Home

logdag wiki

logdag generates causal DAGs among time-series events extracted from syslog data. It takes structured log events from amulog as input, infers a causal graph with a configurable causal-discovery method (PC or LiNGAM), and outputs it as a NetworkX DiGraph.

Getting Started

• Installation — requirements, install steps, and optional backends.
• Quick Start — an end-to-end run from an amulog database to a DAG.

User Guide

• Overview and Pipeline — what logdag does and the full feature-DB-to-DAG pipeline.
• Configuration — the logdag config file and how it relates to amulog.
• Generating DAGs — building the feature DB and running DAG estimation.
• Causal Discovery Methods — PC and LiNGAM (and their correlation variants) and how to select them.
• Data Sources — amulog log input, SNMP/RRD, and the feature-DB (evdb) backends.
• Viewing and Filtering DAGs — inspecting, filtering, and plotting results.

Reference

• CLI Commands — every subcommand of the four logdag command-line tools.
• Configuration Options — every config section and option with defaults.

Developer Documentation

• Architecture Overview — modules, responsibilities, data model, and data flow.
• Extending logdag — adding a causal-discovery method or a data source.