Abstract Distributed systems have been widely used in many safety‐critical areas. Any abnormalities (e.g., service interruption or service quality degradation) could lead to application crashes or decrease user satisfaction. These things may cause serious economic losses. Among the various quality assurance approaches for distributed systems, log‐based anomaly detection (LAD) has become a popular research topic. Its popularity relates to system logs being able to record and reveal important run‐time information. This paper presents a general LAD framework for distributed systems. Log grouping and feature‐pattern mining are two crucial LAD components that impact on the anomaly‐detection effectiveness. We also present a systematic survey of techniques in these two directions; propose classification frameworks for log grouping and feature patterns; and summarize four log‐grouping techniques and five feature patterns (which refer to invariant relationships among logs that can be used for anomaly detection). To evaluate their applicability, we report on the findings when applying existing techniques to Ray, a popular industrial distributed system. Based on these findings, several open issues are identified, which provide potential guidance for future research and development.

Microservice architecture has been widely used for the development of large-scale distributed applications. Microservice systems normally have high complexity and loose coupling nature, which make it challenging to localize faults in them. Automated fault localization is particularly difficult for microservice systems, due to their unique features, such as frequent updates, complex dependencies, and multiple microservice instances. In this paper, we propose a fault localization approach for microservice systems based on trace log clusterings, called TLCluster. TLCluster first derives trace logs by collecting and combining communication messages and logs of microservice systems, then clusters trace logs for different business process categories, calculates similarities between normal and abnormal trace logs, and finally evaluates and ranks the suspiciousness scores of microservice instances. We conducted a series of experiments to evaluate the effectiveness of TLCluster using a large-scale microservice system. Experimental results show that our approach is able to effectively localize faults of microservice systems and demonstrates a better fault localization accuracy and precision compared with state-of-the-art baseline techniques.