Papers for

it monitoring teams

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Log parsing accuracy improves on rare templates with tailored augmentation

TAILOR: Template-Preserving Augmentation for Long-Tailed Log Parsing

Abstract: Log parsing is essential for system log analysis because it supports tasks such as debugging, monitoring, and anomaly detection by transforming unstructured log messages into structured log templates. However, real-world log datasets exhibit highly imbalanced, long-tailed distributions, where a small number of frequent templates dominate while many rare templates appear only a few times. This imbalance causes evaluation results to be overly optimistic by allowing frequent templates to dominate benchmark metrics, while poor performance on rare yet operationally important events remains largely hidden. In this paper, we investigate the prevalence and impact of rare log groups, defined as log groups with fewer than five instances. Our empirical study on the widely used Loghub-2.0 benchmark shows that rare log groups account for nearly 20% of all templates but less than 0.01% of log messages. Because they contain only a handful of instances, all evaluated parsers experience substantial performance degradation on these groups. To address this challenge, we propose TAILOR, a log parsing framework that improves template inference for rare log groups through template-preserving augmentation. TAILOR enriches rare log groups with template- consistent log messages before template inference. The additional structural evidence helps distinguish static tokens from dynamic variables. Our experimental results show that TAILOR improves parsing accuracy on rare log groups by 19% over the strongest baseline while maintaining competitive performance on complete datasets. We further show that the proposed augmentation strategy generalizes across different LLM backbones and consistently improves existing LLM-based parsers without modifying their core architectures.

Mon 21 SeptSoftware Engineering
The gist
Logs generated by computer systems are made of repeated message patterns called templates, but many templates occur very rarely. Parsing these rare templates correctly is hard and existing methods perform poorly on them. The authors studied these rare cases and found that they make up a large fraction of template types though very few total messages. They propose a way to create more examples for rare templates without changing their structure, helping the parsing method learn better. Their technique improves accuracy significantly on these rare templates while keeping performance high overall.
Open → 2609.25261v1