Determining critical logs for network applications

A computing system comprising processing circuitry having access to a storage device, the processing circuitry configured to:

• create a knowledge graph identifying dependencies of nodes within each of a plurality of layers for a network application, wherein the plurality of layers are layers of a computing infrastructure;
• generate, based on metrics from each of the plurality of layers, anomaly logs;
• determine, based on the anomaly logs, a plurality of nodes affected by a performance issue, the plurality of nodes including at least one node from each of the plurality of layers;
• obtain, based on the knowledge graph identifying dependencies of the plurality of nodes affected by the performance issue, a plurality of candidate logs for the plurality of layers, wherein the plurality of candidate logs comprise system logs from the plurality of nodes;
• for each candidate log of the plurality of candidate logs:
• map the candidate log to a log template of a plurality of log templates,
• wherein each log template to which a candidate log is mapped is a mapped log template;
• rank the mapped log templates based on one or more properties of each of the mapped log templates;
• select, based on the ranking of the mapped log templates, a set of critical logs from the plurality of candidate logs;
• and
• output at least one of (1) an indication of the set of critical logs to enable determination of a potential root cause associated with the performance issue of the network application or (2) an indication of the potential root cause associated with the performance issue of the network application.

Non-transitory computer-readable storage media comprising instructions that, when executed, cause processing circuitry to:

• create a knowledge graph identifying dependencies of nodes within each of a plurality of layers for a network application, wherein the plurality of layers are layers of a computing infrastructure;
• generate, based on metrics from each of the plurality of layers, anomaly logs;
• determine, based on the anomaly logs, a plurality of nodes affected by a performance issue, the plurality of nodes including at least one node from each of the plurality of layers;
• obtain, based on the knowledge graph identifying dependencies of the plurality of nodes affected by the performance issue, a plurality of candidate logs for the plurality of layers, wherein the plurality of candidate logs comprise system logs from the plurality of nodes;
• for each candidate log of the plurality of candidate logs:
• map the candidate log to a log template of a plurality of log templates,
• wherein each log template to which a candidate log is mapped is a mapped log template;
• rank the mapped log templates based on one or more properties of each of the mapped log templates;
• select, based on the ranking of the mapped log templates, a set of critical logs from the plurality of candidate logs;
• and
• output at least one of (1) an indication of the set of critical logs to enable determination of a potential root cause associated with the performance issue of the network application or (2) an indication of the potential root cause associated with the performance issue of the network application.