aquanauts / alogamous

A log anomaly detection framework
MIT License
1 stars 9 forks source link

Improperly formatted log lines being mistaken for stack traces #76

Open kitrady opened 3 months ago

kitrady commented 3 months ago

If an improperly formatted log lines directly follows a stack trace, both the stack trace analyzer and format analyzer will confuse it as part of the stack trace. This means that when these analyzers report, they may add log lines that aren't supposed to be there or omit log lines that are supposed to be there, respectively. This is because both analyzers use the unstructured line type from the parser to check if the lines are still part of the stack trace, which leads to this bug, given that improperly formatted log lines also are marked as unstructured. I don't think this bug has any reasonable fix, given that this would require a really complex tokenization system, but I wanted to document it anyway so that people would be aware of this behavior.