No More Labelled Examples? An Unsupervised Log Parser with LLMs
Log parsing serves as an essential prerequisite for various log analysis tasks. Recent advancements in this field have improved parsing accuracy by leveraging the semantics in logs through fine-tuning large language models (LLMs) or learning from in-context demonstrations. However, these methods heavily depend on labeled examples to achieve optimal performance. In practice, collecting sufficient labeled data is challenging due to the large scale and continuous evolution of logs, leading to performance degradation of existing log parsers after deployment. To address this issue, we propose LUNAR, an unsupervised LLM-based method for efficient and off-the-shelf log parsing. Our key insight is that while LLMs may struggle with direct log parsing, their performance can be significantly enhanced through comparative analysis across multiple logs that differ only in their parameter parts. We refer to such groups of logs as Log Contrastive Units (LCUs). Given the vast volume of logs, obtaining LCUs is difficult. Therefore, LUNAR introduces a hybrid ranking scheme to effectively search for LCUs by jointly considering the commonality and variability among logs. Additionally, LUNAR crafts a novel parsing prompt for LLMs to identify contrastive patterns and extract meaningful log structures from LCUs. Experiments on large-scale public datasets demonstrate that LUNAR significantly outperforms state-of-the-art log parsers in terms of accuracy and efficiency, providing an effective and scalable solution for real-world deployment.
Mon 23 JunDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
14:00 - 15:30 | LoggingResearch Papers / Journal First at Andromeda Chair(s): Domenico Bianculli University of Luxembourg | ||
14:00 20mTalk | No More Labelled Examples? An Unsupervised Log Parser with LLMs Research Papers Junjie Huang The Chinese University of Hong Kong, Zhihan Jiang The Chinese University of Hong Kong, Zhuangbin Chen Sun Yat-sen University, Michael Lyu Chinese University of Hong Kong DOI | ||
14:20 20mTalk | Exploring the Effectiveness of LLMs in Automated Logging Statement Generation: An Empirical Study Journal First Yichen LI The Chinese University of Hong Kong, Yintong Huo Singapore Management University, Zhihan Jiang The Chinese University of Hong Kong, Renyi Zhong The Chinese University of Hong Kong, Pinjia He Chinese University of Hong Kong, Shenzhen, Yuxin Su Sun Yat-sen University, Lionel Briand University of Ottawa, Canada; Lero centre, University of Limerick, Ireland, Michael Lyu Chinese University of Hong Kong | ||
14:40 20mTalk | Protecting Privacy in Software Logs: What Should be Anonymized? Research Papers Roozbeh Aghili Polytechnique Montréal, Heng Li Polytechnique Montréal, Foutse Khomh Polytechnique Montréal DOI |
Andromeda is located close to the restaurant and the bar, at the end of the corridor on the side of the bar.
From the registration desk, go towards the restaurant, turn left towards the bar, walk until the end of the corridor.