  Software log analysis can be laborious and time consuming. Time and labeled
data are usually lacking in industrial settings. This paper studies
unsupervised and time efficient methods for anomaly detection. We study two
custom and two established models. The custom models are: an OOV
(Out-Of-Vocabulary) detector, which counts the terms in the test data that are
not present in the training data, and the Rarity Model (RM), which calculates a
rarity score for terms based on their infrequency. The established models are
KMeans and Isolation Forest. The models are evaluated on four public datasets
(BGL, Thunderbird, Hadoop, HDFS) with three different representation techniques
for the log messages (Words, character Trigrams, Parsed events). We used the
AUC-ROC metric for the evaluation. The results reveal discrepancies based on
the dataset and representation technique. Different configurations are advised
based on specific requirements. For speed, the OOV detector with word
representation is optimal. For accuracy, the OOV detector combined with trigram
representation yields the highest AUC-ROC (0.846). When dealing with unfiltered
data where training includes both normal and anomalous instances, the most
effective combination is the Isolation Forest with event representation,
achieving an AUC-ROC of 0.829.
