New Framework Pinpoints Individual Log Anomalies Without Massive Labeling Effort

Production systems generate enormous volumes of log data every day, yet most anomaly detection tools work at a coarse level—flagging entire sessions or time windows rather than identifying the exact problematic message. This approach leaves operators wading through countless normal entries to find the actual issue.

The Core Challenge#

Message-level detection would be more precise, but three obstacles have made it difficult to achieve at scale. A single event pattern can represent both healthy and faulty system behavior. Failures emerge from diverse, heterogeneous subsystems rather than a single root cause. And labeling individual log lines by hand—a prerequisite for training—becomes impractical in real-world environments with millions of daily entries.

FAME's Approach#

Researchers have introduced FAME (Failure-Aware Mixture-of-Experts), a framework that dramatically reduces the annotation burden while maintaining high accuracy. The method uses a large language model once, offline, to understand the semantic structure of logs. Rather than annotating thousands of examples, operators label at most K lines per event template, marking whether each represents normal or anomalous behavior and providing representative cases.

The LLM then proposes how to organize templates into distinct failure domains—categories representing different types of system problems. A validation step confirms this grouping before the actual training begins.

Performance and Efficiency#

Once trained, FAME deploys a lightweight router and domain-specific expert models that run on-premise, producing anomaly predictions and failure-domain classifications in real time. On benchmark datasets, the approach achieved exceptional results:

• BGL dataset: F1 score of 98.16 at just K=100 labeled examples, representing a 76-fold reduction in annotation effort and detecting 97.7% of anomalies from previously unseen event types
• Thunderbird dataset: F1 score of 99.95 with perfect recall

These results suggest that combining minimal human labeling with LLM-guided domain organization can deliver production-grade anomaly detection without the cost of labeling at scale.