LogQA: Question Answering in Unstructured Logs

TL;DR

LogQA introduces a novel system for answering natural language questions directly from large-scale unstructured logs, improving efficiency and user experience in log analysis.

Contribution

This work presents the first approach to log question answering, combining log retrieval and reading components, and provides a new labeled dataset for the domain.

Findings

LogQA outperforms six baseline methods in accuracy.

A new public dataset for log question answering is introduced.

The system enhances user-friendliness and efficiency in log analysis.

Abstract

Modern systems produce a large volume of logs to record run-time status and events. System operators use these raw logs to track a system in order to obtain some useful information to diagnose system anomalies. One of the most important problems in this area is to help operators find the answers to log-based questions efficiently and user-friendly. In this work, we propose LogQA, which aims at answering log-based questions in the form of natural language based on large-scale unstructured log corpora. Our system presents the answer to a question directly instead of returning a list of relevant snippets, thus offering better user-friendliness and efficiency. LogQA represents the first approach to solve question answering in lod domain. LogQA has two key components: Log Retriever and Log Reader. Log Retriever aims at retrieving relevant logs w.r.t. a given question, while Log Reader is responsible for inferring the final answer. Given the lack of a public dataset for log questing answering, we manually labelled a QA dataset of three open-source log corpus and will make them publicly available. We evaluated our proposed model on these datasets by comparing its performance with 6 other baseline methods. Our experimental results demonstrate that LogQA has outperformed other baseline methods.