Events & Clusters

Event

An “Event” is a log line or group of lines depending on the type of log. For example, the Java exception log with stack trace exception of multiple lines is considered one event. Similarly, log lines for error from Python code are also considered as one event.

The type of events in log analysis are as follows:

Baseline

The Info/Debug events that are unique for a version release. The baseline events are used as a standard to assess the quality of the next version release.

Unexpected

Errors and warnings appearing only in a Release version and the common Errors/Warnings that occur more often in a Release version as compared to Baseline.

Expected

The Info/Debug events that are common to both Baseline & Release and the Errors/Warnings that occur less often in Release version as compared to Baseline. Ignored

The Info/Debug events of Release version that are not of much importance.

All

All events of Baseline and Release versions.

Cluster

A “Cluster” is a group of log events that share high similarity with each other. A cluster of log events may differ in the variable values or in commonly occurring terms that add no additional information to the log event. Events in logs are processed to form clusters of events.

Outliers

Log events that occur only once and share no similarity with other log events are considered outliers in the log files. The importance of outlier events is determined based on the classification of the event. Process of classification is detailed in the template description section.