## 5 Results and Discussion
### Impact of Parameters  
Understanding the sensitivity of the proposed CFTL method to parameter changes is necessary for practical deployment. Without this, CFTL will have very limited application and usability. The performance of the CFTL method is primarily affected by two parameters: separation and LCS thresholds. The former primarily affects the number of log templates, whereas the latter primarily affects the matching between new logs and templates.  
**Separation threshold.** The separation threshold is typically set to a certain proportion based on the total number of token types in the log dataset. In this section, seven separation thresholds ranging from 0.65 to 0.95 are used in the experiment, and their impacts on the number of log templates parsed are evaluated. The results are presented in Table 4.  
Table 4 shows that the number of log templates increases as the separation threshold increases, indicating an improvement in log parsing accuracy. In addition, the number of actual log events may significantly affect the result. If the number of actual log events is smaller, a lower separation threshold level is sufficient to obtain better results. For example, when the separation threshold was 0.8 for HDFS, all events were parsed into log templates. However, at the same threshold for Android, only 123 templates were parsed, which was  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & **0.65** & **0.70** & **0.75** & **0.80** & **0.85** & **0.90** & **0.95** & **Actual** \\ \hline Apache & 4 & 6 & 6 & 6 & 6 & 6 & 6 & 6 \\ HDFS & 11 & 12 & 12 & 14 & 14 & 14 & 14 & 14 \\ OpenSSH & 19 & 21 & 25 & 26 & 27 & 27 & 27 & 27 \\ Spark & 22 & 23 & 28 & 31 & 32 & 36 & 36 & 36 \\ HPC & 21 & 27 & 32 & 35 & 40 & 44 & 46 & 46 \\ Windows & 31 & 37 & 42 & 47 & 48 & 49 & 49 & 50 \\ Hadoop & 83 & 96 & 104 & 107 & 109 & 110 & 112 & 114 \\ Thunderbird & 65 & 83 & 97 & 108 & 126 & 137 & 144 & 149 \\ Android & 101 & 109 & 114 & 123 & 139 & 150 & 157 & 166 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Impact of different separation thresholds on number of log templates.  
Figure 8: Memory consumption (MB) of different log parsing methods.  
only approximately 75% of the actual events. In other words, a smaller separation threshold may be suitable for datasets with fewer actual log events, and a larger threshold may lead to overfitting. However, a larger threshold appears better for datasets with more actual log events, and a smaller threshold may lead to underfitting.  
**LCS threshold.** Five different LCS thresholds ranging from 0.80 to 0.99 were selected, and their impacts on accuracy and F1-measure were evaluated. The results are presented in Figure 9.  
Figure 9 shows that the LCS threshold affects accuracy more than F1-measure. In particular, for log data with many actual events such as Hadoop, Thunderbird, and Android, the LCS threshold nearly exerts no effect on F1-measure. However, as the threshold increased, the accuracy first increased and then decreased. This result can be attributed to overfitting with larger LCS thresholds for these datasets. For log data with fewer actual events such as Apache, HDFS, and OpenSSH, a larger LCS threshold resulted in better results in terms of both accuracy and F1-measure. Smaller LCS thresholds may lead to underfitting. For log data with a moderate number of actual events such as Spark, HPC, and Windows, the LCS threshold primarily influences accuracy. In general, a smaller LCS threshold is more suitable for log data with fewer actual events, and vice versa.