Virtual Machine Failure Prediction using Log

Analysis
Sukhyun Nam, Jibum Hong, Jae-Hyoung Yoo, and James Won-Ki Hong

Department of Computer Science and Engineering, POSTECH, Pohang, Korea

{obiwan96, hosewq, jhyoo78, jwkhong}@[Link]

Abstract—In this study, we propose a machine learning model failure occurrence. Based on an empirical study on bug reports
that predicts failures by analyzing logs before failures occur in in a Linux kernel [1], network faults are more likely to be of
virtual machines (VMs) used in network function virtualization Mandelbug type because networking is regarded as a basic
(NFV) environments. The proposed model utilizes convolutional
neural network (CNN) and includes pre-processing and pre- and core function from an operating system aspect, and thus
failure tagging techniques. We collected log data from VMs its interaction is more complex and tight. The average time
built on OpenStack to validate the proposed model. We classified required to fix Mandelbug is longer than that of regular bugs
failures based on early fault messages and built a CNN model to [1]. Therefore, faults and failures in networks and servers are
predict VM failures. The experimental results showed that the dangerous and can cause serious losses to service operators.
proposed model can predict failures before 5 minutes with the F1
score of 0.67. The proposed model will be used for VM proactive For example, faults in clouds deployed on OpenStack can take
live migration to avoid service degradation and interruptions hours or even days to fix [?]. However, most failures have
caused by failures. previous faults or errors before they occur. Failures based on
Index Terms—VNF, failure prediction, machine learning fault events can be predicted if failures have former faults. In
the case of VNF, if we can predict a failure in advance, we
I. I NTRODUCTION can migrate the VNF to another server before a failure occurs
Today’s networks are becoming larger in size and more to minimize the service quality degradation.
complex in structure. The advent of software-defined net- Faults and errors of computer equipment can be found in
working (SDN) and network function virtualization (NFV) the log. Most server and network equipment provide real-time
technologies has reduced CAPEX/OPEX, but the complex log output (e.g., syslog). Some studies are underway to harness
virtual structures have made it more difficult to monitor logs in network management [5]–[8]. However, as the software
and take action on virtual network and server failures. To structure of servers and networks has become more complex,
address this problem, many studies are underway for anomaly the amount of logs has increased proportionally. Since most
detection in SDN/NFV environments, but there is a lack of log data is not systematically generated, automatic analysis of
research on technologies that proactively predict failures in log data remains a fairly challenging task.
servers, virtual machines (VMs), and virtual network functions
In a log analysis, sentence classification techniques using
(VNFs) to take action before failures occur.
natural language processing (NLP) techniques are applied.
The failure prediction problem in NFV is challenging for
Sentence classification is the field of analyzing textual doc-
several reasons. First, owing to the complexity of large-scale
uments such as movie reviews to determine likes and dislikes
network systems, failures can be caused by many hetero-
of movies, or to classify documents according to predefined
geneous software and hardware faults. Second, the failure
criteria such as spam mail classification. Unlike other NLP
data are usually highly unbalanced. For example, Microsoft
fields where recurrent neural networks (RNNs) are strong
cloud services reported that each day, less than 0.1% of
because of the importance of word order, convolutional neural
nodes encounter failures [2]. Unbalanced data lead to a poor
networks (CNNs) are mainly used to analyze how each word
performance of the prediction model. Third, it is difficult
affects the classification results [9].
to determine the symptoms of failures from a large number
of data indicating the state of the network equipment. In In this paper, we propose a CNN based VM failure pre-
the case of log data, for example, modern cloud systems diction model which uses logs extracted from each VM as
produce approximately 30-50 gigabytes (approximately 120- input values. The model predicts the failure with former fault
200 million lines) of logs per hour [3]. However, most failures messages. The model includes pre-processing techniques for
have associated symptoms, and recent advances in machine log analysis such as log based word embedding and pre-failure
learning technologies have made it possible to analyze huge tagging techniques.
numbers of complicated data. To validate the feasibility of the proposed model, we trained
Mandelbug [4] is a type of fault with a complex activation the model with logs collected from VMs for a month in an
and propagation; thus, it is difficult to reproduce and incurs a NFV environment. The experimental results showed that the
high possibility of a time lag between a fault activation and a F1 score was 0.67 to predict the failure in 5 minutes.

