LLM-SrcLog: Towards Proactive and Unified Log Template Extraction via Large Language Models

TL;DR

LLM-SrcLog introduces a proactive, source-code-based log template extraction framework using large language models, significantly improving accuracy and efficiency over existing reactive, log-centric methods.

Contribution

It presents a novel unified approach combining static code analysis and LLM-based template extraction, enabling proactive log parsing from source code and enhancing performance in real-world systems.

Findings

Improves F1-score by 2-17% over baselines

Achieves 1,000x faster parsing than per-log LLM methods

Effective in industrial-scale production environments

Abstract

Log parsing transforms raw logs into structured templates containing constants and variables. It underpins anomaly detection, failure diagnosis, and other AIOps tasks. Current parsers are mostly reactive and log-centric. They only infer templates from logs, mostly overlooking the source code. This restricts their capacity to grasp dynamic log structures or adjust to evolving systems. Moreover, per-log LLM inference is too costly for practical deployment. In this paper, we propose LLM-SrcLog, a proactive and unified framework for log template parsing. It extracts templates directly from source code prior to deployment and supplements them with data-driven parsing for logs without available code. LLM-SrcLog integrates a cross-function static code analyzer to reconstruct meaningful logging contexts, an LLM-based white-box template extractor with post-processing to distinguish constants from variables, and a black-box template extractor that incorporates data-driven clustering for remaining unmatched logs. Experiments on two public benchmarks (Hadoop and Zookeeper) and a large-scale industrial system (Sunfire-Compute) show that, compared to two LLM-based baselines, LLM-SrcLog improves average F1-score by 2-17% and 8-35%. Meanwhile, its online parsing latency is comparable to data-driven methods and about 1,000 times faster than per-log LLM parsing. LLM-SrcLog achieves a near-ideal balance between speed and accuracy. Finally, we further validate the effectiveness of LLM-SrcLog through practical case studies in a real-world production environment.