CLI Commands

CLI Commands

logdag exposes four command-line tools registered as console_scripts in setup.py:

Tool	Entry point	Scope
logdag	logdag.__main__:main	DAG generation, inspection, plotting
logdag.source	logdag.source.__main__:main	Feature-DB population (log events, SNMP/RRD)
logdag.eval	logdag.eval.__main__:main	Evaluation against labelled trouble tickets
logdag.visual	logdag.visual.__main__:main	Visual comparison and edge search across DAG sets

All four tools follow the same dispatch convention (from amulog.cli):

python -m logdag SUBCOMMAND [options] [positional-args]
python -m logdag SUBCOMMAND -h          # per-subcommand help

Or equivalently via the installed script name:

logdag SUBCOMMAND [options]
logdag.source SUBCOMMAND [options]
# etc.

Common options present on almost every subcommand:

Option	Short	Description
--config CONFIG	-c	Path to the logdag configuration file (default: None, uses amulog default search)
--debug		Set logging level to DEBUG (default: INFO)

---

logdag — DAG generation and inspection

Top-level help (python -m logdag -h):

usage: __main__.py SUBCOMMAND [options and arguments] ...

subcommands:
  dump-events: Output event node definition in readable format
  dump-input: Output causal analysis input in pandas csv format
  make-args: Initialize arguments for pc algorithm
  make-dag: Generate causal DAGs
  make-dag-stdin: make-dag interface for pipeline processing
  plot-dag: Generate causal DAG view
  plot-node-ts: Generate node time-series view
  show-args: Show arguments recorded in argument file
  show-deafult-config: Show configuration defaults
  show-edge: Show edges related to given conditions
  show-edge-list: Show all edges in a DAG
  show-full-config: Show virtual configuration considering defaults
  show-group-stats: Show stats classified by amulog tags
  show-list: Show abstracted results of DAG generation
  show-netsize: Show distribution of connected subgraphs in DAGs
  show-netsize-list: Show connected subgraphs in every DAG
  show-node-list: Show node definitions of the input
  show-node-ts: Show time-series of specified nodes in csv format
  show-stats: Show sum of nodes and edges
  show-stats-by-threshold: Show sum of edges by thresholds
  show-subgraphs: Show edges in each connected subgraphs
  update-event-label: Overwrite labels for log events

try "__main__.py SUBCOMMAND -h" to refer detailed subcommand usage
see also sub-libraries amulog.source amulog.eval amulog.visual

Generation commands (make-*)

make-args

Initialize (pre-compute and serialize) the argument set for all DAG jobs, without running the causal inference. Use this to inspect or verify the job partition before a full run.

usage: logdag make-args [-h] [-c CONFIG] [--debug]

Option	Description
-c CONFIG	Configuration file path
--debug	Debug logging

See Generating-DAGs for the job-splitting model (evdb_whole_term / unit_term / unit_diff).

---

make-dag

Generate causal DAGs for all jobs defined by the configuration. This is the main production command. Reads log-event features from the feature DB, runs the configured causal-inference algorithm, and writes DAG output files under <output_dir>/<area>_<date>/.

usage: logdag make-dag [-h] [-c CONFIG] [--debug] [-p PARALLEL]

Generate causal DAGs

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -p PARALLEL, --parallel PARALLEL
                        number of processes in parallel

The -p / --parallel option launches a multiprocessing.Pool; the default is 1 (sequential). See Generating-DAGs and Configuration-Options ([dag] section) for algorithm selection.