Authorized licensed use limited to: MANIPAL INSTITUTE OF TECHNOLOGY. Downloaded on December 25,2025 at 12:04:20 UTC from IEEE Xplore. Restrictions apply.
©Copyright IEICE - APNOMS 2021 279
 II. R ELATED W ORK the simplest form of a CNN, which indicates that a CNN fits
the sentence classification problems.
A. Faults and Failures
Du et al. [8] proposed a contextual anomaly detection model
Because computer systems are extremely complex, the using a deep neural network (DNN) to learn log patterns from
causes of failures also vary widely, and thus the ways to a normal execution and detect anomalies when log patterns
cope with them are different. In general, faults are classified deviate from the model. They parsed each log entry into a
as Bohrbug and Mandelbug faults [4]. Whereas Bohrbug log key and parameter value vector and trained two parallel
faults can be easily isolated and reproduced, Mandelbug is an models as multiclass classifiers with a log key and parameter
opposite terminology whose activation and propagation appear value vector. Their model showed an F1-score of 0.98 with
non-deterministic and is complex. In addition, Mandelbug the OpenStack log data set.
faults have two possible cases that are not mutually exclusive W. Ji et al. [7] proposed a CNN model that collected log
[4]: First, such a fault causes a failure that is influenced data from wireless communication systems in a simulation
by other elements (e.g., operating system or hardware) of environment to predict whether log data after a constant gap
the software system. Second, the complexity of the error contained failure messages. In this work, the authors used the
propagation results in a time lag between fault activation and pre-processing technique which removed both symbols and
final failure occurrences. In the Mandelbug sub-classification numbers in the log data. The CNN model was based on the
system proposed by [10], LAG and ARB correspond to the model in [9]. This work was compared to models using long
second case, which has a delay in failure occurrence. short-term memory (LSTM) and gated recurrent units (GRU)
• ARB (Aging Related Bug) : A kind of bug that can cause for performance verification of the proposed CNN model,
an increasing failure rate and/or degraded performance, where the result showed that the CNN model showed slightly
known as software aging. This represents a situation in higher performance than the LSTM and GRU model. The
which the error state is generated slowly due to overloads, learning results showed an accuracy of about 0.75 when the
like continuous memory leaks or an increase in total gap was 2000, and an accuracy of about 0.57 when the gap
system runtime. was 5000. The problem is that the time difference between the
• LAG : A kind of bug that is non-aging related Mandelbug failure occurrence and input window is not constant because
(NAM), but there exists a time lag between the activation the unit of the gap is defined as the number of log messages. In
of the bug and the occurrence of its failure. particular, since more log messages are generated when faults
occur, the time difference with the prediction target is further
In either case, the error conditions do not immediately lead
reduced, resulting in a more urgent prediction.
to failures. These features provide the possibility of predicting
Thus, in our research, we used time (minutes) as a unit of
a failure through faults. In this study, we classified ARB and
the gap to stabilize the time difference from the prediction
LAG from the failures we collected, based on error logs, to
target. We also used a similar model with the CNN model
determine whether faults existed before a failure. We then
from [9], but we added pre-failure tagging steps in the data
utilize the failures classified as LAG and ARB for CNN model
tagging stage to generate more suitable data for log analysis.
learning.
III. D ESIGN AND I MPLEMENTATION
B. Sentence Classification and Log Analysis
This section describes the design of the proposed failure
Y. Kim [9] proposed to use a CNN model in a sentence prediction model and CNN model.
classification problem. This work used the word embedding
[11], a technique for representing words as dense vectors to A. CNN based VM failure prediction model
use sentences as input features for CNN. The author generated We propose a model that uses log data to predict and alert
sentence vectors via a concatenation process with generated failure risks in VM. The proposed model uses a time-based
word embedding vectors. The generated sentence vector was gap until the prediction point. The proposed CNN based VM
input through a convolution layer. The filters used in the failure prediction model structure is shown in Figure 1.
convolution layers used the dimension of the product of the As a testbed for collecting log data, we used NFV infrastruc-
filter size h and size of embedding vectors k, that is hk. ture (NFVI) built using OpenStack. This NFVI environment
Because the length of the input sentence is varying, the operates a variety of VNFs (e.g., IDS, firewall) to provide
dimension of the vector generated at this point is not constant. network services. Each VM passes logs from VNF, system
So max-pooling layer takes the maximum value for each vector daemon, and kernel to the monitoring node using rsyslog [12].
generated from a filter. Finally, feature values are generated The monitoring node extracts data of a pre-defined input
with the number of filters and are passed to a fully connected window size from the collected log data using timestamp (i.e.
softmax layer whose output is the probability distribution over logs in the last 10 minutes). Extracted data go through the
labels. Although the proposed CNN model’s performance was pre-processing step and is transmitted to the AI node. AI node
not significantly superior to that of the other algorithms (e.g., contains pre-trained word embedding and CNN model. In the
RNN-based and SVM algorithms), it showed a slightly better AI node, the log data passed from the monitoring node is
performance than the other models despite being built using converted to word embedding vectors and used as input for

