Log Entries Research Articles

Logformer: Cascaded Transformer for System Log Anomaly Detection

Modern large-scale enterprise systems produce large volumes of logs that record detailed system runtime status and key events at key points. These logs are valuable for analyzing performance issues and understanding the status of the system. Anomaly detection plays an important role in service management and system maintenance, and guarantees the reliability and security of online systems. Logs are universal semi-structured data, which causes difficulties for traditional manual detection and pattern-matching algorithms. While some deep learning algorithms utilize neural networks to detect anomalies, these approaches have an over-reliance on manually designed features, resulting in the effectiveness of anomaly detection depending on the quality of the features. At the same time, the aforementioned methods ignore the underlying contextual information present in adjacent log entries. We propose a novel model called Logformer with two cascaded transformer-based heads to capture latent contextual information from adjacent log entries, and leverage pre-trained embeddings based on logs to improve the representation of the embedding space. The proposed model achieves comparable results on HDFS and BGL datasets in terms of metric accuracy, recall and F1-score. Moreover, the consistent rise in F1-score proves that the representation of the embedding space with pre-trained embeddings is closer to the semantic information of the log.

The President Will See Whom Now? Presidential Engagement with Organized Interests

Though presidents often criticize organized interests, presidents also expend considerable effort engaging them. Using original elite interviews, a survey of lobbyists, and administrative data, I consider how this engagement manifests, why presidents engage interests, and with which interests presidents engage. Unlike in other institutions, presidents exercise substantial control over engagement with interests, and they engage to mobilize interests’ institutional resources in service of their goals. To optimize mobilization, presidents focus engagement on well-resourced interests and interests who share presidents’ preferences. Pairing over seven million White House visitor log entries from two administrations with lobbying and campaign finance records, I demonstrate that presidential engagement is informed by interests’ electoral and policy resources and partisan alignment, though these characteristics’ substantive effects are modest. My findings highlight coalition building with interests as an underappreciated source of presidential power and elucidate the degree to which presidents amplify the political voice of well-resourced and copartisan interests.

Self-access Strategy Instruction for Academic Writing Vocabulary: What Learners Actually Do

Abstract This paper describes a close-up investigation of four advanced language learners’ engagement with strategy instruction (SI) materials specially designed to enhance efforts to fine-tune comprehension and production of academic vocabulary. The learners first completed a measure of learning style, and then provided introspective and retrospective verbal report data and log entries during and after each interactive session with the SI materials over an eight-week period. The results showed that the learners’ engagement in these sessions heightened their awareness of strategies for fine-tuning their comprehension and production of vocabulary. Issues also arose during their efforts at vocabulary fine-tuning—such as their doubting the results, their experiencing fatigue, and their perceived failure to strategize effectively. The study provided a look at the complex interplay of variables when the learners were attempting to extract insights from the SI materials. In particular, the data illustrated how style preferences related to the selection of strategies in academic writing. The implications for individualized approaches to the implementation of SI and for teachers’ support of L2 learners’ strategic performance are discussed.

Web Personalized Recommendation Model Using Temporal Fuzzy Association Rule Mining

Abstract: A web access log file contains timely sequenced log entries which include essential fields to indicate user activities. Analysis of these patterns provides valuable information for web designer to quickly respond to their individual needs. Many industries are struggling to retain regular interested customers for the improvement of customer relationship. Retrieval of relevant information automatically from these log files for interested group of users is a difficult process, since acquiring interested user profiles which evolves continuously with respect to time are not so easy. The paper presents a novel Web Personalized Recommendation Model (WPRM) using temporal fuzzy association rule mining technique. Temporal Fuzzy Association Rule Mining (FTARM) technique is proposed and applied on a focused set of interested users to provide intelligent recommendations. The proposed model results in less execution time and reduced memory utilization with high accuracy.

