Too many clients spoil the logs: distributed parsing, aggregation techniques and metrics
Log messages are employed to identify anomalies in IoT systems and have been widely used across many applications. To enable collaboration among infrastructures belonging to different organizations, federated log anomaly detection has been thoroughly investigated for this purpose, often assuming the availability of ground truth log templates. However, this is typically not the case, as it is still necessary to depend on log parsers to extract log templates at inference time, while the design and deployment of such parsers in distributed environments remains largely an open problem. To this end, we report on an empirical investigation of distributed parsing and its key challenges, providing insights and lessons learned towards closing the gap between research and application. To further refine and contextualize the resulting benchmarks, we examine and introduce new metrics that provide a more comprehensive view for evaluating distributed parsers and how they behave in distributed environments. We propose a set of lessons learned and recommendations to support the design, deployment, and evaluation of distributed parsers. In particular, we evaluate the performance of five distinct parsing algorithms in combination with aggregation techniques that allow a unified agreement of event-template mappings across all participating clients, a prerequisite for federated log anomaly detection. In total, 6,720 distinct distributed configurations were tested for this purpose.