Authorized licensed use limited to: MANIPAL INSTITUTE OF TECHNOLOGY. Downloaded on December 25,2025 at 12:04:20 UTC from IEEE Xplore. Restrictions apply.
©Copyright IEICE - APNOMS 2021 280
 the CNN model. CNN calculates the probability that a failure According to [14], using the max-pooling layer for a CNN
occurs after a gap of minutes based on input and passes it to in the sentence classification problem showed the highest per-
the control node when that probability crosses the predefined formance; therefore, we also used the max-pooling layer. The
threshold. The control node can then move the VNF to another max-pooling layer produces a vector with the same number of
server to prevent the failure before the failure occurs through dimensions as the number of filters. We then put the vector
VM live migration. into the fully-connected layer and dropout layer. A dropout
layer was used to prevent an overfitting. In addition, we used
B. Input Data Sigmoid as an activation function in the fully-connected layer
We used sliding windows with an input window size of to calculate the probability of a failure occurring as a value
minutes to obtain the input sequence from the logs. We between zero and 1.
removed the numbers and replaced the symbols with spaces,
removing the VM information, time, and application names D. Output Tagging
from the logs. Fig. 2 illustrates an example of logs that Learning the CNN model requires a label for each input
have been pre-processed. In addition, if there were duplicate window. Similar to the general classification problem, we
sentences in the window, they were removed, leaving only one tagged each input window to 1 if it was related to failure, and
sentence. 0 if the state would be normal. We tagged based on failure
The generated log corpus was converted into log embedding history, which is data recorded every minute whether each VM
through word embedding before being entering the CNN was failed or in a normal state. Each input window was tagged
model. Because word embedding learns similarity through whether a failure occurs after the gap minutes according to the
words that are together within sentences during the learning failure history.
phase, public word embeddings are unsuitable for a log analy- We could further increase the performance through the a
sis. Therefore, we applied a word embedding generated using pre-failure tagging method, which tags the states before the
our log corpus data. For word embedding learning, we used failure occurred as a pre-failure rather than as normal. Fig. 4
Google’s open-source project word2vec [13] and collected a shows the difference between regular tagging and pre-failure
log corpus for 1-month period from six VMs and servers in tagging. In this illustration, with regular tagging, Windows
our testbed. We set the minimum count to learn only the words 1 through 4 are tagged as zero because the state is normal
that appeared more than once in the daily log for each VM. after gap minutes, and Window 5 is tagged as 1. However,
We used Skip-gram as an embedding algorithm, and we set the error messages associated with the failure (in this case, ”Failed
vector size to 100 and window size to 5. The generated word to retrieve unit state: Connection timed out”) are included
embedding contained 265,452 words. Based on the results, for in all windows from Window1 through Window5. Owing to
example, the closest words to ”err” were ”over”, ”dropped”, the nature of a CNN, which extracts only important features
”rx”, ”crc”, ”tx”, ”collison” and ”miss.” regardless of the order of the words, error messages are highly
likely to not be recognized as the cause of the failure because
C. Convolutional Neural Network Window 1 through 4 are learned to output a value of zero.
We build a CNN model based on the CNN model from [9]. Therefore, we tagged the normal states as pre-failure states
Figure 3 represents the CNN model and inputs and outputs during the pre-failure size minutes just before the occurrence
used in our work. Generated word embedding goes through a of a failure. In addition, we tagged windows with a pre-failure
convolutional layer, which consists of several types of filters. state as a pre-failure value, which is a value between zero and
We set the number of filter types to binput window size/2c+1 1. Therefore, in our model, the CNN can learn about the error
because the larger the input value, the more necessary the message even if there is no failure after the gap. We conducted
filter is, and the size of the filter starts at 3 and grows by 1. experiments to determine which values were appropriate for
the pre-failure size and pre-failure value.
To ensure that the changed tagging method is applied
to learning, we utilize the following KL divergence-based
loss function. ytrue represents the tagged values, and ypred

