{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,6]],"date-time":"2026-07-06T18:30:06Z","timestamp":1783362606436,"version":"3.54.6"},"reference-count":26,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2022,7,26]],"date-time":"2022-07-26T00:00:00Z","timestamp":1658793600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"EU H2020 IoTwins Innovation Action project","award":["g.a. 857191"],"award-info":[{"award-number":["g.a. 857191"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>Context\u2014Anomaly detection in a data center is a challenging task, having to consider different services on various resources. Current literature shows the application of artificial intelligence and machine learning techniques to either log files or monitoring data: the former created by services at run time, while the latter produced by specific sensors directly on the physical or virtual machine. Objectives\u2014We propose a model that exploits information both in log files and monitoring data to identify patterns and detect anomalies over time both at the service level and at the machine level. Methods\u2014The key idea is to construct a specific dictionary for each log file which helps to extract anomalous n-grams in the feature matrix. Several techniques of Natural Language Processing, such as wordclouds and Topic modeling, have been used to enrich such dictionary. A clustering algorithm was then applied to the feature matrix to identify and group the various types of anomalies. On the other side, time series anomaly detection technique has been applied to sensors data in order to combine problems found in the log files with problems stored in the monitoring data. Several services (i.e., log files) running on the same machine have been grouped together with the monitoring metrics. Results\u2014We have tested our approach on a real data center equipped with log files and monitoring data that can characterize the behaviour of physical and virtual resources in production. The data have been provided by the National Institute for Nuclear Physics in Italy. We have observed a correspondence between anomalies in log files and monitoring data, e.g., a decrease in memory usage or an increase in machine load. The results are extremely promising. Conclusions\u2014Important outcomes have emerged thanks to the integration between these two types of data. Our model requires to integrate site administrators\u2019 expertise in order to consider all critical scenarios in the data center and understand results properly.<\/jats:p>","DOI":"10.3390\/computers11080117","type":"journal-article","created":{"date-parts":[[2022,7,26]],"date-time":"2022-07-26T22:03:42Z","timestamp":1658873022000},"page":"117","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["Combining Log Files and Monitoring Data to Detect Anomaly Patterns in a Data Center"],"prefix":"10.3390","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1913-6947","authenticated-orcid":false,"given":"Laura","family":"Viola","sequence":"first","affiliation":[{"name":"Department of Statistical Sciences, University of Bologna, 40126 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7341-6491","authenticated-orcid":false,"given":"Elisabetta","family":"Ronchieri","sequence":"additional","affiliation":[{"name":"Department of Statistical Sciences, University of Bologna, 40126 Bologna, Italy"},{"name":"INFN CNAF, 40126 Bologna, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3938-0947","authenticated-orcid":false,"given":"Claudia","family":"Cavallaro","sequence":"additional","affiliation":[{"name":"Department of Mathematics and Computer Science, University of Catania, 95124 Catania, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,7,26]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Farshchi, M., Schneider, J.G., Weber, I., and Grundy, J. (2015, January 2\u20135). Experience report: Anomaly detection of cloud application operations using log and cloud metric correlation analysis. Proceedings of the 2015 IEEE 26th International Symposium on Software Reliability Engineering (ISSRE), Gaithersbury, MD, USA.","DOI":"10.1109\/ISSRE.2015.7381796"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Gervasi, O., Murgante, B., Misra, S., Garau, C., Ble\u010di\u0107, I., Taniar, D., Apduhan, B.O., Rocha, A.M.A., Tarantino, E., and Torre, C.M. (2021). Identifying anomaly detection patterns from log files: A dynamic approach. Computational Science and Its Applications\u2014ICCSA 2021, Springer International Publishing.","DOI":"10.1007\/978-3-030-87010-2"},{"key":"ref_3","unstructured":"Ma, M., Zhang, S., Chen, J., Xu, J., Li, H., Lin, Y., Nie, X., Zhou, B., Wang, Y., and Pei, D. (2021, January 14\u201316). Jump-starting multivariate time series anomaly detection for online service systems. Proceedings of the 2021 USENIX Annual Technical Conference (USENIX ATC 21), Virtual."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Bertero, C., Roy, M., Sauvanaud, C., and Tr\u00e9dan, G. (2017, January 23\u201326). Experience report: Log mining using natural language processing and application to anomaly detection. Proceedings of the 2017 IEEE 28th International Symposium on Software Reliability Engineering (ISSRE), Toulouse, France.","DOI":"10.1109\/ISSRE.2017.43"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Wang, M., Xu, L., and Guo, L. (2018, January 24\u201327). Anomaly detection of system logs based on natural language processing and deep learning. Proceedings of the 2018 4th International Conference on Frontiers of Signal Processing (ICFSP), Poitiers, France.","DOI":"10.1109\/ICFSP.2018.8552075"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Layer, L., Abercrombie, D.R., Bakhshiansohi, H., Adelman-McCarthy, J., Agarwal, S., Hernandez, A.V., Si, W., and Vlimant, J.R. (2020, January 4\u20138). Automatic log analysis with NLP for the CMS workflow handling. Proceedings of the 24th International Conference on Computing in High Energy and Nuclear Physics (CHEP 2019), Adelaide, Australia.","DOI":"10.2172\/1637601"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"100030","DOI":"10.1016\/j.hcc.2021.100030","article-title":"An unsupervised anomaly detection framework for detecting anomalies in real time through network system\u2019s log files analysis","volume":"1","author":"Zeufack","year":"2021","journal-title":"High-Confid. Comput."