Towards Effective Log Summarization

Database access logs are the canonical go-to resource for tasks ranging from performance tuning to security auditing. Unfortunately, they are also large, unwieldy, and it can be difficult for a human analyst to divine the intent behind typical queries in the log. With an eye towards creating tools for ad-hoc exploration of queries by intent, we analyze techniques for clustering queries by intent. Although numerous techniques have already been developed for log summarization, they target specific goals like query recommendation or storage layout optimization rather than the more fuzzy notion of query intent. In this paper, we first survey a variety of log summarization techniques, focusing on a class of approaches that use query similarity metrics. We then propose DCABench, a benchmark that evaluates how well query similarity metrics capture query intent, and use it to evaluate three similarity metrics. DCABench uses student answers to query construction assignments to capture a wide range of distinct SQL queries that all have the same intent. Next, we propose and evaluate a query regularization process that standardizes query representations, significantly improving the effectiveness of the three similarity metrics tested. Finally, we propose an entirely new similarity metric based on the Weisfeiler-Lehman (WL) approximate graph isomorphism algorithm, which identifies salient features of a graph — or in our case, of the abstract syntax tree of a query. We show experimentally that distances in WL-feature space capture a meaningful notion of similarity, while still retaining competitive performance.