用少量标注实现日志异常的精准定位,让故障排查更高效。
FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection

- 仅需每模板100行标注,通过大模型离线分析划分故障域。
- 在BGL数据集上达到98.16的F1值,检测97.7%未见事件模板的异常。
- 轻量级推理框架可本地部署,适合生产环境持续监控。
生产系统每日生成数百万条日志,但多数异常检测器仅在会话或窗口级别工作,仅能标记一组日志而非具体异常消息。这种粗粒度导致告警中包含大量正常日志。消息级检测虽更精细,但面临挑战:单一事件模板可能对应正常或异常消息,故障来源多样,且大规模逐行标注不可行。尽管大语言模型(LLM)可理解日志语义,但实时应用成本过高。本文提出FAME(Failure-Aware Mixture-of-Experts),一种标签高效的混合专家框架,在离线阶段仅使用一次LLM。对每模板最多标注K=100行,生成二元正常/异常标签与代表性样本。LLM将模板划分为故障域,经验证后用于训练轻量级路由器与领域专家。模型本地运行,输出异常预测与故障域标签。在BGL数据集上,当K=100时F1达98.16,标注效率提升76倍,并检测97.7%未见EventID的异常;在Thunderbird上,F1为99.95,召回率为100%。
原文摘要 · Abstract (English)
Production systems generate millions of log lines daily, yet most anomaly detectors operate at the session or window-level, flagging groups of lines rather than identifying the specific message responsible. This coarse granularity forces operators to inspect many routine lines per alert. Message-level detection offers finer granularity, but remains challenging. A single event template may correspond to both normal and anomalous messages, failures arise from heterogeneous subsystems, and line-level labeling at scale is impractical. Although large language models (LLMs) can reason over log semantics, applying them to every line is too costly for continuous monitoring. We present FAME (Failure-Aware Mixture-of-Experts), a label-efficient message-level mixture-of-experts framework that uses an LLM only once offline. We annotate at most K labeled lines per template to derive binary normal/anomaly indicators and representative examples. The LLM proposes a partition of templates into failure domains, and a certification step validates the proposal before training. FAME trains a lightweight router and domain experts that run on-premise and output anomaly predictions and failure-domain labels. On BGL, FAME achieves F1 = 98.16 at K = 100 reducing annotation effort by 76x and detects 97.7% of anomalies from unseen EventIDs. On Thunderbird, FAME reaches F1 = 99.95 with perfect recall.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。