Debugging Tabular Log as Dynamic Graphs
Chumeng Liang, Zhanyang Jin, Zahaib Akhtar, Mona Pereira, Haofei Yu, Jiaxuan You
TL;DR
This paper introduces GraphLogDebugger, a dynamic graph-based framework that models tabular logs for system debugging, outperforming large language models in flexibility and scalability.
Contribution
It presents a novel dynamic graph modeling approach for tabular logs and demonstrates that a simple GNN can effectively debug logs, surpassing LLMs.
Findings
Dynamic graph modeling improves debugging accuracy.
GNN outperforms LLMs in log debugging tasks.
Framework validated on real-world datasets.
Abstract
Tabular log abstracts objects and events in the real-world system and reports their updates to reflect the change of the system, where one can detect real-world inconsistencies efficiently by debugging corresponding log entries. However, recent advances in processing text-enriched tabular log data overly depend on large language models (LLMs) and other heavy-load models, thus suffering from limited flexibility and scalability. This paper proposes a new framework, GraphLogDebugger, to debug tabular log based on dynamic graphs. By constructing heterogeneous nodes for objects and events and connecting node-wise edges, the framework recovers the system behind the tabular log as an evolving dynamic graph. With the help of our dynamic graph modeling, a simple dynamic Graph Neural Network (GNN) is representative enough to outperform LLMs in debugging tabular log, which is validated by…
Peer Reviews
Decision·ICLR 2026 Conference Withdrawn Submission
- The formulation of tabular log debugging as a dynamic heterogeneous graph link prediction task is well-motivated. - The framework is efficient, scalable, and avoids the computational burden of LLMs. - Experiments are conducted across several domains (academic, system, finance, geology), and the ablation studies support design choices.
- Novelty is limited: the core idea — modeling logs as dynamic graphs for anomaly detection via link prediction — was already introduced in TempoLog (arXiv:2501.12166, Jan 2025). TempoLog focuses on discrete event logs (parsed into templates) and constructs a homogeneous temporal graph of template dependencies, and this work targets structured tabular logs with explicit object – event semantics and builds a heterogeneous graph, the high-level paradigm (dynamic graph + link prediction for log ano
- The idea of framing tabular log debugging as online link prediction on a dynamic, heterogeneous graph is interesting. This formulation could inform future work on efficient, online, graph-based anomaly detection. - Reporting GFLOPs and throughput alongside accuracy is valuable, highlighting the model’s efficiency compared to RAG baselines. - The paper explains the framework clearly, mapping each anomaly type to a specific graph operation. Figures and algorithms help the reader understand the p
Limited novelty: - The idea of representing log data as graphs has been explored in prior works (e.g., [LogKG](https://ieeexplore.ieee.org/document/10179162/), [GLAD](https://arxiv.org/pdf/2309.05953), [GuARD](https://arxiv.org/pdf/2412.03930v2)). A comparison with these methods is therefore necessary to clarify the method’s novelty and relative performance. Empirical design lacks clarity and rigor: - The experimental protocol lacks a validation set, making it unclear whether hyperparameters ar
1. The integration of dynamic heterogeneous graphs to represent tabular logs and redefine the object-event connections as link prediction on the evolving graph are unique. 2. One of the key strengths is its efficiency. Unlike LLM-based models that suffer from high computational overhead, GraphLogDebugger delivers high throughput and low GFLOPs, making it suitable for real-time applications in large-scale systems. The approach demonstrates significant improvements in processing speed compared t
1. In some cases, GraphLogDebugger performed worse than RAG, like your Case 3 in the case study. The authors have mentioned that there may be limitations in scenarios with low connectivity between objects and events, where the dynamic graph might not provide enough information for accurate anomaly detection. It would be better if the authors could provide further analysis of these edge cases and discuss ways to improve the model in scenarios where the object-event graph is sparse or the event hi
1. Lighter than full LLM pipelines: The method avoids the computational overhead of large language models, offering a practical and efficient alternative for log understanding. 2. Related-work coverage broad (even if slightly disorganized): The authors review a wide range of related work, showing awareness of the field and positioning their approach within both log-analysis and dynamic-graph research.
1. Clarity and Formalism * Many definitions (e.g., of event nodes, object nodes, and anomalies) are vague or semi-formal. * The notation and formal setup are fragmented, critical parts are only in the appendix. This interrupts reading flow. * Key concepts (such as the distinction between “features” and “objects”) remain unclear to me. 2. Model Definition Many aspects of the model are unclear and need clarification: * Mapping from logs to graph structure unclear: I cannot fully understand how
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSoftware System Performance and Reliability · Graph Theory and Algorithms · Cloud Computing and Resource Management