Log Intelligence: Systematically Leveraging Logs Using Development Knowledge

日志是在运行时通过记录开发人员故意添加到源代码中的语句生成的。在大型软件系统的现场调试和支持活动中，执行过程中产生的错误起着至关重要的作用。这样的日志不仅是为了方便开发者和操作者，而且已经成为法律的要求的一部分（例如，2002年《萨班斯-奥克斯利法案》（Sarbanes-Oxley Act）近年来，许多公司（例如，IBM、BlackBerry和Microsoft）已经开始利用日志中的丰富知识来支持其大型软件系统的开发和操作。日志的广泛使用导致日志分析平台的新市场的出现（例如，Splunk、XpoLog和Logstash），支持收集、存储、搜索和分析大量日志数据。*虽然日志在实践中被广泛使用，并且在先前的软件工程研究中已经很好地识别了它们的重要性，但是日志是以特别的方式进行维护和分析的。首先，日志维护（例如，什么时候更新日志）通常取决于开发人员的直觉。日志常常过于冗长或位于错误的位置。更糟糕的是，开发人员经常在不考虑其他涉众需求的情况下更改日志记录语句。第二，当前的日志存储和分析技术仍然是非常临时的，即使使用现有的日志维护和分析平台。文件通常存储为文本文件。对日志的最常见分析是通过不可伸缩的脚本语言和基本正则表达式执行的。第三，日志分析技术很少利用与日志语句相关的丰富的运行时和开发知识。例如，一个典型的日志分析是使用基本关键字（如“error”）搜索日志。这种基本的方法非常容易出错，并且无法真正利用日志的巨大潜力。在维护和分析日志方面拥有丰富经验的研究人员和从业人员（来自Spunk和Google）也强调了这些挑战。*拟议的研究的目的是解决利用日志的做法的上述限制。为了改进日志维护的实践，我计划设计一个系统化和自动化的日志维护指导框架。为了支持系统的日志分析，我计划创建一个日志的通用分析基础设施。将在大型开源和工业系统上进行大规模的实证研究，以了解我们工作的好处和局限性。研究成果将推动软件开发人员和运营商的实践，他们依赖日志来确保为全球数百万用户提供服务的大型软件系统的质量。此外，拟议的研究将暴露，培训和使五个高素质的人员（HQP），以促进国家的最先进的软件工程研究。

Logs are generated at run-time by logging statements that are deliberately added into the source code by developers. Logs generated during the execution play an essential role in field debugging and support activities of large software systems. Such logs are not only for the convenience of developers and operators, but have already become part of legal requirements (e.g., the Sarbanes-Oxley Act of 2002). In recent years, many companies (e.g., IBM, BlackBerry and Microsoft) have started leveraging the rich knowledge in logs to support the development and operation of their large software systems. The broad usage of logs lead to the emergence of a new market for log analysis platforms (e.g., Splunk, XpoLog, and Logstash), which support collecting, storing, searching, and analyzing the large amounts of log data.****Although logs are widely used in practice, and their importance has been well-identified in prior software engineering research, logs are maintained and analyzed in an ad hoc manner. First of all, log maintenance (e.g, ., when to update a log) often depends on the gut feelings of developers. All too often, logs are too verbose or are at the wrong spots. Making it worse, developers often change logging statements without considering the needs of other stakeholders. Second, current storage and analysis techniques for logs remain very ad hoc, even with existing log maintenance and analysis platforms. Logs are typically stored as textual files. Most common analysis on logs is performed by un-scalable scripting languages and basic regular expressions. Third, log analysis techniques rarely make use of the rich run-time and development knowledge associated with the logging statements. For example, a typical log analysis is searching through logs using basic keywords like “error”. Such an basic approach is very error-prone and fails to truly leverage the enormous potential of logs. Such challenges are also highlighted by the researchers and practitioners (from Spunk and Google) who have extensive experiences in maintaining and analyzing logs.****The aim of the proposed research is to address the aforementioned limitations of the practices of leveraging logs. To improve the practice of log maintenance, I plan to design a framework for the systematic and automated guidance of log maintenance. To support the systematic log analysis, I plan to create a general analytical infrastructure for logs. Large-scale empirical studies will be performed on large open source and industrial systems, to understand the benefits and limitations of our work. The research outcomes will advance the practice of software developers and operators who depend on logs to ensure the quality of large software systems that serve millions of users worldwide. Furthermore, the proposed research will expose, train and enable five highly qualified personnel (HQP) to contribute to the state-of-the-art in software engineering research.**