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Bursic, S., Cuculo, V., and D\u2019Amelio, A. (2019, January 7\u201311). Anomaly detection from log files using unsupervised deep learning. Proceedings of the International Symposium on Formal Methods, Porto, Portugal.","DOI":"10.1007\/978-3-030-54994-7_15"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly detection: A survey","volume":"41","author":"Chandola","year":"2009","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"22056","DOI":"10.1088\/1742-6596\/1176\/2\/022056","article-title":"Detecting anomalies in data center physical infrastructures using statistical approaches","volume":"1176","author":"Huang","year":"2019","journal-title":"J. Phys. Conf. Ser. Iop Publ."},{"key":"ref_11","unstructured":"Gabel, M., Schuster, A., and Gilad-Bachrach, R. (2013). Unsupervised Anomaly Detection in Large Datacenters. [Ph.D. Thesis, Computer Science Department, Technion]."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Wang, C., Viswanathan, K., Choudur, L., Talwar, V., Satterfield, W., and Schwan, K. (2011, January 23\u201327). Statistical techniques for online anomaly detection in data centers. Proceedings of the 12th IFIP\/IEEE International Symposium on Integrated Network Management (IM 2011) and Workshops, Dublin, Ireland.","DOI":"10.1109\/INM.2011.5990537"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Decker, L., Leite, D., Giommi, L., and Bonacorsi, D. (2020, January 19\u201324). Real-time anomaly detection in data centers for log-based predictive maintenance using an evolving fuzzy-rule-based approach. Proceedings of the 2020 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE), Glasgow, UK.","DOI":"10.1109\/FUZZ48607.2020.9177762"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1186\/s40537-020-00400-y","article-title":"A novel multi-source information-fusion predictive framework based on deep neural networks for accuracy enhancement in stock market prediction","volume":"8","author":"Nti","year":"2021","journal-title":"J. Big Data"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Lee, J., and Yi, J.S. (2017). Predicting Project\u2019s Uncertainty Risk in the Bidding Process by Integrating Unstructured Text Data and Structured Numerical Data Using Text Mining. Appl. Sci., 7.","DOI":"10.3390\/app7111141"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"8002","DOI":"10.1051\/epjconf\/201921408002","article-title":"INFN Tier\u20131: A distributed site","volume":"214","author":"Boccali","year":"2019","journal-title":"EPJ Web Conf."},{"key":"ref_17","unstructured":"Breskin, R.V.A. (2009). The CERN Large Hadron Collider: Accelerator and Experiments Volume 2: CMS, LHCb, LHCf, and Totem, CERN."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"92029","DOI":"10.1088\/1742-6596\/898\/9\/092029","article-title":"The evolution of monitoring system: The INFN-CNAF case study","volume":"898","author":"Bovina","year":"2017","journal-title":"J. Phys. Conf. Ser."},{"key":"ref_19","unstructured":"He, P., Chen, Z., He, S., and Lyu, M.R. (October, January 26). Characterizing the natural language descriptions in software logging statements. Proceedings of the 33rd ACM\/IEEE International Conference on Automated Software Engineering ASE, Rochester, MI, USA."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Chen, B., and Jiang, Z.M.J. (2017, January 20\u201328). Characterizing and detecting anti-patterns in the logging code. Proceedings of the IEEE\/ACM 39th International Conference on Software Engineering (ICSE), Buenos Aires, Argentina.","DOI":"10.1109\/ICSE.2017.15"},{"key":"ref_21","unstructured":"NLP (2022, July 16). Natural Language Toolkit. Available online: https:\/\/www.nltk.org\/."},{"key":"ref_22","unstructured":"Scikit Learn (2022, July 15). CountVectorizer in Scilit Learn. Available online: https:\/\/scikit-learn.org\/stable\/modules\/generated\/sklearn.feature_extraction.text.CountVectorizer.html."},{"key":"ref_23","unstructured":"(2022, July 16). pyLDAvis. Available online: https:\/\/pyldavis.readthedocs.io\/en\/latest\/readme.html."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Sandhu, A., and Mohammed, S. (2022). Detecting Anomalies in Logs by Combining NLP features with Embedding or TF-IDF. TechRxiv.","DOI":"10.36227\/techrxiv.19498769"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/TSE.2020.3007554","article-title":"Logram: Efficient Log Parsing Using n-Gram Dictionaries","volume":"48","author":"Dai","year":"2020","journal-title":"IEEE Trans. Softw. Eng."},{"key":"ref_26","first-page":"77","article-title":"Probabilistic topic models","volume":"55","author":"Blei","year":"2010","journal-title":"IEEE Signal Process. Mag."}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/11\/8\/117\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T23:56:49Z","timestamp":1760140609000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/11\/8\/117"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,7,26]]},"references-count":26,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2022,8]]}},"alternative-id":["computers11080117"],"URL":"https:\/\/doi.org\/10.3390\/computers11080117","relation":{"has-preprint":[{"id-type":"doi","id":"10.20944\/preprints202206.0205.v1","asserted-by":"object"}]},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,7,26]]}}}