log schema discovery/recognition; and
 
Block  603 A 3 : classification as log or performance cluster.
 
         [0053]    At block  602 A 1  (tokenization; similarity; clustering), taking arbitrary heterogeneous logs (from step  601  of  FIG. 6 ), a tokenization process is performed so as to generate semantically meaningful tokens from logs. After tokenization, a similarity measurement on heterogeneous logs is applied. This similarity measurement leverages both the log layout information and log content information, and it is specially tailored to arbitrary heterogeneous logs. Once the similarities among logs are obtained, a log clustering algorithm can be applied so as to generate and output log clusters. IMCAHL allows users to plug in their favorite clustering algorithms. 
         [0054]    At block  602 A 2  (alignment; log schema discovery/recognition), once the logs are clustered, the logs are also aligned within each cluster. The log alignment is designed to preserve the unknown layouts of heterogeneous logs so as to help log schema recognition in the following steps. Once the logs are aligned, log schema discovery is conducted so as to find the most representative layouts and log fields. 
         [0055]    The following steps show how we perform log field recognition. First, fields such as time stamps, Internet Protocol (IP) addresses, and universal resource locators (URLs) are recognized based on prior knowledge about their syntax structures. Second, fields which are highly stable in the logs are recognized as general constant fields in log schemas. Third, the rest fields are recognized as general variable fields, including number fields, hybrid string fields, and string fields. 
         [0056]    At block  602 A 3  (classification as log or performance cluster), we classify log clusters as text log clusters and performance log clusters. A cluster is a performance log cluster, if its log schema contains three fields. The first field is a constant field indicating performance metric names, the second field is time stamp field, and the third field is number field. If a cluster is not a performance log cluster, then it is a text log cluster. For example, log messages about CPU usage are usually grouped into a performance log cluster, and one such message could be “CPU_usage, 2015/5/17 01:30:20, 60.72”. 
         [0057]    Regarding the per-cluster time sequence generation block  602 B, within one cluster, logs share a common log schema and are taken as same type of logs. We generate time sequences for each log cluster as follows per block  602 B 1  and  602 B 2 : 
         [0000]      602 B 1 : performance log cluster time sequence generation; and
   602 B 2 : text log cluster time sequence generation.
 
         [0058]    At block  602 B 1 , for a performance log cluster, we generate its time sequence as follows. First, we order log messages in the cluster. Second, we extract values in the time stamp and the number fields, and build a tuple (X, Y) for each log message, where X is the value in its time stamp field and Y is the value in its number field. Assume we have k log messages. After this step, we obtain a time sequence s=&lt;(X 1 , Y 2 ), . . . , (X k , Y k )&gt;, where X 1 &lt;X 2 &lt; . . . &lt;X k . 
         [0059]    At block  602 B 2 , for a text log cluster, we generate its time sequence as follows. First, we order log messages in the cluster. Second, we extract values in the time stamp field, and build a tuple (X, 1) for each log message, where X is the value in its time stamp field and 1 indicates such kind of logs occur once at time X. Assume we have k log messages. After this step, we obtain a time sequence s=&lt;(X 1 , 1), . . . , (X k , 1)&gt;, where X 1 &lt;X 2 &lt; . . . &lt;X k . 
         [0060]      FIG. 8  shows time sequences  800  for the logs in  FIG. 2  that match the log schemas, in accordance with an embodiment of the present invention. That is,  FIG. 8  shows an example of IMCAHL time sequence data for the logs in  FIG. 2 , in accordance with an embodiment of the present invention. 
         [0061]      FIG. 9  further shows the time series generation block  603  of  FIG. 6 , in accordance with an embodiment of the present invention. 
         [0062]    The time series generation block  603  includes a time window generation block  603 A and a resampling block  603 B. 
         [0063]    For each log cluster/schema, we obtain a time sequence s=&lt;(X 1 , Y 1 ), (X 2 , Y 2 ), . . . , (X k , Y k )&gt; output from  602 B (see  FIG. 7 ), the following is time series generation procedure that fuses multiple time sequences into multiple time series that share identical sampling time and frequency. Given a user-define time window size w, we perform time series generation as follows. 
         [0064]    Regarding the time window generation block  603 A, take the time domain as a one-dimensional space, which starts at epoch time 0 (i.e., 1970/1/1 00:00:00) and goes into the infinite future. We partition time domain into time windows with identical size, where the duration of a time window is w. 
         [0065]    Regarding the resampling block  603 B, we denote a time window W as a time range [t s , t e ], where t s  is the starting time point of W and t e  is the end time point of W. Note that time point t s  is not included in W so that time windows are disjoint. Given a time sequence s=&lt;(X 1 , Y 1 ), . . . , (X k , Y k )&gt;, we identify a sequence of time windows &lt;W 1 , W 2 , . . . , W m &gt; that fully covers time stamps {X 1 , X 2 , . . . , X k }. 
