Presentation Information
[B-6-31]A Method for Suppressing False Positives Caused by Identifier–String Collisions
〇Haruki Yamauchi1, Makoto Araoka1 (1. NTT, Inc.)
Keywords:
Log Monitoring,False Detection / False Positive,False Alarm,String Matching Detection
In the monitoring and operation of controllers for device management, systems collect resource usage data and logs to detect early signs of anomalies, thereby ensuring stable service delivery. In log monitoring, anomaly detection is commonly performed by defining specific strings, such as error messages, as detection conditions and triggering alerts based on string matching.
However, when monitored strings are included in identifiers such as device names, the system may fail to distinguish the context, leading to false detections and erroneous alerts. Once false detections occur, operators must perform individual investigations, including log verification, root cause analysis, and evaluation of suppression settings. This process requires checking multiple pieces of information, increasing operational workload and reducing alert reliability, which may lead to overlooking critical alerts.
Although prior checking is effective for preventing false detections, manual verification is prone to oversight due to the wide range of targets.
To address this issue, this paper proposes a method to suppress false detections by checking conflicts between monitored strings and identifiers in advance, prior to adding or modifying monitoring configurations or identifiers, and by presenting information such as the presence and location of conflicts to the operator.
However, when monitored strings are included in identifiers such as device names, the system may fail to distinguish the context, leading to false detections and erroneous alerts. Once false detections occur, operators must perform individual investigations, including log verification, root cause analysis, and evaluation of suppression settings. This process requires checking multiple pieces of information, increasing operational workload and reducing alert reliability, which may lead to overlooking critical alerts.
Although prior checking is effective for preventing false detections, manual verification is prone to oversight due to the wide range of targets.
To address this issue, this paper proposes a method to suppress false detections by checking conflicts between monitored strings and identifiers in advance, prior to adding or modifying monitoring configurations or identifiers, and by presenting information such as the presence and location of conflicts to the operator.