arXiv:2509.08698cs.LGcs.AI2025-09

三层架构自动分析日志,快速定位系统故障根源。

A layered architecture for log analysis in complex IT systems

  • 分三层处理日志:自动标注、异常检测、根因分析。
  • 异常检测F1达0.98~1.0,根因定位准确率90%~98%。
  • 适合需要高效运维的复杂IT系统团队使用。

在日益复杂的IT环境中,系统稳定性和可靠性至关重要,但其复杂性给DevOps团队带来挑战。日志分析作为AIOps核心,可揭示系统行为与故障。本论文提出一种三层架构支持故障快速排查。第一层日志调查实现自动日志标注与异常分类,提出无需人工标注的方法,支持监督学习与精确评估;同时定义三类异常分类体系,确保方法适配。第二层异常检测采用灵活方法,适用于无监督、弱监督和监督训练,在公开与工业数据集上均达到F1分数0.98至1.0,检测可靠。第三层根因分析识别描述故障的最小日志集合及其事件序列,通过平衡训练数据与关键服务识别,始终在前10个候选中定位90%~98%的根因日志行,提供可操作修复建议。该架构提升系统可靠性,助力团队高效应对故障。

原文摘要 · Abstract (English)

In the evolving IT landscape, stability and reliability of systems are essential, yet their growing complexity challenges DevOps teams in implementation and maintenance. Log analysis, a core element of AIOps, provides critical insights into complex behaviors and failures. This dissertation introduces a three-layered architecture to support DevOps in failure resolution. The first layer, Log Investigation, performs autonomous log labeling and anomaly classification. We propose a method that labels log data without manual effort, enabling supervised training and precise evaluation of anomaly detection. Additionally, we define a taxonomy that groups anomalies into three categories, ensuring appropriate method selection. The second layer, Anomaly Detection, detects behaviors deviating from the norm. We propose a flexible Anomaly Detection method adaptable to unsupervised, weakly supervised, and supervised training. Evaluations on public and industry datasets show F1-scores between 0.98 and 1.0, ensuring reliable anomaly detection. The third layer, Root Cause Analysis, identifies minimal log sets describing failures, their origin, and event sequences. By balancing training data and identifying key services, our Root Cause Analysis method consistently detects 90-98% of root cause log lines within the top 10 candidates, providing actionable insights for mitigation. Our research addresses how log analysis methods can be designed and optimized to help DevOps resolve failures efficiently. By integrating these three layers, the architecture equips teams with robust methods to enhance IT system reliability.

日志分析AIOps根因分析异常检测

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。