Attack detection and mitigation using optimal deep maxout network in cloud computing

SummaryCloud computing is a promising technique and the majority of information technology based services function in this infrastructure, which addresses the need of today's data center. There involve privacy and security problems in the cloud, which affected the utility of the cloud. Various mitigation solutions are developed in existing, in which the attacks continue to elevate in frequency and severity. This calls for a model for addressing the needs of challenging security threats. This article devises novel attack detection and mitigation technology using an optimization‐driven deep learning model. Here, the system comprises five modules, like data, data owner, cloud server, cloud user, and thin provision virtual volume. Here, each entity performs its own operations. The proposed technique includes five stages, namely, authentication phase, data sharing and communication phase, recorded log file creation phase, attack detection phase, and attack mitigation phase. An initial phase is the authentication phase where an authentication protocol is modeled using different mathematical functionalities. Once the authentication is done, the data sharing and communication are initiated for sharing the sensitive data. Thereafter the log file creation phase is initiated for storing the log entries. Then the attack detection is performed utilizing deep maxout network that is tuned by the developed gray wolf political optimizer (GWPO). The GWPO is the integration of gray wolf optimizer (GWO) and political optimizer (PO). Finally, attack mitigation is performed by reducing the data rates of attack nodes. The developed GWPO‐enabled deep maxout network provided improved performance with the highest accuracy of 97.9%, true positive rate of 97.3%, and true negative rate of 97.7%.

A Novel Dictionary-Based Method to Compress Log Files with Different Message Frequency Distributions

In the present day, virtually every application software generates large amounts of log entries during its work. The log files that are made from these entries are a collection of information about what happened while the program was running. This report can be used for multiple purposes such as performance monitoring, maintaining security, or improving business decision making. Log entries are usually generated in a disorganized manner. Using template miners, the different ‘event types’ can be distinguished (each log entry is an event), and the set of all entries is split into disjointed subsets according to the event types. These events consist of two parts. The first is the constant part, which is the same for all occurrences of the same event type. The second is the parameter part, which can be different for each occurrence. Since software mass-produces log files, in our previous paper, we introduced an algorithm that uses the templates mined from the data to create a dictionary, which is then used to encode the log entries, so only the ID and the parameter list would be stored. In this paper, we enhance our algorithm with the use of the frequency of the templates, by encoding the parameters and also making use of Huffman coding. With the use of these measures, compared to the previous 67.4% compression rate, a 94.98% compression rate can be achieved (where compression rate is 1 minus the ratio of the size of the compressed file to the uncompressed size). The running times of the different measures that we used to enhance our algorithm are also compared. We also analyze the difference between the compression rate of the enhanced algorithm and general compressors such as LZMA, Bzip2, and PPMd. We examine whether the size of the log files can be further decreased with the combined use of our enhanced method and the general compressors. We also generate log files that follow different distributions to examine the compression capability if the distribution does not follow the power law. Based on our experiments, we would recommend the use of the MoLFI (Multi-objective Log message Format Identification) template miner method with our enhanced algorithm together with PPMd.

DeepSyslog: Deep Anomaly Detection on Syslog Using Sentence Embedding and Metadata

Anomaly events indicating the unhealthy status of the computer system are recorded in the system log (Syslog). Therefore, Syslog-based anomaly event detection is crucial for diagnosing system issues and problems. However, existing log-based anomaly detection approaches use raw and unstructured log entries <i>independently</i> and <i>incompletely</i>, i.e., without considering the context of each event and event metadata in the logs. They employ incomplete representation of unstructured log data, limiting the deep learning model&#x2019;s capacity in the early stage, which tends to omit anomaly events and cause false alarms. In this work, we propose DeepSyslog, which represents Syslog with the context of log events and event metadata in the logs. Inspired by the sequence nature of the log stream, we employ unsupervised sentence embedding to extract the semantic and context information hidden in the log stream, rather than word embedding or one-hot embedding, which only capture the similarities between log words. The sentence embedding is further integrated with event metadata to form complete representations of Syslog, which can distinguish the anomaly caused by the correlated log entries and exceptional event metadata in the log. The simulation results on widely used log datasets show that DeepSyslog achieves high performance compared with the existing log-based anomaly event detection approaches.

Using Sport Education to Teach Wushu, a Form of Chinese Martial Arts

This study examined the veracity of the commonly held notion that ‘there is only one way to teach Chinese martial arts.’ To achieve this, a cohort of Chinese physical education majors and their teacher participated in a semester-long season of Wushu taught using Sport Education (SE). Data were collected from the teacher in the form of weekly logs and interviews and students participated in small-group interviews throughout the program. Student grades were also analyzed. Student and teacher generated data were analyzed using analytic induction and constant comparison techniques. There was a high consistency among teacher’s log entries, her interviews, and comments made by students during interviews. Nevertheless, one topic that occupied significant discussion in the final interview was the teacher’s sense of professional renewal as a result of the SE project. Analysis of student interviews generated six themes, most which reflected student responses about SE (e.g., teams, competition, roles) but which also expressed a preference for the instructional climate of classes. Further, participation during the season did not compromise knowledge or skill performance of these students. Rather, SE led to higher levels of enthusiasm and engagement than in students’ previous martial arts courses.

