Logzip: Extracting Hidden Structures via Iterative Clustering for Log Compression
Execution logs record detailed runtime information of software systems and are used as the main data source for many tasks around software engineering. As modern software systems are evolving into large scale and complex structures, logs have become one type of fast-growing big data in industry. In particular, such logs often need to be stored for a long time in practice (e.g., a year), in order to analyze recurrent problems or track security issues. However, archiving logs consumes a large amount of storage space and computing resources, which in turn incurs high operational cost. Data compression is essential to reduce the cost of log storage. Traditional compression tools (e.g., gzip) work well for general texts, but are not tailed for execution logs. In this paper, we propose a novel and effective log compression method, namely logzip. Logzip is capable of extracting hidden structures from logs via fast iterative clustering and further generating coherent intermediate representations that can enable more effective compression. We evaluate logzip on five large log datasets of different types, with a total of 63.6 GB in size. The results show that, on average, logzip can save about half of the storage space over traditional compression tools. Meanwhile, the design of logzip is highly parallel and only incurs negligible overhead. In addition, we share the industrial experience of applying logzip in a global company.