Grant: Discovery Grants Program - Individual

Logs are generated at run-time by logging statements that are deliberately added into the source code by developers. Logs generated during the execution play an essential role in field debugging and support activities of large software systems. Such logs are not only for the convenience of developers and operators, but have already become part of legal requirements (e.g., the Sarbanes-Oxley Act of 2002). In recent years, many companies (e.g., IBM, BlackBerry and Microsoft) have started leveraging the rich knowledge in logs to support the development and operation of their large software systems. The broad usage of logs lead to the emergence of a new market for log analysis platforms (e.g., Splunk, XpoLog, and Logstash), which support collecting, storing, searching, and analyzing the large amounts of log data.*Although logs are widely used in practice, and their importance has been well-identified in prior software engineering research, logs are maintained and analyzed in an ad hoc manner. First of all, log maintenance (e.g, ., when to update a log) often depends on the gut feelings of developers. All too often, logs are too verbose or are at the wrong spots. Making it worse, developers often change logging statements without considering the needs of other stakeholders. Second, current storage and analysis techniques for logs remain very ad hoc, even with existing log maintenance and analysis platforms. Logs are typically stored as textual files. Most common analysis on logs is performed by un-scalable scripting languages and basic regular expressions. Third, log analysis techniques rarely make use of the rich run-time and development knowledge associated with the logging statements. For example, a typical log analysis is searching through logs using basic keywords like error. Such an basic approach is very error-prone and fails to truly leverage the enormous potential of logs. Such challenges are also highlighted by the researchers and practitioners (from Spunk and Google) who have extensive experiences in maintaining and analyzing logs.*The aim of the proposed research is to address the aforementioned limitations of the practices of leveraging logs. To improve the practice of log maintenance, I plan to design a framework for the systematic and automated guidance of log maintenance. To support the systematic log analysis, I plan to create a general analytical infrastructure for logs. Large-scale empirical studies will be performed on large open source and industrial systems, to understand the benefits and limitations of our work. The research outcomes will advance the practice of software developers and operators who depend on logs to ensure the quality of large software systems that serve millions of users worldwide. Furthermore, the proposed research will expose, train and enable five highly qualified personnel (HQP) to contribute to the state-of-the-art in software engineering research.*