Anomaly detection and filtering based on system logs

A system, comprising:

• a processor;
• and
• a memory including instructions that when executed by the processor perform an operation comprising:
• receiving, at a first time, a first sequence of log entries from a networked system;
• generating, using a machine learning model and based on previously observed log entries including the first sequence of log entries, predicted log entries for a second time;
• receiving, at the second time, a second sequence of log entries from the networked system;
• determining whether the second sequence is anomalous based on comparing the second sequence with the predicted log entries;
• in response to determining that the second sequence is anomalous, determining whether the second sequence is noteworthy based on a function entropy of the first sequence and a sentiment polarity of the second sequence, wherein the function entropy is a measure of randomness in the log entries, and wherein the sentiment polarity is a measure of sentiment of words found in the log entries;
• and
• in response to determining that the second sequence is noteworthy, generating an anomaly report that includes the second sequence and a root cause.

A device including computer-readable instructions that when executed by a processor in the device enable performance of an operation comprising:

• receiving, at a first time, a first sequence of log entries from a networked system;
• generating, using a machine learning model and based on previously observed log entries including the first sequence of log entries, predicted log entries for a second time;
• receiving, at the second time, a second sequence of log entries from the networked system;
• determining whether the second sequence is anomalous based on comparing the second sequence against the predicted log entries;
• in response to determining that the second sequence is anomalous, determining whether the second sequence is noteworthy based on a function entropy of the first sequence and a sentiment polarity of the second sequence, wherein the function entropy is a measure of randomness in the loci entries, and wherein the sentiment polarity is a measure of sentiment of words found in the log entries;
• and
• in response to determining that the second sequence is noteworthy, generating an anomaly report that includes the second sequence and a root cause.