Skip to content

Installation

Jump to bottom
sat edited this page Jul 15, 2026 · 1 revision

Installation

logdag requires Python 3.8–3.14 and depends on two sibling packages — amulog and pcalg — that must be installed alongside it.

Prerequisites

Requirement Notes
Python 3.8–3.14
amulog ≥ 0.5.0 Log templating and event DB
pcalg ≥ 0.1.9 PC algorithm implementation
gsq ≥ 0.1.6 G-squared independence test
numpy, scipy, pandas, scikit-learn Core numeric stack
networkx ≥ 2.1 Graph representation
lingam LiNGAM causal-discovery method
statsmodels Statistical utilities
python-dateutil Date parsing

All of the above are declared in requirements.txt and installed automatically by pip.

amulog — input-layer dependency

logdag reads log event data from an amulog database. You need a working amulog installation (and a populated amulog DB) before you can run a full logdag analysis. Install amulog from source or PyPI before installing logdag:

pip install amulog
# — or from source —
git clone https://github.com/amulog/amulog.git
cd amulog
pip install -e .

Refer to the amulog documentation for how to build a log database from raw syslog files.

Installing logdag

From PyPI

pip install logdag

From source (editable / development install)

git clone https://github.com/amulog/logdag.git
cd logdag
pip install -e .

The editable install is recommended for development: changes to the source tree take effect immediately without reinstalling.

Verify the installation

$ python -m logdag -h
usage: __main__.py SUBCOMMAND [options and arguments] ...

subcommands:
  dump-events: Output event node definition in readable format
  dump-input: Output causal analysis input in pandas csv format
  make-args: Initialize arguments for pc algorithm
  make-dag: Generate causal DAGs
  make-dag-stdin: make-dag interface for pipeline processing
  plot-dag: Generate causal DAG view
  plot-node-ts: Generate node time-series view
  show-args: Show arguments recorded in argument file
  show-deafult-config: Show configuration defaults
  show-edge: Show edges related to given conditions
  show-edge-list: Show all edges in a DAG
  show-full-config: Show virtual configuration considering defaults
  show-group-stats: Show stats classified by amulog tags
  show-list: Show abstracted results of DAG generation
  show-netsize: Show distribution of connected subgraphs in DAGs
  show-netsize-list: Show connected subgraphs in every DAG
  show-node-list: Show node definitions of the input
  show-node-ts: Show time-series of specified nodes in csv format
  show-stats: Show sum of nodes and edges
  show-stats-by-threshold: Show sum of edges by thresholds
  show-subgraphs: Show edges in each connected subgraphs
  update-event-label: Overwrite labels for log events

try "__main__.py SUBCOMMAND -h" to refer detailed subcommand usage
see also sub-libraries amulog.source amulog.eval amulog.visual

(The output above is the real output of python -m logdag -h from logdag 0.3.1.)

Optional extras

InfluxDB v1 backend

If you want to store time-series features in InfluxDB v1 (or an InfluxDB v2 server via its v1 compatibility API), install the optional extra:

pip install -e .[influx]
# or: pip install logdag[influx]

This adds the influxdb Python client. The InfluxDB v3 backend (influx3) requires no extra package — it communicates with the v3 HTTP API using the Python standard library (urllib).

The default backend (evdb = sql in the config) uses SQLite3, which is part of the Python standard library and needs no extra installation.

Test data (Hawkes processes)

The vendored logdag.causaltestdata module provides synthetic causal time series for testing. Most variable types depend only on numpy/scipy/pandas (already required). If you need HawkesEventVariable, install the optional Hawkes package:

pip install -e .[testdata]
# or: pip install logdag[testdata]

pcalg dependency

pcalg provides the PC algorithm used by the default causal-discovery method. It is declared in requirements.txt and installed automatically. If you need to install it separately:

pip install pcalg
# — or from source —
git clone https://github.com/cpflat/pcalg.git
cd pcalg
pip install -e .

Next steps

  • Quick-Start — walk through a minimal end-to-end analysis on sample SSH log data.
  • Configuration — understand the logdag config file and how it references the amulog config.
  • Overview and Pipeline — the full three-phase pipeline from log events to causal DAG.

Clone this wiki locally