Discovering hidden errors from application log traces with process mining

Over the past decades logs have been widely used for detecting and analyzing failures of computer applications. Nevertheless, it is widely accepted by the scientific community that failures might go undetected in the logs. This paper proposes a measurement study with a dataset of 3,794 log traces obtained from normative and failure runs of the Apache web server. We use process mining (i) to infer a model of the normative log behavior, e.g., presence and ordering of messages in the traces, and (ii) to detect failures within arbitrary traces by looking for deviations from the model (conformance checking). Analysis is done with the Integer Linear Programming (ILP) Miner, Inductive Miner and Alpha++ Miner algorithms. Our measurements indicate that, although only around 18% failure traces contain explicit error keywords and phrases, conformance checking allows detecting up to 87% failures at high precision, which means that most of the errors are hidden across the traces.