Conversation Extraction from Event Logs

Event logs are more and more considered for helping IT personnel understand system behaviour or performance. One way to get knowledge from event logs is by extracting conversations (a.k.a. sessions) through the recovering of event correlations. This paper proposes a highly parallel algorithm to retrieve conversations from event logs, without having any knowledge about the used correlation mechanisms. To make the event log exploration effective and efficient, we devised an algorithm that covers an event log and builds the possible conversation sets w.r.t. the data found within the events. To limit the conversation set exploration and quicker recover good candidates, the algorithm is guided by an heuristic based upon the evaluation of invariants and conversation quality attributes. This heuristic also offers flexibility to users, as the quality and invariants can be adapted to the system context. We report experimental results obtained from 6 case studies and show that our algorithm has the capability of recovering the expected conversation sets in reasonable time delays.