A Story About Cohesion and Separation: Label-Free Metric for Log Parser Evaluation

TL;DR

This paper introduces PMSS, a label-free metric for evaluating log parsers that correlates well with traditional label-based metrics, enabling more flexible and industry-relevant parser assessment.

Contribution

The study proposes a novel label-free evaluation metric, PMSS, for log parsers, addressing limitations of existing label-dependent metrics and demonstrating its effectiveness and correlation with traditional measures.

Findings

PMSS correlates strongly with FGA and FTA metrics.

PMSS achieves comparable performance to label-based metrics with only 2.1% difference.

PMSS enables parser evaluation without relying on ground-truth labels.

Abstract

Log parsing converts log messages into structured event templates, allowing for automated log analysis and reducing manual inspection effort. To select the most compatible parser for a specific system, multiple evaluation metrics are commonly used for performance comparisons. However, existing evaluation metrics heavily rely on labeled log data, which limits prior studies to a fixed set of datasets and hinders parser evaluations and selections in the industry. Further, we discovered that different versions of ground-truth used in existing studies can lead to inconsistent performance conclusions. Motivated by these challenges, we propose a novel label-free template-level metric, PMSS (parser medoid silhouette score), to evaluate log parser performance. PMSS evaluates both parser grouping and template quality with medoid silhouette analysis and Levenshtein distance within a near-linear time complexity in general. To understand its relationship with label-based template-level metrics, FGA and FTA, we compared their evaluation outcomes for six log parsers on the standard corrected Loghub 2.0 dataset. Our results indicate that log parsers achieving the highest PMSS or FGA exhibit comparable performance, differing by only 2.1% on average in terms of the FGA score; the difference is 9.8% for FTA. PMSS is also significantly (p<1e-8) and positively correlated to both FGA and FTA: the Spearman's rho correlation coefficient of PMSS-FGA and PMSS-FTA are respectively 0.648 and 0.587, close to the coefficient between FGA and FTA (0.670). We further extended our discussion on how to interpret the conclusions from different metrics, identifying challenges in using PMSS, and provided guidelines on conducting parser selections with our metric. PMSS provides a valuable evaluation alternative when ground-truths are inconsistent or labels are unavailable.