RISK FACTORS AND OUTCOMES OF NEW ONSET ARRHYTHMIA IN SURGICAL INTENSIVE CARE UNIT: A RETROSPECTIVE STUDY

Objective: To assess the frequency of new-onset cardiac arrhythmias among patients admitted in surgical intensive care unit as well as associated risk factors.&#x0D; Study Design: Retrospective observational study.&#x0D; Place and Duration of Study: Surgical Intensive Care Unit, Aga Khan University Hospital, Karachi, from Jan 2018 to Dec 2019.&#x0D; Methodology: The medical record numbers of all patients admitted in surgical intensive care unit were obtained from Surgical intensive care unit case log entries and reviewed. Patients` and healthcare providers` identification were kept confidential. Data was analyzed using SPSS version 19.&#x0D; Results: Only 13/1076 patients included in the study had cardiac arrhythmias during their stay in Surgical intensive care unit. Among all patients with arrhythmias (n=13), atrial fibrillation was the most common type of arrhythmia 7 (53.8%). The study found higher occurrence of arrhythmias among the patients in the age category of 66 years or above 8 (4.6%) and when compared to younger patients with age categories 18-40 years 2 (0.3%) and 41-65 years 3 (0.3%) respectively (p-value&lt;0.05). Similarly, arrhythmias were higher among patients who had relatively prolong intensive care unit stay and post-operative status as the primary cause of intensive care unit admission.&#x0D; Conclusion: Occurrence of cardiac arrhythmias is relatively low among patients admitted to surgical intensive care patient population. Patients age (&gt;65 years), prolong intensive care unit stay, post-operative status are positively associated with development of cardiac arrhythmias among critically ill patients admitted in surgical intensive care unit.

Anomaly detection in a forensic timeline with deep autoencoders

An investigator needs to analyze a forensic timeline after a cybersecurity incident has occurred. Log entries from various sources are used to generate a forensic timeline. Finding the anomalous activities recorded in these log records is a difficult task if manual inspection or keyword searches are used. In this work, we propose a method for identifying anomalies in a forensic timeline. We use deep autoencoders as a machine learning technique to establish a baseline for normal activities in log files. Furthermore, we set an anomaly threshold of reconstruction value based on the constructed baseline. We then plot these anomalous events on a forensic timeline. Our experiments indicate that the proposed method achieves superior performance compared to other log anomaly detection methods with overall mean F1 score and accuracy of 94.036% and 96.720%, respectively.

Domain adaptation for Windows advanced persistent threat detection

Like many cyber security domains, data availability influences many active decisions and research trajectories in the advanced persistent threat (APT) landscape. Current solutions relying on many temporal constrains have limited generalization for new threats. In this paper, these two challenges are addressed, whereby we introduce domain adaptation to broaden the availability of data to improve APT detection while determining the relevance of separating samples based on their reported use. With the ability to introduce new data, namely in the APT-Executable (APT-EXE) dataset, we propose a new method to adapt over 4500 APT malware log samples to our target domain and achieve superior detection performance. A combination of transductive and inductive adaptation is applied by adapting the distribution of APT file system interaction. Adaptation is applied to retrieve system driven access and usage structure and functionality interaction footprints. The aligned distribution of log entries is projected within a Riemannian manifold. A weighted geodesics distance between APT samples and unseen log entries is measured, and APT driven Bayes net (APT-BN) is probed for queries for respective techniques respectively for adaptation and footprint methods. The proposed method is evaluated on 183 different Windows APT samples for 207 processes from 20 documented APT campaigns 2018 and onward. Comparisons are made based on the proposed method, multiple state-of-the-art log embedding techniques, and established text processing techniques. The proposed method outperforms all techniques in reducing false positives to less than 100 in 100,000 processes and a true positive rate of 0.80%. Thus, domain adaptation methods are promising to mitigate the challenges of detecting APTs.