Fig. 1. CNN based VM failure prediction model Fig. 2. Pre-processing example

Authorized licensed use limited to: MANIPAL INSTITUTE OF TECHNOLOGY. Downloaded on December 25,2025 at 12:04:20 UTC from IEEE Xplore. Restrictions apply.
©Copyright IEICE - APNOMS 2021 281
 Fig. 5. VM state tagging DFA

traffic. We used the Apache web server as the server. We need

to check the status of VMs, so we sent a ping message from
the other server to each VM every minute to check the status.
Fig. 3. CNN model design We decided to tag the VM as a failure when it refuses to ping
for one minute in a row. Figure 5 shows the deterministic finite
automata (DFA) representing the tagging scheme. In addition,
represents the output of CNN. We also applied class weights when multiple VMs became a failure state at the same time,
to handle unblanched data, which will be explained later. it was excluded from the VM failure tag, judging that there
  was a problem with the server, not with the VM.
loss = ytrue × log yypredtrue
× ClassW eight1 + (1 − We collected data for two weeks, and since failures usually
 
1−ytrue do not occur easily on VMs, we overload them in three ways
ytrue ) × log 1−y pred
× ClassW eight0
to generate as many failures as possible.
With the pre-failure tagging method, windows near failure • Resource overload – We overloaded CPU and memory for
will output values that are close to pre-failure values, but must each VM with Stress-ng [15], a resource overload tool.
be tagged as normal. So we set the threshold of failure as pre- We continuously increase CPU usage and memory usage.
failure value+0.05 so that the window’s output does not exceed The overload started at 50% and increased 5% every 5
the threshold. minutes, and when a failure occurred, overload figures
have been reset.
IV. E XPERIMENT AND E VALUATION • Traffic overload - Client VM sent traffic requests to the
In this section, we describe the experiments we conducted to server with Apache Bench [16], a server performance
verify the suitability of the proposed model and CNN models checking tool. It continuously increases the number of
and describe the results. requests and increases the number of concurrent connec-
A. Data Collection tions every 30 minutes. If a failure occurred, overload
figures have been reset.
We conduct experiments by building the NFVI described • External attack – The attacker server generates a DDoS
in Chapter 3. The NFVI consists of three servers that take attack to a randomly picked VM. It transmitted more than
on compute nodes and two servers take on for monitoring 100,000 packets at intervals below 6µs. Transmission
node and controller node respectively. Each compute node packet interval, attack time were randomly selected each
also contains VMs to run VNF and to serve as clients and time of the attack.
servers. We installed six different VNFs (Suricata, HAProxy,
As a result, we collected 44 failures within a month of the
iptables, ntopng, nDPI and Snort) on each VM to output
experiment. Thirteen of them occurred simultaneously in the
various logs, and also to create different situation. We changed
VMs, and thus they were determined to be from a server
the specification of each VM in response to each VNF’s
failure. Based on the log, we select the failures where the
requirement.
former fault logs exist. Four of the 31 VM failures that did
We generated multiple client–VNF-server chains that utilize
not have an error log before the failure were determined. The
each VNF as a single service, allowing each VNF to handle the
remaining 27 failures were considered to have early faults
associated with the failure and were distinguished by ARB
and LAG according to the criteria provided in [10].
In the case of ARB, similar fault logs were repeated con-
tinuously, and repeated logs were mainly regarding messages
indicating that processes or networks were unresponsive or
took too long. In the case of LAG, there was an error
message that did not normally occur, and in general, other
system daemons were restarted after the message occurred.
Furthermore, error logs mainly occurred from the kernel and
were related to hardware or system faults. The following are
examples of log messages from the ARBs and LAGs observed
Fig. 4. Regular tagging and pre-failure tagging before a failure.