---

make-dag-stdin

Run the DAG generation pipeline for a single named job, identified by its task name. Intended for pipeline / queue-based dispatch (e.g. GNU Parallel, job schedulers).

usage: logdag make-dag-stdin [-h] [-c CONFIG] [--debug] TASKNAME

make-dag interface for pipeline processing

positional arguments:
  TASKNAME              argument name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

Dump commands (dump-*)

dump-input

Export the causal-inference input matrix for a specific job as a CSV file. The matrix rows are time bins and columns are event IDs. Useful for debugging or offline analysis.

usage: logdag dump-input [-h] [-c CONFIG] [--debug] [-o OUTPUT] [-b] TASKNAME

Output causal analysis input in pandas csv format

positional arguments:
  TASKNAME              argument name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o OUTPUT, --output OUTPUT
                        output filename (default: output)
  -b, --binary          dump binarized dataframe csv

---

dump-events

Print the event node definitions for a specific job in human-readable format. Each line shows eid <id>: <EventDefinition>. If no event map is cached, builds the input first.

usage: logdag dump-events [-h] [-c CONFIG] [--debug] TASKNAME

Output event node definition in readable format

positional arguments:
  TASKNAME              argument name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

Inspection commands (show-*)

show-args

Print the serialized argument set (all jobs) for the current configuration. Requires that make-args (or make-dag) has been run previously.

usage: logdag show-args [-h] [-c CONFIG] [--debug]

Show arguments recorded in argument file

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

show-edge

Show all edges in a specific DAG that match one or more conditions. Conditions use key=value syntax; valid keys are node, gid, host.

usage: logdag show-edge [-h] [-c CONFIG] [--debug] [--instruction] [-d]
                        [--nocache] TASKNAME CONDITION [CONDITION ...]

Show edges related to given conditions

positional arguments:
  TASKNAME              argument name
  CONDITION             Conditions to search edges.Example: MODE gid=24
                        host=host01 ..., Keys: node, gid, host.

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  --instruction         show event definition with source information
  -d, --detail          show event time-series samples
  --nocache             ignore existing cache

Example: logdag show-edge -c myconf.conf job_area1_20230101 gid=42

---

show-edge-list

Show all edges in a specific DAG (optionally filtered). A format option controls the level of detail.

usage: logdag show-edge-list [-h] [-c CONFIG] [--debug] [-t THRESHOLD]
                             [--instruction] [-d] [--nocache] [-f FILTERS]
                             TASKNAME

Show all edges in a DAG

positional arguments:
  TASKNAME              argument name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -t THRESHOLD, --threshold THRESHOLD
                        threshold for filter ate_prune
  --instruction         show event definition with source information
  -d, --detail          show event time-series samples
  --nocache             ignore existing cache
  -f FILTERS, --filter FILTERS
                        filters for dag stats or plots. see showdag_filter.py
                        for more detail

See Viewing-and-Filtering-DAGs for the list of available filter names.

---

show-subgraphs

Show edges grouped by connected subgraph (component). Useful for understanding the overall structure of a DAG.

usage: logdag show-subgraphs [-h] [-c CONFIG] [--debug] [-t THRESHOLD]
                              [--instruction] [-d] [--nocache] [-f FILTERS]
                              TASKNAME

Show edges in each connected subgraphs

positional arguments:
  TASKNAME              argument name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -t THRESHOLD, --threshold THRESHOLD
                        threshold for filter ate_prune
  --instruction         show event definition with source information
  -d, --detail          show event time-series samples
  --nocache             ignore existing cache
  -f FILTERS, --filter FILTERS
                        filters for dag stats or plots. see showdag_filter.py
                        for more detail

---

show-list

Print a summary table of all generated DAGs (node count, edge count per job). Supports optional aggregation by a groupby metric.

usage: logdag show-list [-h] [-c CONFIG] [--debug] [-t THRESHOLD]
                        [--groupby GROUPBY]

Show abstracted results of DAG generation

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -t THRESHOLD, --threshold THRESHOLD
                        threshold for filter ate_prune
  --groupby GROUPBY     aggregate results by given metrics (like day, area)

---

show-node-list

Print all node (event) definitions for a specific job.

usage: logdag show-node-list [-h] [-c CONFIG] [--debug] TASKNAME

Show node definitions of the input

positional arguments:
  TASKNAME              argument name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

show-stats

Print aggregate statistics across all generated DAGs: total nodes, total edges, directed edges, undirected edges. With --xhost, adds cross-host edge counts.

