# Log-Based Fault Localization with Unsupervised Log Segmentation
## 3 Results  
The purpose of this work was to localize logs related to faults by reducing the number of logs an engineer has to analyze when traditional LBFL methods return many log lines with the highest rank of 1. The data used were labeled by experts to identify the crucial log in each scenario that revealed the real root cause. We collected the number of segments sorted by context ranking and standard timestamp. We consider our method to be better if it ranks the most important log template with a lower rank than the timestamp approach, and if going from the top of the ranking to the obtained segment, the developer has to examine a lower number of log templates. Suspicious log lines are presented to the developer in an original form, not in a log template form, as it is easier to analyze and understand. It is thus preferable to group all instances of the log template together so that after seeing one  
Figure 6: Log snippet from Example 2 with the most important line number 11.  
instance from the group, the developer may skip the rest. To measure the gain, we used a percentage of reduction of data to analyze, calculated as follows:  
\[Red=\left(\frac{X_{1}-X_{2}}{X_{1}}\right)\times 100, \tag{6}\]  
where \(X_{1}\) represents the baseline value and \(X_{2}\) represents the obtained value. During our experiments, we aimed to answer two research questions:  
**RQ1:**: Does ranking by context suspicious score reduce the number of distinct log templates to check? **RQ2:**: Does ranking by context suspicious score reduce the number of log lines to check? **RQ1:**: Does ranking by context suspicious score reduce the number of distinct log templates to check? In Example 1, after the application of the traditional LBFL, there were 73 log templates with a suspicious score of 1, and 105 segments obtained by VotingExperts contained these log templates. The most crucial log template was located in line 445 when lines related to suspicious log templates were sorted by timestamp, which were related to 33 log templates. Our method ranked the most important line in segment 29, which corresponded to 18 templates to analyze (Table 5). The number of log templates to be analyzed was reduced by 45.45% (Figure 7b). In Example 2, the LBFL marked 668 log templates with a suspicious score of 1, and 1871 VE segments in the failed log contained these log templates. The most crucial log template was in line 3576, when lines related to suspicious log templates were sorted by timestamp. Those lines were related to 454 log templates (Table 5). The log snippet with failure from this example is shown in Figure 6. Context-based ranking ranked the most important line in segment 285 with 93 templates to check. The number of log templates to be analyzed was reduced by 79.51% (Figure 7b). In Example 3, LBFL returned 86 log templates with a suspicious score of 1, and 319 segments from VotingExperts contained those log templates. The most crucial log \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Example** & \begin{tabular}{} \end{tabular} & \begin{tabular}{} \end{tabular} & \
\begin{tabular}{} \end{tabular} &
\begin{tabular}{} \end{tabular} \\ \hline Example 1 & 33 & 18 & 45.45 \\ \hline Example 2 & 454 & 93 & 79.51 \\ \hline Example 3 & 22 & 15 & 27.65 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Log template reduction results. Figure 7: Comparison of (**a**) number and (**b**) reduction of log templates to analyze in the context-based compared with the timestamp method. template was present in the 47 th line, for lines related to suspicious log templates sorted by timestamp. It corresponded to 22 log templates. Context-based ranking ranked the most important segment at position 32, with 15 log templates to check (Table 5). The number of log templates to be analyzed was reduced by 27.65% (Figure 7). _RQ2: Does ranking by context suspicious score reduce the number of log lines to check?_  
Example 1, with context-based ranking segments from 1 to 29, contained 35 different log lines for verification.