Horus is a system that collects, organizes and enables the refinement of distributed system logs in a causally-consistent and scalable fashion. Horus leverages kernel-level probing to capture events for tracking causality between application-level logs from multiple sources. The events are then encoded as a directed acyclic graph and stored in a graph database, thus allowing the use of rich query languages to reason about runtime behavior.
Horus comprises a variety of software parts. We split the entire system in the following repositories:
Collection of Java serializers to forward events from Java applications to the Horus processor. The serializers follow a FlatBuffers specification, which is placed in Horus Tracer repository.
This repository is a custom Log4j Appender that forwards Log4j logs to Horus pipeline. This makes Java applications capable of storing log entries in Horus.
The eBPF tracer used in Horus collects low level events related to socket communications and processes lifecycle. It is based on the state-of-the-art Falcon's tracer.
This is the processing module of the Horus pipeline. Combines both processors of intra- and inter-process causal relationships.
This repository contains a Docker deployment configuration of the entire Horus pipeline.
This repository is a Neo4j plugin that includes procedures to perform efficient causal queries on causal graphs generated by Horus.
This repository contains a set of synthetic benchmarks to evaluate scalability of Horus software parts.