usage: logdag show-stats [-h] [-c CONFIG] [--debug] [-r DATE DATE] [--xhost]

Show sum of nodes and edges

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -r DATE DATE, --range DATE DATE
                        datetime range, start and end in YY-MM-dd style. end
                        date is not included.(optional; use all data in
                        default)
  --xhost               show additional stats for edges across multiple hosts

---

show-stats-by-threshold

Show how the total edge count changes as the ate_prune threshold is swept from 0 to 1 in 0.1 steps.

usage: logdag show-stats-by-threshold [-h] [-c CONFIG] [--debug] [-r DATE DATE]

Show sum of edges by thresholds

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -r DATE DATE, --range DATE DATE
                        datetime range, start and end in YY-MM-dd style. end
                        date is not included.(optional; use all data in
                        default)

---

show-group-stats

Aggregate node, edge, and log-event counts by amulog event group tag across all DAGs.

usage: logdag show-group-stats [-h] [-c CONFIG] [--debug]

Show stats classified by amulog tags

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

show-node-ts

Print the time-series (one row per time bin) for specified node IDs in CSV format (via pandas to_csv).

usage: logdag show-node-ts [-h] [-c CONFIG] [--debug] TASKNAME NODE_IDs [NODE_IDs ...]

Show time-series of specified nodes in csv format

positional arguments:
  TASKNAME              argument name
  NODE_IDs              nodes to show

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

show-netsize

Show the distribution (histogram) of connected-component sizes across all DAGs.

usage: logdag show-netsize [-h] [-c CONFIG] [--debug]

Show distribution of connected subgraphs in DAGs

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

show-netsize-list

List the connected subgraph sizes for every DAG individually.

usage: logdag show-netsize-list [-h] [-c CONFIG] [--debug]

Show connected subgraphs in every DAG

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

show-full-config

Dump the effective configuration (defaults merged with user overrides) to stdout. Useful for understanding exactly what settings are active.

usage: logdag show-full-config [-h] [-c CONFIG] [--debug]

Show virtual configuration considering defaults

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

show-deafult-config

Note: The subcommand name contains a typo (deafult instead of default). This is the actual registered name in the current code (DICT_ARGSET key in logdag/__main__.py, line 587). Do not use show-default-config — it will not be recognized.

Print the built-in default configuration. No config file or other options are required.

usage: logdag show-deafult-config [-h]

Show configuration defaults

options:
  -h, --help  show this help message and exit

See Configuration-Options for the full annotated table of all options.

---

update-event-label

Refresh the event group labels stored in the event-definition map for a job by re-reading the group field from amulog. Run this if amulog group assignments have changed after the feature DB was built.

usage: logdag update-event-label [-h] [-c CONFIG] [--debug] TASKNAME

Overwrite labels for log events

positional arguments:
  TASKNAME              argument name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

Plot commands (plot-*)

plot-dag

Render the DAG for a specific job as a graph image (via NetworkX / matplotlib). Filters can be applied before rendering. Output path is printed to stdout.

usage: logdag plot-dag [-h] [-c CONFIG] [--debug] [-o OUTPUT] [-t THRESHOLD]
                       [-f FILTERS] TASKNAME

Generate causal DAG view

positional arguments:
  TASKNAME              argument name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o OUTPUT, --output OUTPUT
                        output filename (default: output)
  -t THRESHOLD, --threshold THRESHOLD
                        threshold for filter ate_prune
  -f FILTERS, --filter FILTERS
                        filters for dag stats or plots. see showdag_filter.py
                        for more detail

See Viewing-and-Filtering-DAGs for filter names.

---

plot-node-ts

Plot the time-series for specified node IDs and save the result as an image. Output path is printed to stdout.

usage: logdag plot-node-ts [-h] [-c CONFIG] [--debug] [-o OUTPUT]
                           TASKNAME NODE_IDs [NODE_IDs ...]

