log analysis

Traditional security log analysis methods suffer from low efficiency, high false-positive rates, and poor interpretability. Method: This paper presents the first systematic meta-analysis of large language model (LLM)-driven log analysis, synthesizing insights from 127 state-of-the-art studies through bibliometric analysis, methodological comparison, and cross-modal representation evaluation. Contribution/Results: We propose the first holistic taxonomy framework for LLM-based log analysis; identify critical gaps—including insufficient log format robustness and lack of causal reasoning—and derive design principles for scalable, standardized evaluation benchmarks. We categorize six mainstream technical paradigms (e.g., fine-tuning, retrieval-augmented generation, in-context learning), distill four persistent bottlenecks, and outline seven concrete future research directions. Our work delivers a theoretical roadmap and practical guidelines for automated threat detection and interpretable log auditing.

To address the infeasibility of manual analysis for large-scale IT system logs, this paper proposes a lightweight log analysis framework leveraging large language models (LLMs). The method introduces a CPU-efficient inference mechanism that significantly improves LLM throughput on resource-constrained hardware without compromising semantic understanding fidelity. It integrates log parsing, contextual modeling, and fault-oriented semantic reasoning to enable end-to-end automated diagnosis. Deployed in production, the system supports 70 software products and has processed over 2,000 incident tickets. Empirical evaluation demonstrates an average monthly reduction of more than 300 human labor hours compared to conventional approaches—equivalent to approximately USD 15,444 in cost savings. The framework thus advances practical, scalable, and cost-effective LLM-based log analytics for real-world operational environments.

This work addresses the pervasive issue of redundant and isolated messages in system logs, which hinder downstream tasks such as model reasoning and anomaly detection. To tackle this challenge, the authors propose LogPurifier—the first task-agnostic log cleansing framework—that systematically purifies logs by extracting log templates and modeling their dependencies to accurately identify and remove messages irrelevant to system functional behavior. By doing so, LogPurifier enables effective log sanitization applicable across diverse analytical scenarios. Experimental results demonstrate that LogPurifier substantially improves both accuracy and efficiency in various downstream tasks, thereby validating its effectiveness and generalizability.

Addressing three key challenges in cross-system log anomaly detection—high labeling costs, dynamic log evolution, and poor generalization—this paper proposes CroSysLog, a log-event-level meta-learning framework. CroSysLog decouples pretraining on source systems from few-shot adaptation to target systems, integrating neural log representation (LSTM/Transformer), MAML-style meta-learning, and temporal-aware log segmentation. Evaluated on four large-scale supercomputing systems—BGL, Liberty, Thunderbird, and Spirit—the framework achieves efficient adaptation using only a handful of labeled log events per target system. Results show an average 12.7% improvement in F1-score over baseline methods, demonstrating substantially enhanced cross-system generalizability and practical deployability.

Existing log analysis models are task-specific, rely heavily on domain-specific annotated data, exhibit poor generalization, and struggle with complex or unseen instructions. Method: We propose LogLM, an instruction-driven large language model for log analysis, which unifies diverse log tasks—including anomaly detection, parsing, and summarization—into a standardized instruction-response format. LogLM is adapted to the log domain via multi-task instruction tuning and log-specific instruction engineering. It accepts natural-language instructions and supports zero-shot cross-task transfer. Contribution/Results: Experiments demonstrate that LogLM outperforms all state-of-the-art methods across five core log analysis tasks. It exhibits strong generalization to complex instructions and previously unseen tasks. As a single unified model, LogLM replaces multiple specialized models, significantly improving deployment efficiency and task-agnostic capability.

