Learning Latent Events from Network Message Logs

TL;DR

This paper introduces a scalable, unsupervised method to identify error event signatures in large network message logs by transforming the problem into topic discovery using change-point detection and LDA, validated on real data.

Contribution

It presents a novel approach that maps network error analysis to topic discovery, combining change-point detection with LDA for scalable, unsupervised event signature extraction.

Findings

Algorithm is theoretically consistent with low sample complexity.

Scalable to 97 million messages over 15 days.

Effective in identifying error event signatures in real-world data.

Abstract

We consider the problem of separating error messages generated in large distributed data center networks into error events. In such networks, each error event leads to a stream of messages generated by hardware and software components affected by the event. These messages are stored in a giant message log. We consider the unsupervised learning problem of identifying the signatures of events that generated these messages; here, the signature of an error event refers to the mixture of messages generated by the event. One of the main contributions of the paper is a novel mapping of our problem which transforms it into a problem of topic discovery in documents. Events in our problem correspond to topics and messages in our problem correspond to words in the topic discovery problem. However, there is no direct analog of documents. Therefore, we use a non-parametric change-point detection algorithm, which has linear computational complexity in the number of messages, to divide the message log into smaller subsets called episodes, which serve as the equivalents of documents. After this mapping has been done, we use a well-known algorithm for topic discovery, called LDA, to solve our problem. We theoretically analyze the change-point detection algorithm, and show that it is consistent and has low sample complexity. We also demonstrate the scalability of our algorithm on a real data set consisting of $97$ million messages collected over a period of $15$ days, from a distributed data center network which supports the operations of a large wireless service provider.