Generate node time-series view

positional arguments:
  TASKNAME              argument name
  NODE_IDs              nodes to show

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o OUTPUT, --output OUTPUT
                        output filename (default: output)

---

logdag.source — Feature DB population

Invocation: python -m logdag.source SUBCOMMAND [options]

Populates the event feature database from amulog log data or SNMP/RRD telemetry. Must be run before logdag make-dag.

Top-level help:

usage: __main__.py SUBCOMMAND [options and arguments] ...

subcommands:
  drop-features: Drop feature data (except original data) in feature DB
  make-evdb-log-all: Load log data from amulog and store features
  make-evdb-snmp: Load telemetry data from rrd and store features
  make-evdb-snmp-all: Load telemetry data from rrd and store features
  make-evdb-snmp-org: Load telemetry data from rrd and store
  make-evdb-snmp-tests: Store 1 feature from a specified source
  show-snmp-stats: Show event counts in telemetry features

Common options for this sub-tool:

Option	Short	Description
--config CONFIG	-c	Configuration file path
--debug		Debug logging
--org	-o	Also output the original (un-binarized) data to the feature DB
--dry	-d	Dry-run: do not write to DB
--parallel N	-p	Number of parallel workers (SNMP commands only)

make-evdb-log-all

Load all log events from amulog and store binned features in the feature DB for the whole configured time range (evdb_whole_term / evdb_unit_diff). This is the required prerequisite for logdag make-dag when using log input.

usage: logdag.source make-evdb-log-all [-h] [-c CONFIG] [--debug] [-o] [-d]

Load log data from amulog and store features

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o, --org             output original data to evdb
  -d, --dry             do not write down to db (dry-run)

See Generating-DAGs for the full pipeline context.

---

make-evdb-snmp-all

Load all SNMP/RRD telemetry features for the configured whole term and store them in the feature DB.

usage: logdag.source make-evdb-snmp-all [-h] [-c CONFIG] [--debug] [-o] [-d]
                                         [-p PARALLEL]

Load telemetry data from rrd and store features

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o, --org             output original data to evdb
  -d, --dry             do not write down to db (dry-run)
  -p PARALLEL, --parallel PARALLEL
                        parallel processing for calculating features

---

make-evdb-snmp

Load a single named SNMP feature and store it in the feature DB.

usage: logdag.source make-evdb-snmp [-h] [-c CONFIG] [--debug] [-o] [-d]
                                     [-p PARALLEL] FEATURE

Load telemetry data from rrd and store features

positional arguments:
  FEATURE               feature_name

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o, --org             output original data to evdb
  -d, --dry             do not write down to db (dry-run)
  -p PARALLEL, --parallel PARALLEL
                        parallel processing for calculating features

---

make-evdb-snmp-org

Load all SNMP/RRD source (raw) data and store it as original data in the feature DB, without computing derived features.

usage: logdag.source make-evdb-snmp-org [-h] [-c CONFIG] [--debug] [-o] [-d]
                                         [-p PARALLEL]

Load telemetry data from rrd and store

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o, --org             output original data to evdb
  -d, --dry             do not write down to db (dry-run)
  -p PARALLEL, --parallel PARALLEL
                        parallel processing for calculating features

---

make-evdb-snmp-tests

Store one SNMP feature filtered by specific tags, for testing purposes.

usage: logdag.source make-evdb-snmp-tests [-h] [-c CONFIG] [--debug] [-o] [-d]
                                           [-p PARALLEL] FEATURE TAG TAG

Store 1 feature from a specified source

positional arguments:
  FEATURE               feature_name
  TAG                   tags, like "host=host1" "key=key2"...

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o, --org             output original data to evdb
  -d, --dry             do not write down to db (dry-run)
  -p PARALLEL, --parallel PARALLEL
                        parallel processing for calculating features

---

show-snmp-stats

Print a summary table of SNMP event counts per measurement for the configured whole term.

usage: logdag.source show-snmp-stats [-h] [-c CONFIG] [--debug]

Show event counts in telemetry features

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)

---

drop-features

Delete computed feature data from the feature DB for the specified data sources. The --org flag extends the deletion to original (raw) data. Sources are named strings such as log or snmp.

usage: logdag.source drop-features [-h] [-c CONFIG] [--debug] [-o]
                                    DATA_SOURCES [DATA_SOURCES ...]

