Log Intelligence: Systematically Leveraging Logs Using Development Knowledge

日志智能：利用开发知识系统地利用日志

• 批准号: RGPIN-2016-06701
• 负责人: Shang, Weiyi
• 金额: $ 2.62万
• 依托单位: Concordia University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2018
• 资助国家: 加拿大
• 起止时间: 2018-01-01 至 2019-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=664859
• 关键词: Log; Intelligence; Systematically; Leveraging; Logs

Logs are generated at run-time by logging statements that are deliberately added into the source code by developers. Logs generated during the execution play an essential role in field debugging and support activities of large software systems. Such logs are not only for the convenience of developers and operators, but have already become part of legal requirements (e.g., the Sarbanes-Oxley Act of 2002). In recent years, many companies (e.g., IBM, BlackBerry and Microsoft) have started leveraging the rich knowledge in logs to support the development and operation of their large software systems. The broad usage of logs lead to the emergence of a new market for log analysis platforms (e.g., Splunk, XpoLog, and Logstash), which support collecting, storing, searching, and analyzing the large amounts of log data.****Although logs are widely used in practice, and their importance has been well-identified in prior software engineering research, logs are maintained and analyzed in an ad hoc manner. First of all, log maintenance (e.g, ., when to update a log) often depends on the gut feelings of developers. All too often, logs are too verbose or are at the wrong spots. Making it worse, developers often change logging statements without considering the needs of other stakeholders. Second, current storage and analysis techniques for logs remain very ad hoc, even with existing log maintenance and analysis platforms. Logs are typically stored as textual files. Most common analysis on logs is performed by un-scalable scripting languages and basic regular expressions. Third, log analysis techniques rarely make use of the rich run-time and development knowledge associated with the logging statements. For example, a typical log analysis is searching through logs using basic keywords like “error”. Such an basic approach is very error-prone and fails to truly leverage the enormous potential of logs. Such challenges are also highlighted by the researchers and practitioners (from Spunk and Google) who have extensive experiences in maintaining and analyzing logs.****The aim of the proposed research is to address the aforementioned limitations of the practices of leveraging logs. To improve the practice of log maintenance, I plan to design a framework for the systematic and automated guidance of log maintenance. To support the systematic log analysis, I plan to create a general analytical infrastructure for logs. Large-scale empirical studies will be performed on large open source and industrial systems, to understand the benefits and limitations of our work. The research outcomes will advance the practice of software developers and operators who depend on logs to ensure the quality of large software systems that serve millions of users worldwide. Furthermore, the proposed research will expose, train and enable five highly qualified personnel (HQP) to contribute to the state-of-the-art in software engineering research.**

日志是在运行时由开发人员故意添加到源代码中的日志语句生成的。在执行过程中生成的日志在大型软件系统的现场调试和支持活动中起着至关重要的作用。这样的日志不仅是为了方便开发商和运营商，而且已经成为法律要求的一部分（例如，2002年的萨班斯-奥克斯利法案）。近年来，许多公司（例如IBM、BlackBerry和Microsoft）已经开始利用日志中的丰富知识来支持其大型软件系统的开发和操作。日志的广泛使用导致了日志分析平台（例如Splunk、XpoLog和Logstash）的新市场的出现，这些平台支持收集、存储、搜索和分析大量的日志数据。****尽管日志在实践中被广泛使用，并且在以前的软件工程研究中已经很好地确定了它们的重要性，但是日志是以一种特殊的方式维护和分析的。首先，日志维护(例如：（何时更新日志）通常取决于开发人员的直觉。通常情况下，日志过于冗长或位于错误的位置。更糟糕的是，开发人员经常在不考虑其他涉众需求的情况下更改日志记录语句。其次，当前的日志存储和分析技术仍然非常特别，即使使用现有的日志维护和分析平台也是如此。日志通常以文本文件的形式存储。大多数常见的日志分析是由不可伸缩的脚本语言和基本正则表达式执行的。第三，日志分析技术很少利用与日志记录语句相关的丰富的运行时和开发知识。例如，典型的日志分析是使用“error”等基本关键字搜索日志。这种基本方法非常容易出错，并且无法真正利用日志的巨大潜力。在维护和分析日志方面具有丰富经验的研究人员和实践者（来自Spunk和谷歌）也强调了这些挑战。****建议研究的目的是解决利用日志的实践的上述限制。为了完善日志维护实践，我计划设计一个日志维护系统化、自动化指导的框架。为了支持系统的日志分析，我计划为日志创建一个通用的分析基础设施。大规模的实证研究将在大型开源和工业系统上进行，以了解我们工作的好处和局限性。研究结果将推动软件开发人员和操作人员的实践，他们依赖日志来确保为全球数百万用户服务的大型软件系统的质量。此外，拟议的研究将暴露、培训和使五名高素质人员（HQP）为软件工程研究的最新技术做出贡献。**