Risk assessment methodology for information systems, based on the user behavior and IT-security incidents analysis

Obtaining trustworthy estimates for the reliability and security of corporate information systems is an urgent problem. It is not enough just to have estimations for security of software and hardware components. Constant monitoring of a user’s actions and a comprehensive analysis of his (her) behavior in the system are necessary. The novelty of the proposed approach consists in application of psychological profiling methods, models of neuro-fuzzy inference and mechanisms of multidimensional data analysis. Vulnerabilities of computer information systems are determined on the basis of a retrospective analysis of information security incidents. The user’s profile is based on the analysis of his (her) behavior. The patterns of this behavior in a particular computer information system are determined. The work studies the influence of intentional and unintentional user behavior on the probability of information security threats and identifies the threshold values of the number and frequency of the events indicating an information security incident. Such data helped to build a model to search for an intruder during an information security incident. The proposed method was tested in the MatLab software package. The experimental calculations of potential vulnerabilities were performed in the “1C: Enterprise 8.3” system of programs. As the initial data for the calculation, we used the log entries of the actions of more than 100 users with different roles for a period of one year. It is noted that the risk management policy should include a continuous analysis of user actions, as well as the consequences of these actions, in order to identify the goals of such behavior and prevent information security incidents. It is shown that when implementing the proposed methodology, it is necessary to constantly identify users who should not have access to sensitive information from the inside, assuming that a current violator is located within the boundaries of a computer information network. The application of the proposed methodology allows us to increase the level of information security with a constant change in the “working environment” of the information system. It will help to significantly simplify the process of making an objective and reasonable management decision about the most likely implementation of information security incidents. This allows one to take appropriate preventive measures in advance.

ÎNVĂŢAREA COLABORATIVĂ ÎN CADRUL UNEI CERCETĂRI ACŢIUNE DEZVOLTATĂ PENTRU A RĂSPUNDE PROVOCĂRILOR IMPUSE DE ŞCOALA ONLINE

The measures put in place to stop the spread of the Covid-19 have had a major impact on the organization of educational processes. School teachers have been faced with overnight digitalization of their activities without always receiving adequate support with this transition. The present paper reports on a participatory action research project in the form of a tutoring program that sought to understand and respond to these challenges. The project took the form of an open learning initiative addressed to teachers in April – June 2020, followed by a data collection and analysis phase. 37 teachers in four Romanian counties benefited from personalized forms of support offered by 20 student- tutors enrolled in the Educational Sciences Department at the West University in Timişoara. All project activities were carried out at a distance, in the vast majority of cases, online. In analyzing the data produced by the project (tutor reflection log entries, qualitative interviews and focus groups with teachers and tutor students) we seek to answer the following research question: How did a collaborative learning process emerge as part of a participatory action research project carried out during the onset of online teaching and learning practices?. The collaborative learning responded to teachers’ immediate and individual needs regarding the development of digital competences, as well as related to pedagogical and emotional support. Through the tutoring program, the expected roles of the educational actors were reversed: since the undergraduate students were not primarily beneficiaries of the educational processes, but took on an active part as facilitators of the teachers’ learning processes. Thus, a competence transfer from the university to the pre- university environment took place, at a faster rate than it would usually happen.

A semantic-aware log generation method for network activities

Context-aware network logging is becoming more prevalent for enterprise networks, data centers, and forensics. Monitoring agents are strategically placed to generate log files from the activity of interests from various network points. In a distributed architecture, these agents are scattered across multiple nodes, and they have limited network visibility. Consequently, the resulting logs become fragmented and less perceptible without a unified network context. Besides, aggregating useful information from a diverse management protocol with various languages, syntax styles, and notations requires complex semantic understanding to synthesize these log files. Currently, general-purpose logs like SNMP's logs only provide parametric values at connection levels but lacks incident-specific information. Meanwhile, proprietary services like AWS CloudTrail identify more contexts at the incident-level, but they only work on selected products and infrastructure. This paper proposed a platform-agnostic log decoding and generation algorithm (SAG) for network logging that is semantic aware using context aggregation. Firstly, a protocol-agnostic controller acts as a master to collect logs from agents running in routers, firewall, IDS/IPS, load balancers, managed switches, and servers. From these logs, three traffic models, namely (1) service-activity model (SaM), (2) general-activity model (GaM), and (3) device-activity model (DaM), are trained using artificial neural network (ANN). The log generator then uses the context-filling technique to resolve and construct log entries using a generic sentence template while inferring from these machine-learning models. A sentence smoothing technique is designed to restructure entities in the logs based on traffic directionality for semantic correctness. The experimental result shows that SAG's logs have 1.8 times more contexts resolved for improved log's perceptibility.