Authorized licensed use limited to: MANIPAL INSTITUTE OF TECHNOLOGY. Downloaded on December 25,2025 at 12:04:20 UTC from IEEE Xplore. Restrictions apply.
©Copyright IEICE - APNOMS 2021 282
 • ARB TABLE I
P RE - FAILURE SIZE AND VALUE TEST
– task delay info Worker processing SEQNUM is tak-
ing a long time
– Failed to retrieve unit state: Connection timed out
• LAG
– blk update request: I/O error, dev vda, sector op
READ flags phys seg prio class
– fail to add MMCONFIG information, can’t access
extended PCI configuration space under this bridge
ARBs occurred much more frequently, with 6 of the 27
failures being LAGs and 21 being ARBs. If the time difference
TABLE II
between the fault and the failure was too long, it was excluded G AP AND WINDOW SIZE TEST
because the fault message did not enter the input window at the
time of training, and thus five failures with a time difference
of more than 30 min were excluded.

B. CNN Learning

The last generated data included 22 failures. However, in

experimental environments with an input window size of 5 min
and a gap of 5 min, more than 1,500 windows were created
per day (we did not create an input window when the log did
not exist). Because the data were excessively unbalanced, we
applied the oversampling by 2 times to the failure data and C. Results
the undersampling by 60 times to normal data. In addition, We collected 35,370 data, and using an undersampling, we
we applied the class weight as the reciprocal number of each applied only 589 data. We randomly separated the data into
class (normal/failure) in the data to the loss function. training data and test data at a 8:2 ratio. In addition, 20%
We experimented to find the appropriate value for the pre- of them were used as a validation set, and thus the model
failure size, pre-failure value, input window size, and gap. In was trained until the loss value for the validation set remained
the case of the gap, we measured the VM live migration time unchanged.
to catch the lower bound. According to [17], live migration First, we tested the appropriate values for the pre-failure
in OpenStack includes 9 steps, and the original VM services size and pre-failure value. At this time, the input window size
until the 6th step, stop-and-copy, which is the step that VM and gap were set to 5 min. First, we experimented without pre-
is paused. Therefore, we determined that the gap should be failure tagging as a control group. Without pre-failure tagging,
longer than the time that it takes to get to the 6th step. We the CNN showed an accuracy of 0.95 and an F1-score of 0.25,
tested how long it would take to perform five steps. As a result, which was extremely low. We experimented by changing the
it took an average of 45 seconds before the stop-and-copy pre-failure size to 3, 5, and 10 min and the pre-failure value
phase, based on VMs with the size of 5GB on OpenStack. So to 0.5, 0.65, and 0.8. As a result, the accuracy was generally
we decided that even if the gap is one minute, migration could similar and the F1-score varied, but was much higher than the
occur before the failure occurred in normal circumstances. result of the test without pre-failure tagging. Table I shows
In NLP, words that are not in the dictionary are called out- the results. The highest performance was an F1-score of 0.67
of-vocabulary (OOV). In general, for OOV, the model does not when the pre-failure tagging 0.65 for three minutes. In general,
apply word embeddings, and instead uses randomly generated the performance increased when the pre-failure size decreases.
vectors or pre-defined OOV vectors. In the case of log data, We experimented by changing the gap to 1, 3, 5 and 10 min,
most of the OOVs were an application internal ID or process and the input window size to 5, 10, and 20 min. At this time,
ID such as ”UOixfW” and ”xdc” (word after pre-processing). we utilized a pre-failure size of 3 min, and a pre-failure value
However, in the case of LAG errors, they generated logs that of 0.65, which showed the best performance in the former
had never been observed before, and thus included OOV in a experiment. Table II shows the results. As the results indicate,
input window with a high probability. In fact, the error log of the highest performance was an F1-score of 0.67 when gap
one of the failures we observed in our experiment was ”sysrq: was 5 min and the input window size was 5 min. When gap
Resetting”, and both words were OOV with our pre-learned was less than 10 min, the performance changed similarly,
word embedding. It is more important to catch logs related which seems to be because each failure has a different time
to faults than to delete unimportant IDs, and thus we tagged difference from the fault messages. We predicted that a larger
OOV with a random vector of 100 dimensions. input window size would result in a higher performance as

