System event search based on heterogeneous logs

A computer system for searching system events based on heterogeneous logs, comprising:

• a processor device operatively coupled to a memory device, the processor device being configured to:
• mine a plurality of log patterns from a first plurality of heterogeneous logs and a second plurality of heterogeneous logs to obtain a set of known-event log patterns for each known event and a set of unknown-event log patterns for each unknown event;
• build a weighted vector representation of each set of known-event log patterns and of each set of unknown-event log patterns;
• evaluate a similarity of the vector representation of each set of unknown-event log patterns to the vector representation of each set of known-event log patterns;
• and
• identify a known event that is most similar to an unknown event based on the evaluated similarity to troubleshoot system faults based on past actions for similar events to improve an operation of a computer system.

A computer program product for searching system events based on heterogeneous logs, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to perform the method comprising:

• mining, by the processor device based on instructions stored on a storage device coupled to the processor device, a plurality of log patterns from a first plurality of heterogeneous logs and a second plurality of heterogeneous logs to obtain a set of known-event log patterns for each known event and a set of unknown-event log patterns for each unknown event;
• building, by the processor device, a weighted vector representation of each set of known-event log patterns and of each set of unknown-event log patterns;
• evaluating, by the processor device, a similarity of the vector representation of each set of unknown-event log patterns to the vector representation of each set of known-event log patterns;
• and
• identifying, by the processor device, a known event that is most similar to an unknown event based on the evaluated similarity to troubleshoot system faults based on past actions for similar events to improve an operation of a computer system.