Log analysis via space-time pattern matching

Abstract

This paper proposes a new methodology inspired from pattern matching and able to find alarm correlations with or without prior knowledge about the monitored system. The data structure can store every observed pattern of correlated alarms by processing logs online. It can be queried to extract the patterns of alarms leading to an arbitrary failure. First, we propose a framework able to represent alarm logs according to spatio-temporal dependencies. Second, we design a new scalable data structure, able to store every observed pattern of alarms, and validate it by simulation. Third, we show how to exploit this data structure for fault diagnosis.