Explanation
A random variable X follows a log-normal distribution if its natural logarithm ln(X) follows a normal distribution. This occurs naturally in processes where the outcome is the product of many independent random factors, just as the sum of factors leads to the normal distribution via the central limit theorem. The distribution is always positive and has a long right tail, which makes it suitable for modeling incomes, financial asset prices, repair times, particle sizes and task durations. Note: μ and σ are the parameters of ln(X), not of X directly. The mean of X is exp(μ + σ²/2) and its variance is [exp(σ²) − 1]·exp(2μ + σ²).
Formula
\( f(x;\mu,\sigma)=\frac{1}{x\sigma\sqrt{2\pi}}e^{-\frac{(\ln x-\mu)^2}{2\sigma^2}},\quad x>0 \)
Parameters
- μ (mu): mean of the natural logarithm of the variable. Can be any real number.
- σ (sigma): standard deviation of the natural logarithm. Must be σ > 0.
- x: positive value of the original variable (x > 0).
Worked example
Situation: The resolution time for incidents in a computer system (in minutes) follows a log-normal distribution with parameters \(\mu = 2\) and \(\sigma = 0.5\) (in natural logarithm). These parameters describe the behavior of the logarithm of the time, not the time directly.
Question 1: What is the probability that an incident is resolved in 10 minutes or less, \(P(X \leq 10)\)?
Solution: We standardize using the relation \(\ln(X) \sim \mathcal{N}(\mu, \sigma^2)\): \[ P(X \leq 10) = P\!\left(Z \leq \frac{\ln 10 - 2}{0.5}\right) = P\!\left(Z \leq \frac{2.3026 - 2}{0.5}\right) = P(Z \leq 0.605) \approx 0.727 \] There is approximately a 72.7% probability of resolving the incident in 10 minutes or less.
Question 2: What is the median resolution time?
Solution: The median of the log-normal is: \[ \text{median} = e^\mu = e^2 \approx 7.389 \text{ minutes} \] The median is 7.39 minutes. The arithmetic mean, on the other hand, is higher: \[ E[X] = e^{\mu + \sigma^2/2} = e^{2 + 0.125} = e^{2.125} \approx 8.37 \text{ minutes} \]
Interpretation: The median (7.39 min) is lower than the mean (8.37 min), which reflects the typical right skew of the log-normal: most incidents are resolved relatively quickly, but some drag on much longer and pull the mean up. To size a technical support team, it is preferable to use high percentiles (e.g., the 90th percentile) as a service-level target.