Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces FAME, a failure-aware mixture-of-experts framework for message-level log anomaly detection that addresses the limitations of session-level methods and the high cost of directly applying LLMs to every log line. FAME uses an LLM offline to partition log templates into failure domains based on a small number of labeled examples (K lines per template) and then trains lightweight routers and domain experts for efficient on-premise anomaly prediction. Experiments on BGL and Thunderbird datasets demonstrate that FAME achieves high F1 scores (98.16 and 99.95, respectively) with significantly reduced annotation effort and strong generalization to unseen EventIDs.
Pinpointing the exact log message causing an anomaly just got 76x easier, thanks to a new framework that distills LLM reasoning into lightweight, deployable experts.
Production systems generate millions of log lines daily, yet most anomaly detectors operate at the session or window-level, flagging groups of lines rather than identifying the specific message responsible. This coarse granularity forces operators to inspect many routine lines per alert. Message-level detection offers finer granularity, but remains challenging. A single event template may correspond to both normal and anomalous messages, failures arise from heterogeneous subsystems, and line-level labeling at scale is impractical. Although large language models (LLMs) can reason over log semantics, applying them to every line is too costly for continuous monitoring. We present FAME (Failure-Aware Mixture-of-Experts), a label-efficient message-level mixture-of-experts framework that uses an LLM only once offline. We annotate at most K labeled lines per template to derive binary normal/anomaly indicators and representative examples. The LLM proposes a partition of templates into failure domains, and a certification step validates the proposal before training. FAME trains a lightweight router and domain experts that run on-premise and output anomaly predictions and failure-domain labels. On BGL, FAME achieves F1 = 98.16 at K = 100 reducing annotation effort by 76x and detects 86.3% of anomalies from unseen EventIDs. On Thunderbird, FAME reaches F1 = 99.95 with perfect recall.