Abstract:

As the scale and complexity of complex intelligent systems represented by high-performance computing and embedded systems continue to grow, logs, as core operational data, have become critical for ensuring reliable system operation through automated anomaly detection. Traditional log anomaly detection methods driven by machine learning and deep learning primarily focus mostly on log sequence modeling but suffer from insufficient semantic understanding and limited generalization ability. Large Language Models (LLMs), with their superior semantic understanding and contextual reasoning capabilities, have effectively overcome this limitation. Since the advent of LLM technology, relevant research has emerged rapidly, achievements are scattered across multiple technical paths and lack a systematic review. This paper provides a comprehensive survey of log anomaly detection methods based on LLMs. We select 35 core papers and establish a unified technical classification framework, categorizing existing methods into five technical routes: prompt engineering, Retrieval-Augmented Generation (RAG), domain fine-tuning, Reinforcement Learning (RL), and large—small model collaboration. Our analysis reveals that Supervised Fine-Tuning (SFT) is currently the most widely adopted technical route, while the large—small model collaborative architecture, as an emerging paradigm, is shifting research focus from merely pursuing detection accuracy to balancing inference efficiency and industrial deployability. The current evaluation system remains heavily focused on detection performance metrics, with insufficient attention paid to efficiency overhead and interpretability. Finally, this paper identifies inference latency bottlenecks and data privacy challenges of LLMs when processing ultra-long and massive log streams, and provides insights into frontier directions such as lightweight deployment and online continual learning.

Key words: log anomaly detection, Large Language Model (LLM), software operation and maintenance, prompt engineering, fine-tuning, Retrieval-Augmented Generation (RAG)

摘要：

随着以高性能计算系统、嵌入式系统为代表的复杂智能系统规模与复杂度的不断攀升, 日志作为核心运维数据, 其自动化异常检测已成为保障系统可靠运行的关键。传统机器学习与深度学习驱动的日志异常检测方法多侧重日志序列建模, 存在语义理解能力不足、泛化性能受限的问题。大语言模型(LLM)凭借卓越的语义理解与上下文推理能力, 有效突破了这一局限, 自大语言模型技术兴起以来相关研究快速涌现, 但成果分散于多条技术路径, 尚未形成系统性梳理。本文针对基于大语言模型的日志异常检测方法开展全面综述, 筛选纳入35篇核心文献, 构建统一的技术分类框架, 将现有方法归纳为提示工程、检索增强生成(RAG)、领域微调、强化学习(RL)与大小模型协作5类技术路线。研究分析发现: 监督微调(SFT)是当前应用最广泛的技术路线, 而大小模型协同架构作为新兴范式, 正推动研究重心从单纯追求检测精度向兼顾推理效率与工业可部署性转变; 现有评估体系高度集中于检测性能指标, 对效率开销与可解释性的关注存在不足。最后, 本文揭示了大语言模型在处理超长海量日志流时存在的推理延迟瓶颈与数据隐私挑战, 并针对轻量化部署与在线持续学习等前沿方向提出了见解。

关键词: 日志异常检测, 大语言模型, 软件运维, 提示工程, 微调, 检索增强生成