Authorized licensed use limited to: MANIPAL INSTITUTE OF TECHNOLOGY. Downloaded on December 25,2025 at 12:04:20 UTC from IEEE Xplore. Restrictions apply.
©Copyright IEICE - APNOMS 2021 283
 sequence of log messages, and it is expected to show higher
performance.
ACKNOWLEDGMENT
This work was supported by Korea Evaluation Institute Of
Industrial Technology (KEIT) grant funded by the Korea Gov-
ernment(MOTIE) [ (No.2009633) Development of AI network
traffic controlling system based on SDN for ultra-low latency
network service ].
This work was supported by the Institute of Information
& Communications Technology Planning & Evaluation (IITP)
grant funded by the Korean government (MSIT) (2018-0-
00749, Development of Virtual Network Management Tech-
Fig. 6. ROC curve with CNN, RNN, GRU
nology based on Artificial Intelligence).
R EFERENCES
more information was entered; however, it was similar when [1] G. Xiao, Z. Zheng, B. Yin, K. S. Trivedi, X. Du and K. Cai, ”Experience
gap is under 10 min. This is because the time difference Report: failure Triggers in Linux Operating System: from Evolution
between most fault messages and failures is less than 10 min. Perspective,” 2017 IEEE 28th International Symposium on Software
Reliability Engineering (ISSRE), 2017, pp. 101-111.
However, when the gap is over 10 min, the performance is [2] Q. Lin, K. Hsieh, Y. Dang, H. Zhang, K. Sui, Y. Xu, J. Lou, C. Li, Y.
very low. Wu and R. Yao, ”Predicting node failure in cloud service systems,” In
Finally, for a performance evaluation of the CNN, we Proceedings of the 2018 26th ACM Joint Meeting on European Software
Engineering Conference and Symposium on the Foundations of Software
compared the performance of a GRU and RNN. Each model Engineering, 2018, pp. 480–490.
is simple, containing 256 cells and fully connected layer with [3] H. Mi, H. Wang, Y. Zhou, M. R. Lyu, and H. Cai, ”Toward fine-
a Sigmoid function. All three models used data with input grained, unsupervised, scalable performance diagnosis for production
cloud computing systems,” IEEE Transactions on Parallel and Dis-
window size 5, gap 5, pre-failure size 5, and pre-failure value tributed Systems, 2013.
0.65. As a result, the GRU showed an accuracy of 0.53, a [4] M. Grottke and K. S. Trivedi, ”A classification of software faults,”
recall of 0.95, and an F1-score of 0.41, and the RNN showed Journal of Reliability Engineering Association of Japan, 2005, pp. 425-
438.
an accuracy of 0.53, a recall of 0.68, and an F1-score of 0.33. [5] Q. Fu, J. Lou, Y. Wang and J. Li, ”Execution Anomaly Detection in
Fig. 6 illustrates the receiver operating characteristic (ROC) Distributed Systems through Unstructured Log Analysis,” 2009 Ninth
curve for an accurate comparison of the three models. The IEEE International Conference on Data Mining, 2009, pp. 149-158.
[6] S. He, J. Zhu, P. He and M. R. Lyu, ”Experience Report: System
plot shows angular lines because the number of data points Log Analysis for Anomaly Detection,” 2016 IEEE 27th International
is not large. The much higher area under the curve (AUC) of Symposium on Software Reliability Engineering (ISSRE), Ottawa, ON,
