## 5 Results and Discussion  
### Log Parsing Performance  
**Numbers of log events. ** A good log parser should obtain the appropriate number of log events after parsing, which is close to the number of real log events in the log file. When a log parser overfits, it generates a larger number of log events because similar slightly different log messages are considered different events. Similarly, when a log parser underfits, it generates fewer log events because it considers that many similar log messages belong to the same event; thus, a log event matches many log messages. The publicly published HDFS dataset contains approximately 11 million log entries and only 29 events. We divided the dataset into sub-datasets of different sizes to evaluate the number of events generated by different log parsers. The results are presented in Figure 5. In particular, the ground truth was labeled manually. The numbers of log events obtained by multiple log parsers were counted. As shown in Figure 5, the number of log events obtained by most log parsers exceeds the corresponding ground truth. The reason for this is that there are too many original logs, and the variables in the logs have too many variations. There may be multiple situations, e.g., the same event log has variables of different lengths (the number of words). Log parsers that only rely on the log length for parsing would be affected, resulting in different log events; thus, the number of log events is increased. Other log parsers treat variables as constants, and each different constant would have its event, thereby generating many different log events. Various situations affect the degree of fit of log parsers; thus, based on the number of log events, the pros and cons of log parsers can be assessed from another perspective. As shown in the figure, the number of events generated by CFTL is closest to the real number. Many factors contributed to this result. First, the clustering strategy of CFTL can accurately cluster log messages into groups; second, to ensure that no additional log events are generated, CFTL performs special processing of variables and uses LCS to extract the corresponding events of each group. In contrast, Spell and IPLoM generate too many log events and, thus, overfit, which implies that they do not impose a constraint on the log message template, which results in unsatisfactory results. Both Drain and MoLFI impose a strong constraint on the number of log message templates. Drain uses a fixed tree depth. MoLFI constantly balances overfitting and underfitting during parsing. **Accuracy and F1-measure. ** Accuracy is the most important issue in log parsing. The accuracy metric indicates whether a log parser correctly matches messages with events. It can also prove the effectiveness of a log parsing method. A high-accuracy log parser not only generates accurate log message templates but also effectively performs subsequent log mining tasks. The accuracy and F1-measure values of different log parsers are listed in Table 2. As shown in Table 2, the proposed CFTL method exhibits the best average accuracy and F1-measure results. In addition, the heuristic rule-based methods, such as Drain, exhibit higher accuracy than the other methods due to their specially designed rules. Among the various datasets, regardless of the log parser used, the HDFS and Apache datasets resulted in higher accuracy rates, reaching 99% in some cases. There are two main reasons for this. First, the log messages generated by the HDFS and Apache systems have a simple format and structure, which simplifies the parsing process. Second, the datasets contain log messages with small sizes, which reduces the difficulty of parsing. Figure 5: Numbers of log events parsed by log parsers for HDFS dataset. In the experiment, Drain used a tree structure with a fixed depth, which was more efficient for log message classification and resulted in a high accuracy rate. IPLoM adopted an iterative strategy; thus, it performed well on most datasets because of its effective heuristic rules.