Log Intelligence: Systematically Leveraging Logs Using Development Knowledge

日志是在运行时通过记录开发人员故意添加到源代码中的语句来生成的。在执行过程中生成的日志在大型软件系统的现场调试和支持活动中发挥着重要作用。这样的日志不仅是为了方便开发商和运营商，而且已经成为法律要求的一部分(例如，2002年的萨班斯-奥克斯利法案)。近年来，许多公司(例如IBM、BlackBerry和Microsoft)已经开始利用日志中丰富的知识来支持其大型软件系统的开发和运营。日志的广泛使用导致了新的日志分析平台(如Splunk、XpoLog和Logstash)的出现，这些平台支持收集、存储、搜索和分析海量日志数据。 尽管日志在实践中被广泛使用，并且在以前的软件工程研究中已经很好地认识到它们的重要性，但是日志是以特别的方式进行维护和分析的。首先，日志维护(例如，何时更新日志)通常取决于开发人员的直觉。通常情况下，日志过于冗长或位于错误的位置。更糟糕的是，开发人员经常更改日志记录语句，而不考虑其他利益相关者的需求。其次，即使使用现有的日志维护和分析平台，当前的日志存储和分析技术仍然非常特殊。日志通常存储为文本文件。最常见的日志分析是通过不可伸缩的脚本语言和基本正则表达式执行的。第三，日志分析技术很少利用与日志语句相关的丰富的运行时和开发知识。例如，典型的日志分析是使用诸如“error”之类的基本关键字搜索日志。这种基本方法非常容易出错，并且无法真正利用日志的巨大潜力。在维护和分析日志方面拥有丰富经验的研究人员和从业者(来自Spenk和Google)也强调了这些挑战。 拟议研究的目的是解决上述利用日志的做法的局限性。为了改进日志维护的实践，我计划设计一个日志维护的系统化和自动化指导的框架。为了支持系统的日志分析，我计划为日志创建一个通用的分析基础设施。将对大型开源和工业系统进行大规模的实证研究，以了解我们工作的好处和局限性。研究成果将推动软件开发人员和运营商的实践，他们依赖日志来确保服务于全球数百万用户的大型软件系统的质量。此外，拟议的研究将暴露、培训和使五名高素质人员(HQP)能够为软件工程研究的最新水平做出贡献。

Logs are generated at run-time by logging statements that are deliberately added into the source code by developers. Logs generated during the execution play an essential role in field debugging and support activities of large software systems. Such logs are not only for the convenience of developers and operators, but have already become part of legal requirements (e.g., the Sarbanes-Oxley Act of 2002). In recent years, many companies (e.g., IBM, BlackBerry and Microsoft) have started leveraging the rich knowledge in logs to support the development and operation of their large software systems. The broad usage of logs lead to the emergence of a new market for log analysis platforms (e.g., Splunk, XpoLog, and Logstash), which support collecting, storing, searching, and analyzing the large amounts of log data. Although logs are widely used in practice, and their importance has been well-identified in prior software engineering research, logs are maintained and analyzed in an ad hoc manner. First of all, log maintenance (e.g, ., when to update a log) often depends on the gut feelings of developers. All too often, logs are too verbose or are at the wrong spots. Making it worse, developers often change logging statements without considering the needs of other stakeholders. Second, current storage and analysis techniques for logs remain very ad hoc, even with existing log maintenance and analysis platforms. Logs are typically stored as textual files. Most common analysis on logs is performed by un-scalable scripting languages and basic regular expressions. Third, log analysis techniques rarely make use of the rich run-time and development knowledge associated with the logging statements. For example, a typical log analysis is searching through logs using basic keywords like “error”. Such an basic approach is very error-prone and fails to truly leverage the enormous potential of logs. Such challenges are also highlighted by the researchers and practitioners (from Spunk and Google) who have extensive experiences in maintaining and analyzing logs. The aim of the proposed research is to address the aforementioned limitations of the practices of leveraging logs. To improve the practice of log maintenance, I plan to design a framework for the systematic and automated guidance of log maintenance. To support the systematic log analysis, I plan to create a general analytical infrastructure for logs. Large-scale empirical studies will be performed on large open source and industrial systems, to understand the benefits and limitations of our work. The research outcomes will advance the practice of software developers and operators who depend on logs to ensure the quality of large software systems that serve millions of users worldwide. Furthermore, the proposed research will expose, train and enable five highly qualified personnel (HQP) to contribute to the state-of-the-art in software engineering research.