A Visual Approach for Monitoring Logs
Luc Girardin and Dominique Brodbeck - UBS, Ubilab
Analyzing and monitoring logs that portray system, user, and
network activity is essential to meet the requirements of high
security and optimal resource availability. While most systems now
possess satisfactory logging facilities, the tools to monitor and
interpret such event logs are still in their infancy.
describes an approach to relieve system and network administrators
from manually scanning sequences of log entries. An experimental
system based on unsupervised neural networks and spring layouts to
automatically classify events contained in logs is explained, and the
use of complementary information visualization techniques to visually
present and interactively analyze the results is then discussed.
The system we present can be used to analyze past activity as well as
to monitor real-time events. We illustrate the system's use for event
logs generated by a firewall, however it can be easily coupled to any
source of sequential and structured event logs.
- View the full text of this paper in
HTML form and
- If you need the latest Adobe Acrobat Reader, you can download it from Adobe's site.
- To become a USENIX Member, please see our Membership Information.