用知识图谱和大模型让程序日志变可问可答，提升调试效率。
TAAF: A Trace Abstraction and Analysis Framework Synergizing Knowledge Graphs and LLMs
- 将日志事件构建成带时间索引的知识图谱，捕捉线程、资源等关系。
- 在真实内核日志上测试，自然语言问答准确率最高提升31.2%。
- 适合系统开发者、运维人员快速定位复杂故障，无需写脚本。
执行痕迹是理解、调试和优化复杂软件系统的关键信息源。然而，操作系统内核或 Chrome、MySQL 等大型应用的日志数据量巨大，难以分析。现有工具依赖预设分析逻辑，自定义洞察通常需编写领域特定脚本，耗时且易出错。本文提出 TAAF（Trace Abstraction and Analysis Framework），结合时间索引、知识图谱（KG）与大语言模型（LLM），将原始日志转化为可操作的洞察。TAAF 从日志事件构建时间索引的知识图谱，刻画线程、CPU、系统资源等实体间的关系；再由 LLM 解析查询相关的子图，回答自然语言问题，减少手动排查与深层系统知识依赖。为评估效果，我们构建了基于真实内核日志的 TraceQA-100 基准，包含 100 个问题。在三个 LLM 和多种时间设置下实验表明，TAAF 在多跳推理与因果推理任务中答案准确率最高提升 31.2%。进一步分析揭示图结构推理的优势与局限，为下一代日志分析工具奠定基础。
原文摘要 · Abstract (English)
Execution traces are a critical source of information for understanding, debugging, and optimizing complex software systems. However, traces from OS kernels or large-scale applications like Chrome or MySQL are massive and difficult to analyze. Existing tools rely on predefined analyses, and custom insights often require writing domain-specific scripts, which is an error-prone and time-consuming task. This paper introduces TAAF (Trace Abstraction and Analysis Framework), a novel approach that combines time-indexing, knowledge graphs (KGs), and large language models (LLMs) to transform raw trace data into actionable insights. TAAF constructs a time-indexed KG from trace events to capture relationships among entities such as threads, CPUs, and system resources. An LLM then interprets query-specific subgraphs to answer natural-language questions, reducing the need for manual inspection and deep system expertise. To evaluate TAAF, we introduce TraceQA-100, a benchmark of 100 questions grounded in real kernel traces. Experiments across three LLMs and multiple temporal settings show that TAAF improves answer accuracy by up to 31.2%, particularly in multi-hop and causal reasoning tasks. We further analyze where graph-grounded reasoning helps and where limitations remain, offering a foundation for next-generation trace analysis tools.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。