LOGDIG Log File Analyzer for Mining Expected Behavior from Log Files

Log files are often the only way to identify and locate errors in a deployed
system. This paper presents a new log file analyzing framework,
LOGDIG, for checking expected system behavior from log files. LOGDIG is a
generic framework, but it is motivated by logs that include temporal data
(timestamps) and system-specific data (e.g. spatial data with coordinates of
moving objects), which are present e.g. in Real Time Passenger Information
Systems (RTPIS). The behavior mining in LOGDIG is state-machine-based,
where a search algorithm in states tries to find desired events (by certain accuracy) from log files. That is different from related work, in which transitions are directly connected to lines of log files. LOGDIG reads any log files and uses
metadata to interpret input data. The output is static behavioral knowledge and
human friendly composite log for reporting results in legacy tools. Field data
from a commercial RTPIS called ELMI is used as a proof-of-concept case
study. LOGDIG can also be configured to analyze other systems log files by its
flexible metadata formats and a new behavior mining language.