Abstract
In the evolving IT landscape, stability and reliability of systems are essential, yet their growing complexity challenges DevOps teams in implementation and maintenance. Log analysis, a core element of AIOps, provides critical insights into complex behaviors and failures. This dissertation introduces a three-layered architecture to support DevOps in failure resolution. The first layer, Log Investigation, performs autonomous log labeling and anomaly classification. We propose a method that labels log data without manual effort, enabling supervised training and precise evaluation of anomaly detection. Additionally, we define a taxonomy that groups anomalies into three categories, ensuring appropriate method selection. The second layer, Anomaly Detection, detects behaviors deviating from the norm. We propose a flexible Anomaly Detection method adaptable to unsupervised, weakly supervised, and supervised training. Evaluations on public and industry datasets show F1-scores between 0.98 and 1.0, ensuring reliable anomaly detection. The third layer, Root Cause Analysis, identifies minimal log sets describing failures, their origin, and event sequences. By balancing training data and identifying key services, our Root Cause Analysis method consistently detects 90-98% of root cause log lines within the top 10 candidates, providing actionable insights for mitigation. Our research addresses how log analysis methods can be designed and optimized to help DevOps resolve failures efficiently. By integrating these three layers, the architecture equips teams with robust methods to enhance IT system reliability.
Abstract (translated)
在不断演变的信息技术环境中，系统的稳定性和可靠性至关重要，但日益增加的复杂性给DevOps团队的实施和维护带来了挑战。日志分析作为AIOps的核心要素之一，为理解复杂的系统行为和故障提供了关键见解。本文献提出了一种三层架构以支持DevOps解决故障问题。 第一层是日志调查（Log Investigation），它执行自主的日志标记和异常分类。我们提出了一个不需要人工努力进行标签的方法，从而能够进行监督训练并精确评估异常检测。此外，我们定义了一个将异常划分为三类的分类法，确保方法选择的适当性。 第二层是异常检测（Anomaly Detection），用于识别偏离常态的行为。我们提出了一种灵活的异常检测方法，可以适应无监督、弱监督和有监督训练方式。通过对公开数据集和行业数据集进行评估，F1分数在0.98到1.0之间，确保了可靠的异常检测。 第三层是根本原因分析（Root Cause Analysis），用于识别描述故障起因及其事件序列的最小日志集合。通过平衡训练数据并确定关键服务，我们的根原因分析方法能够在前十个候选日志行中始终发现90-98%的根本原因相关日志行，提供可操作的缓解建议。 本研究探讨了如何设计和优化日志分析方法以帮助DevOps团队高效地解决故障。通过整合这三层架构，该框架为团队提供了增强IT系统可靠性的强大工具。
URL
https://arxiv.org/abs/2509.08698
