New Technique Boosts Accuracy for Rare Event Logs in System Monitoring

The Problem with Imbalanced Logs#

System logs form the backbone of debugging, monitoring, and security—but they present a stubborn analytical challenge. Real-world log datasets are heavily skewed, with a handful of common message templates appearing thousands of times while rare but potentially critical events show up only a handful of times. This imbalance misleads researchers: benchmark evaluations look strong overall because common templates inflate the scores, while failures on rare events—which may signal operational issues—go unnoticed.

Researchers from a recent arXiv submission quantified the scale of this blind spot. In the widely-used Loghub-2.0 benchmark, nearly one-fifth of all distinct log templates account for less than 0.01% of actual messages. These rare log groups—templates with fewer than five examples—represent a major weakness in existing parsing systems.

How TAILOR Works#

The team proposes TAILOR, a framework that tackles this imbalance through template-preserving augmentation. Before attempting to parse logs into structured templates, TAILOR artificially enriches rare log groups by generating synthetic messages that match their patterns. This additional structural evidence helps the parsing algorithm distinguish which parts of a message are fixed text and which are variable data fields.

The key insight is that synthetic augmentation must preserve the template structure—the generated logs must be consistent with the genuine rare event—rather than simply padding datasets with random noise.

Results and Generalization#

Testing on real-world log data, TAILOR achieved a 19% accuracy boost on rare log groups compared to the strongest existing baseline, while keeping overall performance competitive. The method also proved flexible, working across different large language model backends without requiring changes to the core parsing algorithms themselves.

This approach opens a path for making log analysis more robust to operationally important but statistically rare events.