Low-quality log statements—such as ambiguous or misleading ones—obscure actual program behavior and impede software maintenance. Prior work primarily focuses on detecting single log defects and relies on manual fixes. This paper proposes LogFixer, the first automated two-stage framework targeting four real-world log defects: detection and repair. In the offline stage, a lightweight similarity classifier is trained on synthetically defective logs; in the online stage, problematic logs are identified via joint modeling of static textual features and dynamic variable contexts, and semantically appropriate repairs are recommended using large language models (LLMs). LogFixer innovatively integrates a lightweight classifier with LLMs in a synergistic paradigm, ensuring robust detection while enhancing repair validity. Evaluation shows an F1-score of 0.625; adoption rates of static and dynamic repair suggestions improve by 48.12% and 24.90%, respectively; repair suggestion adoption reaches 61.49% on unseen projects; and 40 fixes submitted to GitHub have yielded 25 merged confirmations.

This work addresses the lack of systematic evaluation benchmarks for large language models (LLMs) in security audit log investigation tasks by introducing AuditBench, the first audit log benchmark specifically designed for attack investigation. AuditBench encompasses over 50 real-world scenarios across Linux and Windows systems and focuses on four core tasks: alert classification, persistence mechanism identification, among others. Through multidimensional experiments, the study systematically evaluates the impact of model scale, log representation, prompt design, and fine-tuning strategies on performance and error patterns, while also analyzing the quality of LLM-generated explanations. The findings reveal the capability boundaries and characteristic failure modes of various models across different investigative tasks, providing empirical foundations for deploying and optimizing LLMs in security operations.

This work addresses the challenges of root cause diagnosis in large-scale microservice systems, where existing approaches are hindered by massive log volumes, limited LLM context windows, and insufficient semantic reasoning and interpretability. The authors propose a neuro-symbolic hybrid method that emulates Site Reliability Engineers’ manual troubleshooting process through a six-stage pipeline for log sampling, template clustering, and anomaly ranking, producing a concise evidence package for LLM-based root cause inference. This approach compresses raw logs by 1,000–7,000× while preserving critical failure signals and provides auditable log templates and statistical evidence, substantially enhancing interpretability and practicality. Evaluated on 11 real-world incidents, the method achieves an MRR of 0.790 and ranks the correct root cause within the top three candidates in over 90% of cases within one minute, earning strong endorsement from operations teams.

This work addresses the challenge of inefficient anomaly diagnosis due to the unstructured and semantically impoverished nature of traditional system logs. The authors propose a hierarchical log abstraction method that parses raw logs into a three-layer semantic structure—entities, actions, and states—and introduce a modular collaborative detection framework that performs anomaly detection at each semantic level. By integrating large language models (LLMs) with a human-in-the-loop interactive visualization system, the approach enables precise identification, localization, and interpretable analysis of anomalies. Evaluated on the HDFS benchmark dataset, the method demonstrates effectiveness while supporting hierarchical log browsing, highlighting of anomalous segments, and user-guided review and correction of LLM-generated explanations. The source code and an online demo platform have been publicly released.

This work addresses the challenge of effectively analyzing massive, heterogeneous high-performance computing (HPC) logs, which hinders fault diagnosis and performance optimization. The authors propose a scalable log analysis workflow that uniquely integrates frequent pattern mining based on finite-state automata with job-level log correlation. By leveraging the Aho–Corasick automaton for efficient pattern storage and matching, and incorporating system hierarchy and message priority information, the approach enables automated detection and clustering of errors and anomalous events. Experiments on an exascale-class supercomputing system demonstrate that the method accurately identifies characteristic error sequences, reveals distinct failure patterns across different applications, and supports real-time, interpretable monitoring to enhance system resilience.

Insecure logging practices can lead to sensitive information leakage or log injection attacks, compromising system security and user privacy. This work presents the first systematic characterization of log-related security issues, defining four categories and ten concrete vulnerability patterns. The authors construct the first human-annotated benchmark dataset of real-world insecure logging instances. Leveraging this benchmark, they develop an automated evaluation framework to assess the capability of large language models (LLMs) in detecting and repairing logging vulnerabilities. Experimental results show that LLMs achieve detection accuracies ranging from 12.9% to 52.5% and exhibit limited repair effectiveness. Notably, providing only the problem description yields better detection performance than additionally supplying explanations of the associated security patterns.