Log-based vs Graph-based Approaches to Fault Diagnosis

TL;DR

This paper compares log-based and graph-based models for fault diagnosis in distributed systems, finding that combining log encoders with graph models yields the best results.

Contribution

It provides a comparative analysis of encoder and graph-based approaches, highlighting the effectiveness of integrating log encoders into graph models for fault diagnosis.

Findings

Graph-only models do not outperform encoder baselines.

Combining log encoders with graph models improves performance.

Graph-augmented architectures outperform traditional approaches under certain conditions.

Abstract

Modern distributed systems generate large volumes of logs that can be analyzed to support essential AIOps tasks such as fault diagnosis, which plays a crucial role in maintaining system reliability. Most existing approaches rely on log-based models that treat logs as linear sequences of events. However, such representations discard the structural context between events that are often present in execution logs, such as parent-child dependencies, fan-out (branching), or temporal features. To better capture these relationships, recent works on Graph Neural Networks (GNNs) suggest that representing logs as graphs offers a promising alternative. Building on these observations, this paper conducts a comparative study of log-based encoder architectures (e.g., BERT) and graph-based models (e.g., GNNs) for automated fault diagnosis. We evaluate our models on TraceBench, a trace-oriented log dataset, and on BGL, a more traditional system log dataset, covering both anomaly detection and fault type classification. Our results show that graph-only models fail to outperform encoder baselines. However, integrating learned representations from log encoders into graph-based models achieves the strongest overall performance. These findings highlight conditions under which graph-augmented architectures can outperform traditional log-based approaches.