  Prompt and accurate detection of system anomalies is essential to ensure the
reliability of software systems. Unlike manual efforts that exploit all
available run-time information, existing approaches usually leverage only a
single type of monitoring data (often logs or metrics) or fail to make
effective use of the joint information among multi-source data. Consequently,
many false predictions occur. To better understand the manifestations of system
anomalies, we conduct a comprehensive empirical study based on a large amount
of heterogeneous data, i.e., logs and metrics. Our study demonstrates that
system anomalies could manifest distinctly in different data types. Thus,
integrating heterogeneous data can help recover the complete picture of a
system's health status. In this context, we propose HADES, the first work to
effectively identify system anomalies based on heterogeneous data. Our approach
employs a hierarchical architecture to learn a global representation of the
system status by fusing log semantics and metric patterns. It captures
discriminative features and meaningful interactions from multi-modal data via a
novel cross-modal attention module, enabling accurate system anomaly detection.
We evaluate HADES extensively on large-scale simulated and industrial datasets.
The experimental results present the superiority of HADES in detecting system
anomalies on heterogeneous data. We release the code and the annotated dataset
for reproducibility and future research.
