Software Engineering
LOGOS system diagnoses enterprise outages from raw logs alone, cutting noise by 99.8%
Researchers present an unsupervised technique to isolate failure patterns in production incidents using only unstructured text logs, with no prior domain knowledge required.
When enterprise software fails, traditional troubleshooting relies on rich observability data—distributed traces, system topology maps, and baseline metrics. But when dealing with proprietary systems, operators often have nothing but mountains of raw, unannotated text logs to work with. A new research paper explores how far diagnosis can go using log data alone.
The Challenge of Log-Only Diagnosis#
Production incidents generate enormous volumes of log output, much of it irrelevant noise. Enterprise teams must manually sift through millions of lines to identify which events actually matter. The core question researchers set out to answer: can unsupervised methods extract meaningful failure patterns from raw logs without any human guidance, seed queries, or pre-defined incident boundaries?
Introducing LOGOS#
The answer comes in the form of LOGOS, an unsupervised system designed to collapse massive log datasets into compact summaries of failure propagation. The approach works by identifying how entities and events co-occur in logs and tracking their temporal sequence—essentially building a "precedence forest" that maps which failures trigger which others.
The system requires absolutely no prior knowledge: no labels, no example symptoms, and no manual thresholds to tune. This zero-shot design makes it applicable across different systems without retraining.
Real-World Performance#
The research team evaluated LOGOS against 25 production enterprise outages and 12 open-source software incidents. Results showed:
- Speed: Median analysis time of 4.5 minutes wall-clock time
- Noise reduction: Eliminated a median 99.8% of background log noise
- Detection accuracy: Mean recall of 0.76 for identifying relevant events
- Early warning: Detected failure cascades with a 16-hour median lead time—catching problems well before operators noticed
- Alert consolidation: Compressed alert floods from thousands down to a median of roughly 8 actionable signals (124x compression)
- Root-cause discovery: Achieved 80% zero-shot LLM accuracy for root-cause analysis in enterprise incidents and 100% in open-source cases