[logs] Re: what is normal ?

From: Will Partain (partainat_private)
Date: Thu Nov 14 2002 - 08:12:44 PST

  • Next message: Raistlin: "Re: [logs] Re: what is normal ?"

    "Jon Stearley" <jrstearat_private> writes:
    
    > i'm using the teiresias algorithm
    > (http://cbcsrv.watson.ibm.com/Tspd.html) to classify log lines.
    
    (OK, I'm scared :-)
    
    Just an idle possibly-related thought: could any of the
    principles of Bayesian spam filtering (quite the rage in
    some circles...) be applied to logging?
    
    (Best to go googling if you want real info on Bayesian spam
    filtering, but the rough user-interface is: you train the
    filter on a big pile of spam, and then on a big pile of
    non-spam ('ham'); thereafter, it tells you whether messages
    look more like the one or t'other.)
    
    I'm guessing that a typical syslog message lacks enough info
    to play the Bayesian game.  But I suppose you could feed it
    chunks of logs ({1,5,10} {secs,mins}) and it could at least
    eliminate the chunks that were entirely "uninteresting".
    
    Please bear in mind that I don't know what I'm talking about.
    
    Will
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Thu Nov 14 2002 - 09:53:50 PST