         [0066]    The resampling block  603 B can involve: 
         [0000]      603 B 1 : resampling a time sequence output from a performance log cluster; and
   603 B 2 : resampling a time sequence output from a text log cluster of log schema P.
 
         [0067]    At block  603 B 1  (for a time sequence output from a performance log cluster), we transform s=&lt;(X 1 , Y 1 ), . . . , (X k , Y k )&gt; into time series ts=&lt;(X′ 1 , Y′ 1 ), . . . , (X′ m , Y′ m )&gt;. In ts, X′ i  is the end time point of W i , and Y′ i  is obtained by performing linear interpolation at X′ i  based on s. 
         [0068]    At block  603 B 2  (for a time sequence output from a text log cluster of log schema P), we transform s=&lt;(X 1 , Y 1 ), . . . , (X k , Y k )&gt; into time series ts=&lt;(X′ 1 , Y′ 1 ), . . . , X′ m , Y′ m )&gt;. In ts, X′ i  is the end time point of W i , and Y′ i  is the number of log messages that match log schema P within time window W i . 
         [0069]      FIG. 10  shows the time series  1000  obtained from the time sequences in  FIG. 8 , in accordance with an embodiment of the present invention. 
         [0070]      FIG. 11  further shows the invariant model generation block  604  of  FIG. 6 , in accordance with an embodiment of the present invention. 
         [0071]    The invariant model generation block  604  includes a merging time series block  604 A and an invariant modeling block  604 B. 
         [0072]    For the set of time series output from block  603 B of  FIG. 9 , the following is the invariant model generation procedure that produces invariant models for log cluster pairs. 
         [0073]    Regarding merging time series block  604 A, we collect the set of time series output from block  602 , and merge them into a multi-dimensional time series. 
         [0074]    Regarding the invariant modeling block, with the multi-dimensional time series, we utilize existing correlation analysis tools, such as SLAT (System Invariants Analysis Technology) to generate invariant models for log cluster pairs. In particular, in an embodiment, we filter out invariants whose fitness score is no more than 0.7. 
         [0075]      FIG. 12  shows an invariant model  1200  for the pair of log clusters shown in  FIG. 10 : one is the text log cluster with schema P 1 , and the other is the performance log cluster with schema P 2 . 
         [0076]      FIG. 13  further shows the logs-to-time sequence conversion block  606  of  FIG. 6 , in accordance with an embodiment of the present invention. 
         [0077]    The logs-to-time sequence conversion block  606  includes a log schema selection block  606 A and a per-message time sequence generation block  606 B. 
         [0078]    Regarding the log schema selection block  606 A, from the set of log schemas generated from block  601 , only the schemas with invariant models are selected for the rest of the testing procedure. 
         [0079]    Regarding the per-message time sequence generation block  606 B, for each log message i in the testing data, find the log schema P it matches (e.g., through a regular expression testing), and extract its time stamp X i . If P is a text log schema, this block  606 B outputs a tuple (X i , 1) for this message; if P is a performance log schema, this block  606 B outputs a tuple (X i , Y i ) for this message, where Y i  is the value of the number field in this message. 
         [0080]      FIG. 14  further shows the time series generation block  607  of  FIG. 6 , in accordance with an embodiment of the present invention. 
         [0081]    For each log schema, we obtain a time sequence s=&lt;(X 1 , Y 1 ), (X 2 , Y 2 ), . . . , (X k , Y k )&gt; output from block  606 B (see  FIG. 13 ), the following is time series generation procedure that fuses multiple time sequences into multiple time series that share identical sampling time and frequency. Given a user-define time window size w, we perform time series generation as follows per blocks  1407 A and  1407 B. 
         [0082]    The time series generation block  607  includes a time window generation block  607 A and a resampling block  607 B. 
         [0083]    Regarding the time window generation block  607 A, time windows are generated following the same approach in block  603 A (see  FIG. 9 ). 
         [0084]    Regarding the sampling block  607 B, the block is performed following the approach from block  603 B in  FIG. 9  over both time sequences for text log schemas and time sequences for performance schema. For each time sequence, this block  670 B outputs its corresponding time series. 
         [0085]      FIG. 15  further shows the time series generation block  608  of  FIG. 6 , in accordance with an embodiment of the present invention. 
         [0086]    For a pair of log schemas with invariant models, the following is the invariant model testing procedure to decide if it violates correlation patterns learned from training data. An anomaly will be reported if such violation exists. 
         [0087]    The time series generation block  608  includes a merging time series block  608 A and an invariant model testing block  608 B. 
