LLM4Log: A Systematic Review of Large Language Model-based Log Analysis

• URL: http://arxiv.org/abs/2604.16359v1
• Date: Wed, 18 Mar 2026 20:34:58 GMT
• Title: LLM4Log: A Systematic Review of Large Language Model-based Log Analysis
• Abstract summary: Large language models (LLMs) have reshaped log analysis by enabling semantic generalization and cross-source evidence integration.<n>LLMs also introduce deployment risks such as context limits, latency/cost, privacy constraints, and hallucinations.<n>This paper presents a systematic review of LLM-based log analysis across the end-to-end pipeline.
• Score: 7.098062225687816
• License: http://creativecommons.org/publicdomain/zero/1.0/
• Abstract: Software systems generate massive, evolving, semi-structured logs that are central to reliability engineering and AIOps, yet difficult to analyze at scale under drift and limited labels. Recent advances in pretrained Transformer models and instruction-tuned large language models (LLMs) have reshaped log analysis by enabling semantic generalization and cross-source evidence integration, but also introducing deployment risks such as context limits, latency/cost, privacy constraints, and hallucinations. This paper presents LLM4Log, a systematic review of LLM-based log analysis across the end-to-end pipeline, from upstream logging-statement generation and maintenance to log parsing/structuring and downstream tasks including anomaly detection, failure prediction, root cause analysis, and log summarization. Following a structured search and manual screening protocol, we completed literature collection in November 2025 and identified 145 unique papers across seven logging tasks. We synthesize the research area through a unified, task-driven taxonomy, summarize common design patterns (prompting/ICL, retrieval grounding, fine-tuning, tool/agent augmentation, and verification), and analyze evaluation practices, datasets, metrics, and reproducibility. Based on these cross-paper analyses, we distill key lessons and open challenges for reliable real-world adoption. We emphasize robustness under drift and long-tail events, grounding and faithfulness for operator-facing outputs, and deployment-oriented designs with verifiable behavior.

Related papers

• Dynamic analysis enhances issue resolution [53.50448142467294]
  DAIRA (Dynamic Analysis-enhanced Issue Resolution Agent) is an automated repair framework that embeds dynamic analysis into the agent's reasoning cycle.<n> Driven by a Test Tracing-Driven methodology, DAIRA utilizes lightweight monitors to extract critical runtime data.<n>When powered by Gemini 3 Flash Preview, DAIRA establishes a new state-of-the-art (SOTA) performance, achieving a 79.4% resolution rate on the SWE-bench Verified dataset.
  arXiv  Detail & Related papers  (2026-03-23T14:48:54Z)
• Understanding by Reconstruction: Reversing the Software Development Process for LLM Pretraining [66.89012795621349]
  Large Language Models (LLMs) often struggle with the deep, long-horizon reasoning required for complex software engineering.<n>We propose a novel paradigm: understanding via reconstruction.<n>We introduce a framework that synthesizes latent agentic trajectories using a multi-agent simulation.
  arXiv  Detail & Related papers  (2026-03-11T09:23:20Z)
• Seven simple steps for log analysis in AI systems [31.345120499488974]
  AI systems produce large volumes of logs as they interact with tools and users.<n>Analysing these logs can help understand model capabilities, propensities, and behaviours.<n>Here we suggest a pipeline based on current best practices.
  arXiv  Detail & Related papers  (2026-02-13T21:35:45Z)
• Advances and Frontiers of LLM-based Issue Resolution in Software Engineering: A Comprehensive Survey [59.3507264893654]
  Issue resolution is a complex Software Engineering task integral to real-world development.<n> benchmarks like SWE-bench revealed this task as profoundly difficult for large language models.<n>This paper presents a systematic survey of this emerging domain.
  arXiv  Detail & Related papers  (2026-01-15T18:55:03Z)
• LongDA: Benchmarking LLM Agents for Long-Document Data Analysis [55.32211515932351]
  LongDA targets real-world settings in which navigating long documentation and complex data is the primary bottleneck.<n>LongTA is a tool-augmented agent framework that enables document access, retrieval, and code execution.<n>Our experiments reveal substantial performance gaps even among state-of-the-art models.
  arXiv  Detail & Related papers  (2026-01-05T23:23:16Z)
• Flowco: Rethinking Data Analysis in the Age of LLMs [2.1874189959020427]
  Large language models (LLMs) are now capable of generating such code for simple, routine analyses.<n>LLMs promise to democratize data science by enabling those with limited programming expertise to conduct data analyses.<n>Analysts in many real-world settings must often exercise fine-grained control over specific analysis steps.<n>This paper introduces Flowco, a new mixed-initiative system to address these challenges.
  arXiv  Detail & Related papers  (2025-04-18T19:01:27Z)
• System Log Parsing with Large Language Models: A Review [2.2779174914142346]
  Large language models (LLMs) have introduced the new research field of LLM-based log parsing.<n>Despite promising results, there is no structured overview of the approaches in this relatively new research field.<n>This work systematically reviews 29 LLM-based log parsing methods.
  arXiv  Detail & Related papers  (2025-04-07T09:41:04Z)
• LogLM: From Task-based to Instruction-based Automated Log Analysis [22.44842963552044]
  Existing approaches mostly treat log analysis as training a model to perform an isolated task.<n>We propose an instruction-based training approach that transforms log-label pairs into a unified format of instruction-response pairs.<n>Our trained model, LogLM, can follow complex user instructions and generalize better across different tasks.
  arXiv  Detail & Related papers  (2024-10-12T03:36:52Z)
• LogEval: A Comprehensive Benchmark Suite for Large Language Models In Log Analysis [32.46940506638522]
  We introduce LogEval, a benchmark suite designed to evaluate the capabilities of Large Language Models in log analysis tasks. This benchmark covers tasks such as log parsing, log anomaly detection, log fault diagnosis, and log summarization. LogEval evaluates each task using 4,000 publicly available log data entries and employs 15 different prompts for each task to ensure a thorough and fair assessment.
  arXiv  Detail & Related papers  (2024-07-02T02:39:33Z)
• Log Parsing Evaluation in the Era of Modern Software Systems [47.370291246632114]
  We focus on one integral part of automated log analysis, log parsing, which is the prerequisite to deriving any insights from logs. Our investigation reveals problematic aspects within the log parsing field, particularly its inefficiency in handling heterogeneous real-world logs. We propose a tool, Logchimera, that enables estimating log parsing performance in industry contexts.
  arXiv  Detail & Related papers  (2023-08-17T14:19:22Z)
• Self-Supervised Log Parsing [59.04636530383049]
  Large-scale software systems generate massive volumes of semi-structured log records. Existing approaches rely on log-specifics or manual rule extraction. We propose NuLog that utilizes a self-supervised learning model and formulates the parsing task as masked language modeling.
  arXiv  Detail & Related papers  (2020-03-17T19:25:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.