Drop feature data (except original data) in feature DB

positional arguments:
  DATA_SOURCES          source names (like log, snmp)

options:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        configuration file path for amulog
  --debug               set logging level to debug (default: info)
  -o, --org             output original data to evdb

---

logdag.eval — Evaluation against trouble tickets

Invocation: python -m logdag.eval SUBCOMMAND [options]

Compares generated DAGs against a database of labelled "trouble" (incident) tickets to evaluate detection quality.

Top-level help:

usage: __main__.py SUBCOMMAND [options and arguments] ...

subcommands:
  add-lids: Add messages to a trouble
  add-lids-stdin: Add messages to a trouble from stdin
  add-trouble: Add a new trouble definition
  label-trouble: Set label to a trouble
  list-group: List group information
  list-trouble: List all troubles
  list-trouble-label: Show corresponding label groups of tickets
  list-trouble-stat: List stats of messages in each troubles
  search-trouble: Search troubles with messages of specified features
  show-lids: Show all lids in the given trouble
  show-match: Show matching edges with a ticket
  show-match-all: Show matching edges with all tickets
  show-match-diff: Compare 2 configs with all tickets
  show-match-info: Show abstracted information of edges in all DAG
  show-trouble: Show all messages corresponding to the given trouble
  show-trouble-info: Show abstracted information for the trouble

Trouble-ticket management

Subcommand	Purpose
add-trouble DATE GROUP TITLE	Add a new trouble record
add-lids TID MESSAGE_IDS...	Associate log-message IDs (lids) with a ticket
add-lids-stdin TID	Same, reading lids from stdin (whitespace-separated integers)
label-trouble TID GROUP	Update the group label of a ticket
list-trouble	List all trouble records
list-group	Aggregate ticket and message counts by group
list-trouble-stat	Per-ticket statistics (message, gid, host, event, group counts; entropy)
list-trouble-label	Show the amulog group breakdown for each ticket
show-lids TID	Print the log-message IDs attached to a ticket
show-trouble TID	Print the log messages for a ticket (reads amulog DB)
show-trouble-info TID	Print host/template/group summary for a ticket
search-trouble CONDITION...	Search tickets by gid, host, or group (key=value syntax)

Matching DAG edges to tickets

Subcommand	Purpose
show-match TID	Show DAG edges that match the given ticket
show-match-all	Show matched edge counts for all tickets
show-match-diff CONFIG1 CONFIG2	Compare edge matches between two configurations
show-match-info	Aggregate match statistics (detection rate, average edges)

Options common to matching commands:

Option	Description
-r RULE / --rule	Matching rule: one of all, either, both, log-snmp (default: all)
-e COND / --edge-condition	Additional edge condition (currently xhost is supported)
--instruction	Show event definition with source information
-d / --detail	Show time-series samples
--nocache	Ignore edge label cache

---

logdag.visual — Visual comparison and edge search

Invocation: python -m logdag.visual SUBCOMMAND [options]

Advanced edge search, DAG comparison, and graph drawing utilities. These commands operate across multiple DAG sets or across time.

Top-level help:

usage: __main__.py SUBCOMMAND [options and arguments] ...

subcommands:
  draw-graph-common: Draw common edges of 2 DAG sets
  draw-graph-diff: Draw contrasting edges of 2 DAG sets
  search-gid: List DAGs with edges related to given gid
  search-similar-dag: Show similar DAG to the specified one
  show-clusters: Show clusters of DAGs
  show-dag-anomaly-score: Show anomaly score of DAGs
  show-diff-edges: Show all different edges of 2 edge sets
  show-diff-info: Show information of 2 edge sets
  show-edges-temporal-sort: Show sorted edges with difference from given time
  show-graph-common-edges: List number of edges in common graph
  show-graph-diff-direction: List edge direction differences
  show-graph-diff-lts: List ltids found in diff graph of 2 DAG sets
  show-graph-diff-search: Search diff graphs with given gid
  show-graph-lor-edges: List number of edges in lor graph
  show-major-edges: Show major edges in all data
  show-minor-edges: Show minor edges in all data

