Technical Publications


Contact Information

A Visual Approach for Monitoring Logs

Girardin L.
Brodbeck D.


Analyzing and monitoring logs that portray system, user, and network activity is essential to meet the requirements of high security and optimal resource availability. While most systems now possess satisfactory logging facilities, the tools to monitor and interpret such event logs are still in their infancy.

This paper describes an approach to relieve system and network administrators from manually scanning sequences of log entries. An experimental system based on unsupervised neural networks and spring layouts to automatically classify events contained in logs is explained, and the use of complementary information visualization techniques to visually present and interactively analyze the results is then discussed.

The system we present can be used to analyze past activity as well as to monitor real-time events. We illustrate the system's use for event logs generated by a firewall, however it can be easily coupled to any source of sequential and structured event logs.

[Gir98] Girardin L. and Brodbeck D.. A Visual Approach for Monitoring Logs. In Proceedings of the 12th System Administration Conference (LISA '98), pages 299-308, Boston, MA, December 1998.

Get publication ( 284K, Adobe Acrobat PDF ).

Questions, comments, suggestions?
This site is generously hosted by Macrofocus GmbH, developer of TreeMap, High-D, and other fine visualization tools
Page rendered on Thursday, February 03, 2000