Error of LogAnomaly implementation.

[LeonYang95]

Hi,

Thank you so much for this amazing project!
I am recently playing with different methods here in this project, however, I do find something odd about the implementation of LogAnomaly. Here in this project, LogAnomaly is actually using log event ids within a window to predict the next event id, just the same as DeepLog, which seems wrong.

According to the paperwork of LogAnomaly, it seems using "semantic vectors" for the prediction (the prediction is an event id or semantic vector, either way is good).

So, as far as I can see, should we change the inputs of LogAnomaly from Sequentials and Quantitives to Semantics and Quantitives ?

Please correct me if I misunderstood something. Thanks again for sharing the project!

Lin, Yang

[asimokby]

Hey @YangLin-George,

Have you got an answer to this?

[LeonYang95]

Hi, @asimokby ,

I'm not sure what is the "answer" you mean. But according to the discussion with authors of LogAnomaly, they did not open-source their implementation due to several concerns. This project is the only one I can find in GitHub which combines DeepLog, LogAnomaly and LogRobust.

As for the inappropriate implementation of LogAnomaly. I was debugging LogAnomaly, and found out that the size of the input tensor of loganomaly model in logdeep/models/lstm.py is (2048, L, 1) where 2048 means batch_size. L is the length of input. That means the input for each sequence in this batch is only a (L, 1) vector.

I'm not sure what the id (1 in the input size) is, but seems like there's one step missing which maps event ids into high-demensional vectors in data/hdfs/evene2semantic_vec.json, like word embedding in NLP tasks.

I'm currently not interested in LogAnomaly after we discussed with the authors. So, if you want more details, you can reach out to them directly.

If you are studying log anomaly detection, There's one paper accepted by ICSE2021 that you may be interested.

If you have any other question, you can email me directly, my email address is linyang[AT]tju.edu.cn.

Best,
Lin Yang

[KiteFlyKid]

Hi@YangLin-George
You're right. An additional step to implement dLCE for template2vec is required.

By the way, why you are not interested in LogAnomaly? I am currently doing research on deep learning-based log anomaly detection and maybe you could leave me an email and we can discuss a little.

And I was wondering if you could please tell me which paper you mentioned in ICSE2021.
Thanks.

[LeonYang95]

Hi @KiteFlyKid ,
Thank you.
My email address is linyang[AT]tju.edu.cn. You can email me as much as you want, I'm happy to discuss with other researchers! :D

[ZhongLIFR]

Hi,

Thank you so much for this amazing project! I am recently playing with different methods here in this project, however, I do find something odd about the implementation of LogAnomaly. Here in this project, LogAnomaly is actually using log event ids within a window to predict the next event id, just the same as DeepLog, which seems wrong.

According to the paperwork of LogAnomaly, it seems using "semantic vectors" for the prediction (the prediction is an event id or semantic vector, either way is good).

So, as far as I can see, should we change the inputs of LogAnomaly from Sequentials and Quantitives to Semantics and Quantitives ?

Please correct me if I misunderstood something. Thanks again for sharing the project!

Lin, Yang

After reading the original LogAnomaly paper, I found that this implementation is somewhat incorrect. In the LogAnomaly paper, they indeed use SemanticVector and CountVector as inputs for their LSTM model. However, they original authors did not describe how to use "attention" to connect these two inputs in their original paper. That is a big pity that they did not open-source their code!

[alexjamesmx]

Hi @LeonYang95 Im trying to email you but the email format doesn't seem to be correct. How can I reach you?

[LeonYang95]

Hi @LeonYang95 Im trying to email you but the email format doesn't seem to be correct. How can I reach you?

Hi @alexjamesmx , you can try [email protected]