Abstract: As the scale and complexity of complex intelligent systems represented by high-performance computing systems and embedded systems continue to grow, automated anomaly detection of logs, as core operational data, has become critical to ensuring reliable system operation. Traditional log anomaly detection methods driven by machine learning and deep learning focus mostly on log sequence modeling, and suffer from insufficient semantic understanding and limited generalization ability. Large language models have effectively overcome this limitation with their outstanding semantic understanding and contextual reasoning capabilities. Since the rise of large language model technology, relevant research has emerged rapidly, but achievements are scattered across multiple technical paths and lack a systematic review. This paper provides a comprehensive survey of log anomaly detection methods based on large language models, selects 35 core literatures, and establishes a unified technical classification framework. Existing methods are categorized into five technical routes: prompt engineering, retrieval-augmented generation, domain fine-tuning, reinforcement learning, and large-small model collaboration. Research shows that supervised fine-tuning is the most widely used technical route at present, while the large-small model collaborative architecture, as an emerging paradigm, is shifting the research focus from pure pursuit of detection accuracy to balancing inference efficiency and industrial deployability. Current evaluation systems focus heavily on detection performance metrics, with insufficient attention to efficiency overhead and interpretability. Finally, this paper identifies the inference latency bottlenecks and data privacy challenges of large language models in processing ultra-long massive log streams, and proposes insights into frontier directions such as lightweight deployment and online continuous learning.

摘要： 随着以高性能计算系统、嵌入式系统为代表的复杂智能系统规模与复杂度攀升，日志作为核心运维数据，其自动化异常检测已成为保障系统可靠运行的关键。传统机器学习与深度学习驱动的日志异常检测方法，多侧重日志序列建模，存在语义理解能力不足、泛化性能受限的问题。大语言模型凭借卓越的语义理解与上下文推理能力，有效突破了这一局限，自大语言模型技术兴起以来相关研究快速涌现，但成果分散于多条技术路径，尚未形成系统性梳理。本文针对基于大语言模型的日志异常检测方法开展全面综述，筛选纳入35篇核心文献，构建统一的技术分类框架，将现有方法归纳为提示工程、检索增强生成、领域微调、强化学习与大小模型协作五类技术路线。研究分析发现监督微调是当前应用最广泛的技术路线，而大小模型协同架构作为新兴范式，正推动研究重心从单纯追求检测精度向兼顾推理效率与工业可部署性转变；现有评估体系高度集中于检测性能指标，对效率开销与可解释性的关注存在不足。最后，本文揭示了大语言模型在处理超长海量日志流时的推理延迟瓶颈与数据隐私挑战，并针对轻量化部署与在线持续学习等前沿方向提出了见解。