the CNN compared to the AUCs of the RNN and GRU shows Canada, 2016, pp. 207-218.
[7] W. Ji, S. Duan, R. Chen, S. Wang and Q. Ling, ”A CNN-based
that the CNN is much better learned. network failure prediction method with logs,” 2018 Chinese Control
And Decision Conference (CCDC), 2018, pp. 4087-4090.
V. C ONCLUSION AND F UTURE WORK [8] M. Du, F. Li, G. Zheng and V. Srikumar, ”Deeplog: Anomaly de-
tection and diagnosis from system logs through deep learning,” In
In this work, we proposed a model that analyzes logs Proceedings of the 2017 ACM SIGSAC Conference on Computer and
extracted from VMs which execute VNFs and determine Communications Security, 2017, pp. 1285–1298.
whether failures will occur in the future. The proposed model [9] Y. Kim, ”Convolutional neural networks for sentence classification,” In
Proceedings of the 2014 Conference on Empirical Methods in Natural
is built by adapting the sentence classification techniques. Language Processing (EMNLP), 2014, pp. 1746–1751.
To fit the log analysis of VMs, we made word embeddings [10] D. Cotroneo, M. Grottke, R. Natella, R. Pietrantuono, and K. S. Trivedi,
with log corpus, and we used the pre-failure tagging method. ”Fault triggers in open-source software: An experience report,” in
Software Reliability Engineering (ISSRE), 2013 IEEE 24th International
We validate the proposed model with data generated in the Symposium on. IEEE, 2013, pp. 178–187.
OpenStack testbed. [11] T. Mikolov, I. Sutskever, K. Chen, G. Corrado and J. Dean, ”Distributed
The limitation of this research is that we used stress tools Representations of Words and Phrases and their Compositionality”, In
Advances on Neural information Processing Systems, 2013.
to generate failures instead of using real log data. So, now we [12] Adiscon GmbH, ”The rocket-fast Syslog Server,” [Online]. Available:
are continuously collecting real log data and planning to use [Link] .
a large amount of data in the near future research. [13] Google, ”word2vec,” 2013. [Online]. Available:
[Link] .
In addition, in this study, data with large time differences [14] Y. Zhang and B.C. Wallace, ”A sensitivity analysis of (and practitioners’
between the fault and failure were excluded from the learning. guide to) convolutional neural networks for sentence classification,”
To learn data with a large time difference, the window size arXiv preprint arXiv:1509.01626 (2015).
[15] ”Stress-ng,” [Online]. Available: [Link]
needs to be increased; however, the performance of the CNN ng .
decreased and the learning time becomes much longer when [16] The Apache Software Foundation, ”Apache Bench,” [Online]. Available:
the window size exceeds 20 min. To learn this type of failure, [Link] .
[17] T.J. He, A.N. Toosi, and R. Buyya, ”Performance evaluation of live
we are currently working on a new learning approach that virtual machine migration in SDN-enabled cloud data centers,” Journal
use CNN results in RNN-based models to understand the of Parallel and Distributed Computing 131 (2019): 55-68.

Authorized licensed use limited to: MANIPAL INSTITUTE OF TECHNOLOGY. Downloaded on December 25,2025 at 12:04:20 UTC from IEEE Xplore. Restrictions apply.
©Copyright IEICE - APNOMS 2021 284