Investigating learner engagement in strategy instruction focused on vocabulary for academic writing: A case study

This paper describes a close-up investigation of one advanced language learner’s interaction with strategy instruction (SI) materials specially designed to enhance efforts to fine-tune comprehension of academic writing vocabulary. The learner provided introspective and retrospective verbal report data, log entries, and completed a measure of learning style. The results showed that engaging in eight SI sessions heightened the learner’s awareness of (1) the benefits of being strategic in accessing available resources to assist her in fine-tuning academic vocabulary, (2) the moment-by-moment fluctuation of strategy functions (i.e., metacognitive, cognitive, social, affective), and (3) how her learning style preferences came into play when using selected strategies.In particular, the data underscored the value of the practical suggestions and tips provided by SI materials for enhancing her ability to plan and reflect on strategy use. The data also revealed that her awareness of both style-matching and style-stretching informed her selection and use of strategies. The implications for individualized approaches to the implementation of SI are discussed.

WLAN-log-based superspreader detection in the COVID-19 pandemic

Identifying “superspreaders” of disease is a pressing concern for society during pandemics such as COVID-19. Superspreaders represent a group of people who have much more social contacts than others. The widespread deployment of WLAN infrastructure enables non-invasive contact tracing via people’s ubiquitous mobile devices. This technology offers promise for detecting superspreaders. In this paper, we propose a general framework for WLAN-log-based superspreader detection. In our framework, we first use WLAN logs to construct contact graphs by jointly considering human symmetric and asymmetric interactions. Next, we adopt three vertex centrality measurements over the contact graphs to generate three groups of superspreader candidates. Finally, we leverage SEIR simulation to determine groups of superspreaders among these candidates, who are the most critical individuals for the spread of disease based on the simulation results. We have implemented our framework and evaluate it over a WLAN dataset with 41 million log entries from a large-scale university. Our evaluation shows superspreaders exist on university campuses. They change over the first few weeks of a semester, but stabilize throughout the rest of the term. The data also demonstrate that both symmetric and asymmetric contact tracing can discover superspreaders, but the latter performs better with daily contact graphs. Further, the evaluation shows no consistent differences among three vertex centrality measures for long-term (i.e., weekly) contact graphs, which necessitates the inclusion of SEIR simulation in our framework. We believe our proposed framework and these results can provide timely guidance for public health administrators regarding effective testing, intervention, and vaccination policies.

Exploring teacher awareness of intuition and how it affects classroom practices: conceptual and pragmatic dimensions

ABSTRACT This study explores teachers’ awareness of intuition, and how that awareness affects their classroom practices both conceptually and pragmatically. Scholars have long supported the notion that intuition is a crucial form of knowing that supports teaching. Teachers rely heavily on their intuition to deal with complex classroom situations, especially those that require on-the-spot problem solving, decision-making, and creativity. Yet, how they do so has rarely been the topic of empirical investigation. In this study, qualitative data were gathered from two groups of in-service teachers (17 in total) while they participated in a professional development programme designed to improve their awareness of intuitions through meditative and embodied exercises. Reflection log entries revealed that teachers’ awareness of intuitions includes preparing for, sensing, and considering intuitive signals. Furthermore, participants perceived increased awareness of intuitions as well as perceived positive effects on individual pupils, groups of pupils, and on themselves. This study reveals teacher experiences in their journey to becoming aware of their intuition, developing it, and putting it to use in the classroom. Recommendations are given for further inquiry into the crucial teacher quality of intuition.

Perceived benefits of brief acupuncture for sleep disturbances in postdeployment military service members.

The purpose of this study was to describe the perceived benefits of manual standardized stress acupuncture (MSSA) for sleep disturbances in service members with deployment exposure. This qualitative study was embedded in a 2-arm randomized controlled trial using mixed-methods research that evaluated the effect of weekly MSSA for 4 weeks as an adjunct treatment with abbreviated cognitive-behavioral therapy for insomnia (CBTi) for sleep disturbances in service members. Participants were randomized to either the experimental group (CBTi and MSSA) or the control group (CBTi only). The CBTi consisted of 1 group psychotherapy session for 60 minutes, follow-up telephone therapy for 30 minutes, and an additional four 30-minute follow-up sessions via telephone. Participants provided written journal entries by answering 5 open-ended questions about their treatment experiences at week 5 during the posttreatment assessment. Journal log entries were transcribed verbatim using the Dedoose software. A content analysis method was used to code emerging themes. Three overarching categories were found from the qualitative data: personal challenges in implementing the CBTi sleep strategies, no perception of improvement from treatment, and perceived benefits of treatment. The CBTi/MSSA group reported greater benefits in sleep and in other life areas including mental, physical, and social functioning using content analysis. Findings of this study showed greater improvements in participants' sleep, mood, physical health, and occupational and social functioning after receiving the combination of CBTi and MSSA. Future research that investigates the long-term effects of CBTi and MSSA may be beneficial among postdeployment service members. Registry: ClinicalTrials.gov; Name: Jane J. Abanes; URL: https://clinicaltrials.gov/ct2/show/NCT04031365; Identifier: NCT04031365. Abanes J, Ridner SH, Rhoten B. Perceived benefits of brief acupuncture for sleep disturbances in postdeployment military service members. J Clin Sleep Med. 2021;17(8):1533-1543.

