Logzip: Extracting Hidden Structures via Iterative Clustering for Log Compression

TL;DR

Logzip is a novel log compression method that extracts hidden structures through iterative clustering, significantly reducing storage space for large-scale system logs with minimal overhead.

Contribution

This paper introduces logzip, a new log compression technique that leverages iterative clustering to improve compression efficiency over traditional methods.

Findings

Logzip reduces log storage size by about 50% on average.

It is highly parallel and incurs negligible overhead.

Effective on diverse large-scale log datasets.

Abstract

System logs record detailed runtime information of software systems and are used as the main data source for many tasks around software engineering. As modern software systems are evolving into large scale and complex structures, logs have become one type of fast-growing big data in industry. In particular, such logs often need to be stored for a long time in practice (e.g., a year), in order to analyze recurrent problems or track security issues. However, archiving logs consumes a large amount of storage space and computing resources, which in turn incurs high operational cost. Data compression is essential to reduce the cost of log storage. Traditional compression tools (e.g., gzip) work well for general texts, but are not tailed for system logs. In this paper, we propose a novel and effective log compression method, namely logzip. Logzip is capable of extracting hidden structures from raw logs via fast iterative clustering and further generating coherent intermediate representations that allow for more effective compression. We evaluate logzip on five large log datasets of different system types, with a total of 63.6 GB in size. The results show that logzip can save about half of the storage space on average over traditional compression tools. Meanwhile, the design of logzip is highly parallel and only incurs negligible overhead. In addition, we share our industrial experience of applying logzip to Huawei's real products.