nailo2c/deeplog

PyTorch implements "DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning"

DeepLog

PyTorch implements "DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning"

Play on Colab

https://colab.research.google.com/drive/1xWHovxTkysiPei68bTywqB2oCo6JelAU?usp=sharing

Getting Started

1. Build environment

   git clone https://github.com/nailo2c/deeplog.git
   cd deeplog
   python3 -m venv venv
   . venv/bin/activate
   pip install -r requirements.txt

2. Run local example

   We use open data OpenStack from logpai's loghub

   2.1. Preprocess

   cd example/
   python3 preprocess.py

   2.2. Train

   num-class is count of event_id_map, where event_id_map is generated by preprocess.py. num-candidates is self-define, here we define num-candidates is num-class*0.1

   python3 train.py --num-class 1143 --num-candidates 114 --epochs 35 --window-size 3 --local True

   2.3. Predict

   python3 predict.py --threshold 25

3. Result

   Accuracy	0.9430014
   Precision	0.6497461
   Recall	0.9275362
   F1	0.7641791

4. Deactivate

   deactivate

Folder Structure

• This tree structure is generate by mac terminal tool tree & copy paste it to README.md.

  tree -I "__pycache__|tmp.*" >> tmp.txt

.
├── README.md
├── deeplog
│   ├── __init__.py
│   └── deeplog.py
├── example
│   ├── data
│   │   └── OpenStack
│   │       ├── anomaly_labels.txt
│   │       ├── openstack_abnormal.log
│   │       ├── openstack_normal1.log
│   │       └── openstack_normal2.log
│   ├── predict.py
│   ├── preprocess.py
│   └── train.py
└── requirements.txt

deeplog's Issues

preprocess output and prediction module

Sir, Thank you for this implementation of Deeplog.
i am using this work for further research in this work.
when executing the existing code,
the preprocess output eventid results as 1145
and once training completed, the prediction module results, precision:0, so divide by zero error.

Kindly request to support.

Svaridasan.P

Complete implementation?

Hey, thank you for you this implementation. I wonder if this is complete? Did you implement the three models or just the log key model?

The result can't be reproduced

I runned the code in colab https://colab.research.google.com/drive/1xWHovxTkysiPei68bTywqB2oCo6JelAU?usp=sharing#scrollTo=f8xH9L33cWL0, twice.
The result changed

Mistake in predict.py

deeplog/example/predict.py

Lines 79 to 82 in 0c3cbb4

	elif p == 0 and t == 1:
	FN += 1
	else:
	TN += 1

Shouldn't it be the other way around?

elif p == 0 and t == 1:
	TN +=1
else:
	FN += 1

unique log keys(log templates)

Nice work!
But I still got some questions

1. As mentioned in the original paper, there are only 40 unique log keys while here are 1143
2. The original paper use "instance_id" to group sessions, but I haven't seen this in your log format

Thanks

parameters based prediction

great work,
Paper contains following features:

1. logKey based prediction of next key (= log key path stacked LSTM based prediction)
2. log Parameter based prediction of next parameter (= log parameters LSTM based prediction)
3. Workflow clustering based creation.

In the end your output is sequences how can we convert it back into log statements instead digits of sequences?
Minor Note: You've implemented only LogKeys path finding what about others?

In predict.py, I do not understand why "ground_truth" for 'abnormal_has_anomaly' is all 1. Is there no correct or normal data in abnormal data?

ground_truth = [1]*len(abnormal_has_anomaly) + [0]*len(normal_has_anomaly) predict = abnormal_has_anomaly + normal_has_anomaly