Impact of COVID-19 on Physical Activity Among 10,000 Steps Members and Engagement With the Program in Australia: Prospective Study.

BackgroundPhysical activity is an important health behavior, due to its association with many physical and mental health conditions. During distressing events, such as the COVID-19 pandemic, there is a concern that physical activity levels may be negatively impacted. However, recent studies have shown inconsistent results. Additionally, there is a lack of studies in Australia on this topic.ObjectiveThe aim of this study is to investigate changes in physical activity reported through the 10,000 Steps program and changes in engagement with the program during the COVID-19 pandemic.MethodsData between January 1, 2018, and June 30, 2020, from registered members of the 10,000 Steps program, which included 3,548,825 days with step data, were used. The number of daily steps were logged manually by the members or synced automatically from their activity trackers connected to the program. Measures on program usage were the number of new registered members per day, the number of newly registered organizations per day, the number of steps logged per day, and the number of step entries per day. Key dates used for comparison were as follows: the first case with symptoms in Wuhan, China; the first case reported in Australia; the implementation of a 14-day ban for noncitizens arriving in Australia from China; the start of the lockdown in Australia; and the relaxing of restrictions by the Australian Government. Wilcoxon signed-rank tests were used to test for significant differences in number of steps between subgroups, between engagement measures in 2019 versus 2020, and before and after an event.ResultsA decrease in steps was observed after the first case in Australia was reported (1.5%; P=.02) and after the start of the lockdown (3.4%; P<.001). At the time that the relaxing of restrictions started, the steps had already recovered from the lockdown. Additionally, the trends were consistent across genders and age groups. New South Wales, Australian Capital Territory, and Victoria had the greatest step reductions, with decreases of 7.0% (P<.001), 6.2% (P=.02), and 4.7% (P<.001), respectively. During the lockdown, the use of the program increased steeply. On the peak day, there were more than 9000 step entries per day, with nearly 100 million steps logged per day; in addition, more than 450 new users and more than 15 new organizations registered per day, although the numbers decreased quickly when restrictions were relaxed. On average per day, there were about 55 new registered users (P<.001), 2 new organizations (P<.001), 25.6 million steps (P<.001), and 2672 log entries (P<.001) more in 2020 compared to the same period in 2019.ConclusionsThe pandemic has had negative effects on steps among Australians across age groups and genders. However, the effect was relatively small, with steps recovering quickly after the lockdown. There was a large increase in program usage during the pandemic, which might help minimize the health impact of the lockdown and confirms the important role of physical activity programs during times of distress and lockdowns.

Accurate and efficient follower log repair for Raft-replicated database systems

State machine replication has been widely used in modern cluster-based database systems. Most commonly deployed configurations adopt the Raft-like consensus protocol, which has a single strong leader which replicates the log to other followers. Since the followers can handle read requests and many real workloads are usually read-intensive, the recovery speed of a crashed follower may significantly impact on the throughput. Different from traditional database recovery, the recovering follower needs to repair its local log first. Original Raft protocol takes many network round trips to do log comparison between leader and the crashed follower. To reduce network round trips, an optimization method is to truncate the follower’s uncertain log entries behind the latest local commit point, and then to directly fetch all committed log entries from the leader in one round trip. However, if the commit point is not persisted, the recovering follower has to get the whole log from the leader. In this paper, we propose an accurate and efficient log repair (AELR) algorithm for follower recovery. AELR is more robust and resilient to follower failure, and it only needs one network round trip to fetch the least number of log entries for follower recovery. This approach is implemented in the open source database system OceanBase. We experimentally show that the system adopting AELR has a good performance in terms of recovery time.