# Log-Based Fault Localization with Unsupervised Log Segmentation
Obtaining code coverage or instrumenting code to obtain traces is not always feasible because code coverage is not collected during field execution, and instrumentation of the code often produces an unacceptable level of overhead and may introduce faults themselves. Logs are a source of information that introduces minimal overhead and intervention in the system. Therefore, logs are the most common source of information after failure. As part of the execution path, logs can be used as a source of fault localization information. Logs are generated by lines in the source code and are placed by programmers to reflect a specific intention. The structure and consistency of logs can vary significantly depending on the discipline within a company [18]. This variation necessitates a high resilience in log-based methods. Logs can be considered in terms of their static and dynamic components, where the static part corresponds to the text placed in the code by the programmer, whereas the dynamic part corresponds to the text generated during the program's execution. Several fault localization methods based on logs have been proposed. Some of these methods use logs in conjunction with other data, such as the content of a build configuration file [19] or key performance indicators (KPIs) [20]. However, it is also possible to use logs alone. Fault localization in such a scenario can be achieved by restricting the number of logs to analyze (Log-Based Fault Localization--LBFL) [21] or by substituting logs with the components behind them and then applying traditional Spectrum-Based Fault Localization (SBFL) to rank the components based on their suspicious scores [22]. The LBFL method successfully reduces the number of logs to a small percentage, it may still result in a large number for complex software systems. Log-Based Fault Localization (LBFL) applies a technique similar to code coverage methods but is tailored specifically for log analysis. This approach adjusts the calculation of failure and pass occurrences by normalizing repetitions within a single file. Afterward, the suspiciousness score is computed using the same methodology as in Spectrum-Based Fault Localization (SBFL). The result is a ranking of log templates, ordered from the most suspicious to the least. However, in large systems, the number of logs with high suspiciousness scores is still overwhelming. To address this, we propose further refining the order of the log lines by incorporating contextual information. This is achieved through the use of an unsupervised log sequence segmentation method, Voting Experts [23]. We have previously demonstrated [24] that this method is effective in segmentation and meets the human golden standard segmentation in open source logs. The method is currently being piloted at Nokia, Wroclaw, Poland. The main contributions of this paper are as follows:  
* Introduction of a new measure to calculate the suspiciousness of a log segment,
* A method combining existing Log-based Fault Localization techniques with a new metric to further refine the localization results,
* Utilization of the output from unsupervised log sequence segmentation for automated log analysis,
* Provision of an anonymized dataset from Nokia covering three real-world faults. Section 2 describes the proposed method and datasets used for its evaluation. This is followed by the research questions and results presented in Section 3 as well as a discussion in Section 4. The last section outlines directions for further research.