Distributed log parsers tested across 6,720 federated configurations
Original title: Too many clients spoil the logs: distributed parsing, aggregation techniques and metrics
Five parsers plus aggregation methods were compared so clients can agree on event templates without ground-truth logs.
A paper studies distributed log parsing for federated anomaly detection in IoT systems, where ground-truth templates are usually unavailable at inference time. It tests five parsing algorithms with aggregation techniques that produce a shared event-template mapping across clients. The authors introduce metrics for distributed behavior and report lessons for designing, deploying, and evaluating such parsers. In total, 6,720 distinct distributed configurations were tested.
- Five parsing algorithms were paired with cross-client aggregation techniques.
- The study ran 6,720 distinct distributed configurations.
- New metrics assess parser behavior when clients must agree on templates.
- Recommendations cover design, deployment, and evaluation of distributed parsers.
From the original article
1 min read at arxiv.orgLog messages are employed to identify anomalies in IoT systems and have been widely used across many applications. To enable collaboration among infrastructures belonging to different organizations, federated log anomaly detection has been thoroughly investigated for this purpose, often assuming the availability of ground truth log templates.
By André García Gómez · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.