         [0088]    Regarding the merging time series block  608 A, the set of time series output from block  607 B (see  FIG. 14 ) is collected and merged into a multi-dimensional time series. 
         [0089]    Regarding the invariant model testing block  608 B, with the multi-dimensional time series, we utilize existing correlation analysis tools, such as SLAT, to test if invariant models are broken for time series output by  801 . When broken invariants are detected, anomalies are reported. 
         [0090]    The following shows the three periodicity anomalies detected from the logs in  FIG. 4  based on the invariant model learned from the logs in  FIG. 2 : 
         [0000]    Invariant between P 1  and P 2  is broken, detected at time 2014/4/22 10:02:00. 
         [0091]      FIG. 16  shows a block diagram of an exemplary environment  1600  to which the present invention can be applied, in accordance with an embodiment of the present invention. The environment  1600  is representative of an invariant computer network to which the present invention can be applied. The elements shown relative to  FIG. 2  are set forth for the sake of illustration. However, it is to be appreciated that the present invention can be applied to other network configurations as readily contemplated by one of ordinary skill in the art given the teachings of the present invention provided herein, while maintaining the spirit of the present invention. 
         [0092]    The environment  200  at least includes a set of nodes, individually and collectively denoted by the figure reference numeral  210 . Each of the nodes  210  can include one or more servers or other types of computer processing devices, individually and collectively denoted by the figure reference numeral  211 . The computer processing devices  211  can include, for example, but are not limited to, machines (e.g., industrial machines, assembly line machines, robots, etc.) and so forth. For the sake of illustration, each of the nodes  210  is shown with a set of servers  211 . Each of the nodes generates and/or otherwise provides time series data. 
         [0093]    In an embodiment, the present invention performs invariant modeling and detection for heterogeneous logs, as described herein. Based on the ranks, a computer processing system can be controlled in order to mitigate errors stemming from propagation of an anomaly. 
         [0094]    In the embodiment shown in  FIG. 2 , the elements thereof are interconnected by a network(s)  201 . However, in other embodiments, other types of connections can also be used. Additionally, one or more elements in  FIG. 2  may be implemented by a variety of devices, which include but are not limited to, Digital Signal Processing (DSP) circuits, programmable processors, Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), Complex Programmable Logic Devices (CPLDs), and so forth. These and other variations of the elements of environment  200  are readily determined by one of ordinary skill in the art, given the teachings of the present invention provided herein, while maintaining the spirit of the present invention. 
         [0095]    A description will now be given regarding specific competitive/commercial values of the solution achieved by the present invention. 
         [0096]    The present invention significantly reduces the complexity of performing invariant analysis among heterogeneous logs, even when prior knowledge about the system might not be available. By integrating advanced text mining and time series analysis in a novel way, the present invention provides an automated method that converts heterogeneous logs into multiple time series and then fuses these time series into multi-dimensional time series by time window generation and resampling. The resulting multi-dimensional time series enables invariant analysis over heterogeneous logs, and allows efficient anomaly detection based invariant models. 
         [0097]    Embodiments described herein may be entirely hardware, entirely software or including both hardware and software elements. In a preferred embodiment, the present invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc. 
         [0098]    Embodiments may include a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. A computer-usable or computer readable medium may include any apparatus that stores, communicates, propagates, or transports the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be magnetic, optical, electronic, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. The medium may include a computer-readable medium such as a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk, etc. 
         [0099]    It is to be appreciated that the use of any of the following “/”, “and/or”, and “at least one of”, for example, in the cases of “A/B”, “A and/or B” and “at least one of A and B”, is intended to encompass the selection of the first listed option (A) only, or the selection of the second listed option (B) only, or the selection of both options (A and B). As a further example, in the cases of “A, B, and/or C” and “at least one of A, B, and C”, such phrasing is intended to encompass the selection of the first listed option (A) only, or the selection of the second listed option (B) only, or the selection of the third listed option (C) only, or the selection of the first and the second listed options (A and B) only, or the selection of the first and third listed options (A and C) only, or the selection of the second and third listed options (B and C) only, or the selection of all three options (A and B and C). This may be extended, as readily apparent by one of ordinary skill in this and related arts, for as many items listed. 
         [0100]    Having described preferred embodiments of a system and method (which are intended to be illustrative and not limiting), it is noted that modifications and variations can be made by persons skilled in the art in light of the above teachings. It is therefore to be understood that changes may be made in the particular embodiments disclosed which are within the scope and spirit of the invention as outlined by the appended claims. Having thus described aspects of the invention, with the details and particularity required by the patent laws, what is claimed and desired protected by Letters Patent is set forth in the appended claims.