Lemur: Log Parsing with Entropy Sampling and Chain-of-Thought Merging

TL;DR

Lemur introduces an entropy-based sampling and chain-of-thought merging approach for log parsing, leveraging large language models to improve template identification and semantic understanding, achieving state-of-the-art results.

Contribution

The paper presents a novel log parsing framework that eliminates manual rules and enhances template merging using entropy sampling and chain-of-thought methods with LLMs.

Findings

Achieves state-of-the-art performance on large-scale datasets.

Demonstrates high efficiency in log template clustering.

Effectively captures semantic information in logs.

Abstract

Logs produced by extensive software systems are integral to monitoring system behaviors. Advanced log analysis facilitates the detection, alerting, and diagnosis of system faults. Log parsing, which entails transforming raw log messages into structured templates, constitutes a critical phase in the automation of log analytics. Existing log parsers fail to identify the correct templates due to reliance on human-made rules. Besides, these methods focus on statistical features while ignoring semantic information in log messages. To address these challenges, we introduce a cutting-edge \textbf{L}og parsing framework with \textbf{E}ntropy sampling and chain-of-thought \textbf{M}erging (\model{}). Specifically, to discard the tedious manual rules, we propose a novel sampling method inspired by information entropy, which efficiently clusters typical logs. Furthermore, to enhance the merging of log templates, we design a chain-of-thought method for large language models (LLMs). LLMs exhibit exceptional semantic comprehension and deftly distinguish between parameters and invariant tokens. We have conducted experiments on large-scale public datasets. Extensive evaluation demonstrates that \model{} achieves state-of-the-art performance and impressive efficiency. The Code is available at https://github.com/zwpride/lemur.