Edge search commands

Subcommand	Purpose
search-gid GID	List all DAGs containing edges related to the given amulog template group ID
show-minor-edges TASKNAME [CONDITION...]	Show edges ranked by rarity (lowest TF-IDF / count first)
show-major-edges TASKNAME [CONDITION...]	Show edges ranked by frequency (highest first)
show-edges-temporal-sort TASKNAME TIMESTR [CONDITION...]	Show edges sorted by temporal distance from a given time point
show-dag-anomaly-score	Score each DAG by how anomalous its edge set is
search-similar-dag TASKNAME	Find DAGs most similar to the specified one
show-clusters	Cluster all DAGs and show representative edges per cluster

Options for edge-search commands:

Option	Description
--feature	Edge representation: node, edge, or tfidf (default: edge)
--score	Scoring metric: tfidf, idf, or count (default: tfidf)
-t THRESHOLD	Threshold for ate_prune filter
-f FILTERS	One or more filter names (repeatable)
--instruction	Show source information per event
-d / --detail	Show time-series samples
--nocache	Ignore edge label cache
--reverse	Reverse sort order
--order	Output in DAG order rather than sorted by score

For show-edges-temporal-sort, the time string format is YYYYMMDD or YYYYMMDD_HHMMSS. Use --range TIMESTR_END to specify a range.

DAG comparison commands (two-config)

These commands take two config file paths as positional arguments (CONFIG CONFIG) to compare two parallel DAG sets:

Subcommand	Purpose
draw-graph-common CONFIG1 CONFIG2 TIMESTR	Draw edges common to both DAG sets at the given time
draw-graph-diff CONFIG1 CONFIG2 TIMESTR	Draw edges present in one set but not the other
show-diff-info CONFIG1 CONFIG2	Summary of logical-OR, common, and diff edge counts
show-diff-edges CONFIG1 CONFIG2	List all differing edges with directionality
show-graph-common-edges CONFIG1 CONFIG2	Count common edges per time period
show-graph-lor-edges CONFIG1 CONFIG2	Count logical-OR edges per time period
show-graph-diff-lts CONFIG1 CONFIG2	List amulog template IDs most often in diff edges
show-graph-diff-search CONFIG1 CONFIG2 GID	Search diff edges involving a specific template
show-graph-diff-direction CONFIG1 CONFIG2	Report edges where direction differs between the two sets

For drawing commands, the output file path is set with -f FILENAME / --filename (default: output).

---

Common option reference

The following options recur across multiple subcommands and tools:

Option	Short	Default	Applicable to
--config CONFIG	-c	None	Most subcommands
--debug		False	Most subcommands
--parallel N	-p	1	make-dag, SNMP source commands
--output FILE	-o	output	dump-input, plot-dag, plot-node-ts
--threshold THRESH	-t	None	show-*, plot-dag
--filter FILTER	-f	None (repeatable)	show-edge-list, show-subgraphs, plot-dag, visual commands
--range DATE DATE	-r	None	show-stats, show-stats-by-threshold
--groupby METRIC		None	show-list
--instruction		False	Edge display commands
--detail	-d	False	Edge display commands
--nocache		False	Edge display commands
--xhost		False	show-stats

---

Notes on the SUBLIB dispatch

When logdag is invoked, the SUBLIB list ["source", "eval", "visual"] is passed to amulog.cli.main. This means logdag itself also recognizes sub-library dispatch through amulog.source, amulog.eval, and amulog.visual as forwarding aliases — but the preferred direct invocations are python -m logdag.source, python -m logdag.eval, and python -m logdag.visual.

---

Related pages: Configuration-Options | Generating-DAGs | Viewing-and-Filtering-DAGs