LogLM: From Task-based to Instruction-based Automated Log Analysis

2024/10/12 by Yilun Liu, Liu, Yilun, Yuhe Ji +16 · 9 citations
Computer Science · #Computation and Language (cs.CL) #FOS: Computer and information sciences #Semantic Web and Ontologies #Software Engineering (cs.SE)

paper · pdf · doi:10.48550/arxiv.2410.09352

openalex publication_date 2024/10/12 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Automatic log analysis is essential for the efficient Operation and Maintenance (O&M) of software systems, providing critical insights into system behaviors. However, existing approaches mostly treat log analysis as training a model to perform an isolated task ( e.g., anomaly detection, log parsing, etc.) using task-specific log-label pairs. These task-based approaches are inflexible in generalizing to complex scenarios, depend on task-specific training data, and cost significantly when deploying multiple models. In this paper, we propose an instruction-based training approach that transforms log-label pairs from multiple tasks and domains into a unified format of instruction-response pairs. Our trained model, LogLM, can follow complex user instructions and generalize better across different tasks, thereby increasing flexibility and reducing the dependence on task-specific training data. By integrating major log analysis tasks into a single model, our approach also relieves model deployment burden. Experimentally, LogLM outperforms existing approaches across five log analysis capabilities, and exhibits strong generalization abilities on complex instructions and unseen tasks.

Cited by

• Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection
• LogPurge: Log Data Purification for Anomaly Detection via Rule-Enhanced Filtering
• Scalable and Efficient Large-Scale Log Analysis with LLMs: An IT Software Support Case Study
• CodeAD: Synthesize Code of Rules for Log-based Anomaly Detection with LLMs
• R-Log: Incentivizing Log Analysis Capability in LLMs via Reasoning-based Reinforcement Learning
• LogReasoner: Empowering LLMs with Expert-like Coarse-to-Fine Reasoning for Automated Log Analysis
• RationAnomaly: Log Anomaly Detection with Rationality via Chain-of-Thought and Reinforcement Learning
• Large Language Models for Security Operations Centers: A Comprehensive Survey
• Adaptive Root Cause Localization for Microservice Systems with Multi-Agent Recursion-of-Thought

Related

• Interpretable Online Log Analysis Using Large Language Models with Prompt Strategies
• Learning Representations on Logs for AIOps
• Linnaeus: A highly reusable and adaptable ML based log classification\n pipeline
• Log-based software monitoring: a systematic mapping study
• Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics