# Log-Based Fault Localization with Unsupervised Log Segmentation
## 2 Materials and Methods
### Log-Based Fault localization  
The normalized log contains lines of interest; however, the lines are composed of constant and variable parts. The variable parts contain information inserted in log lines during execution, and documentation is required to examine their correctness. Therefore, the next step after normalization is to remove variable elements from the lines and create so-called log templates. A well-established method for log template extraction is Drain [25],  
Figure 1: Overview of the proposed context-based approach. Figure 2: Description of objects in log lines. Such descriptions are removed during normalization as they do not provide useful information for error localization. which performs this task with the highest accuracy. For example, in the messages \"Status of connection to IP:192.168.11.1 is SUCCESS\" and \"Status of connection to IP:192.168.11.2 is FAILURE\", the constant part is \"Status of connection to IP:* is \"*\", and the variable parts are ['192.168.11.1', 'SUCCESS'] and ['192.168.11.2', 'FAILURE']. This method relies heavily on the quality of the provided regular expressions, as it must correctly distinguish between the constant and variable parts of the log lines. This distinction is not trivial, and it has been shown that improvements at this stage can lead to improvements in downstream tasks [26]. Let \(L_{n}\) be the set of all log templates in normal logs, and \(L_{f}\) be the set of all log templates in the failed logs. The suspiciousness of a log template \(l\) is defined as follows:  
\[Susp(l)=\frac{\frac{\mathit{Fail}(l)}{\mathit{F_{\mathrm{T}}}}}{\frac{\mathit{ Fail}(l)}{\mathit{F_{\mathrm{T}}}}+\frac{\mathit{Pass}(l)}{\mathit{F_{ \mathrm{T}}}}}\,, \tag{1}\]  
where \(\mathit{F_{\mathrm{T}}}\), \(\mathit{F_{\mathrm{T}}}\) are the number of all failed and passed logs, respectively; \(\mathit{Fail}(l)\) is the number of times log template \(l\) was seen in the failed logs; and \(\mathit{Pass}(l)\) is the number of times log template \(l\) was seen in the passed logs. These definitions differ from those of the original LBFL, where occurrences are normalized. We decided not to normalize occurrences, as we would like to operate in situations where there is only one failed, and normal logs and the frequency of log templates are important sources of information for our context-based approach. Figure 3 presents two histograms of suspicious scores--one for normalized and the other for non-normalized occurrences. Normalized occurrences are much less differentiated, whereas in our approach, frequency information is utilized to make the context more useful. The \(Susp\) metric has several important properties. It is equal to 1 for any log template that is exclusively present in failed log files and 0 for log templates that are exclusively present in the passed log files. Ranking is determined provided based on these values. However, this metric cannot further grade log lines that have a rank of 1. In the case of large systems, this may result in a substantial number of log lines having the same highest rank. Tables 1-3 show the Log-based Fault Localization with suspiciousness score and ranking proposed in [21]. An example of this is a simple OK/NOK case. Tables 1 and 2 contain log examples: the first column contains log line numbers, the second is the content of the log file, and the third is the ID of the extracted log template. The last one is the number of occurrences of each template ID (\"-\" is used when the template ID repeats). Table 3 shows \(\mathit{Fail}(l)\) and \(\mathit{Pass}(l)\) values, and \(\mathit{Susp}\) score and rankings based on occurrences. Then, the suspiciousness score was calculated using Formula (1) and it was used to rank the lines. As we can see in this simple example, four lines are already marked with the highest suspiciousness score (rank equal to 1). To find the root cause, the user has to analyze all lines related to rank 1 templates, sorted by timestamp. Figure 3: Occurences metrics used in (a) standard LBFL and (b) context-based approach.