Fine-Tuning Small Language Models for Solution-Oriented Windows Event Log Analysis

• URL: http://arxiv.org/abs/2605.06330v1
• Date: Thu, 07 May 2026 14:24:59 GMT
• Title: Fine-Tuning Small Language Models for Solution-Oriented Windows Event Log Analysis
• Abstract summary: Large language models (LLMs) have shown promise for event log analysis, but their high computational requirements, reliance on cloud infrastructure, and security concerns limit practical deployment.<n>Small language models (SLMs) present a light-weight alternative that can be fine-tuned for a specific purpose and hosted locally.<n>This paper investigates whether SLMs, when fine-tuned for a specific task, can serve as a practical alternative for event log analysis while also generating solutions.
• Score: 2.215422958791151
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language models (LLMs) have shown promise for event log analysis, but their high computational requirements, reliance on cloud infrastructure, and security concerns limit practical deployment. In addition, most existing approaches focus only on the identification of the problem and do not provide actionable remediation. Small language models (SLMs) present a light-weight alternative that can be fine-tuned for a specific purpose and hosted locally. This paper investigates whether SLMs, when fine-tuned for a specific task, can serve as a practical alternative for event log analysis while also generating solutions. We first create a large-scale synthetic Windows event log dataset that contains remediation actions using a high-performing LLM. We then fine-tune multiple SLMs and LLMs using the LoRA parameter-efficient fine-tuning technique and evaluate their performance by comparing with expert assessment. The results show that the dataset accurately reflects real-world scenarios and that fine-tuned SLMs consistently outperform LLMs in identifying issues and providing relevant remediation, while requiring fewer computational resources.

Related papers

• Prompting Is All You Need: Multi-view Prompting Large Language Models for Aspect-Based Sentiment Analysis [5.3558051475405515]
  We introduce Multi-View Prompting (LLM-MvP), which adapts the multi-view principle of considering multiple element orderings to LLM prompting.<n>LLM-MvP achieves performance competitive or superior to finetuned approaches while substantially reducing computational overhead.
  arXiv  Detail & Related papers  (2026-05-27T07:04:39Z)
• WRAVAL -- WRiting Assist eVALuation [7.441391098440092]
  Small Language Models (SLMs) typically score 3-4 times lower than Large Language Models (LLMs) on reasoning metrics.<n>We propose an evaluation framework specifically designed to highlight SLMs' capabilities in non-reasoning tasks.
  arXiv  Detail & Related papers  (2025-12-19T09:21:27Z)
• TravelBench : Exploring LLM Performance in Low-Resource Domains [2.2917707112773593]
  We curated 14 travel-domain datasets spanning 7 common NLP tasks using anonymised data from real-world scenarios.<n>We report on the accuracy, scaling behaviour, and reasoning capabilities of LLMs in a variety of tasks.
  arXiv  Detail & Related papers  (2025-10-03T04:44:34Z)
• Towards Efficient Multi-LLM Inference: Characterization and Analysis of LLM Routing and Hierarchical Techniques [14.892995952768352]
  Language Models (LMs) have excelled at tasks like text generation, summarization, and question answering.<n>Their inference remains computationally expensive and energy intensive in settings with limited hardware, power, or bandwidth.<n>Recent approaches have introduced multi LLM intelligent model selection strategies that dynamically allocate computational resources based on query complexity.
  arXiv  Detail & Related papers  (2025-06-06T23:13:08Z)
• LLMs as Data Annotators: How Close Are We to Human Performance [47.61698665650761]
  Manual annotation of data is labor-intensive, time-consuming, and costly.<n>In-context learning (ICL) in which some examples related to the task are given in the prompt can lead to inefficiencies and suboptimal model performance.<n>This paper presents experiments comparing several LLMs, considering different embedding models, across various datasets for the Named Entity Recognition (NER) task.
  arXiv  Detail & Related papers  (2025-04-21T11:11:07Z)
• Mitigating Forgetting in LLM Fine-Tuning via Low-Perplexity Token Learning [65.23593936798662]
  We show that fine-tuning with LLM-generated data improves target task performance and reduces non-target task degradation.<n>This is the first work to provide an empirical explanation based on token perplexity reduction to mitigate catastrophic forgetting in LLMs after fine-tuning.
  arXiv  Detail & Related papers  (2025-01-24T08:18:56Z)
• Leveraging Online Olympiad-Level Math Problems for LLMs Training and Contamination-Resistant Evaluation [55.21013307734612]
  AoPS-Instruct is a dataset of more than 600,000 high-quality QA pairs.<n>LiveAoPSBench is an evolving evaluation set with timestamps, derived from the latest forum data.<n>Our work presents a scalable approach to creating and maintaining large-scale, high-quality datasets for advanced math reasoning.
  arXiv  Detail & Related papers  (2025-01-24T06:39:38Z)
• AdaptiveLog: An Adaptive Log Analysis Framework with the Collaboration of Large and Small Language Model [42.72663245137984]
  This paper introduces an adaptive log analysis framework known as AdaptiveLog.<n>It effectively reduces the costs associated with LLM while ensuring superior results.<n>Experiments demonstrate that AdaptiveLog achieves state-of-the-art results across different tasks.
  arXiv  Detail & Related papers  (2025-01-19T12:46:01Z)
• ToolScan: A Benchmark for Characterizing Errors in Tool-Use LLMs [77.79172008184415]
  TOOLSCAN is a new benchmark to identify error patterns in LLM output on tool-use tasks.<n>We show that even the most prominent LLMs exhibit these error patterns in their outputs.<n>Researchers can use these insights from TOOLSCAN to guide their error mitigation strategies.
  arXiv  Detail & Related papers  (2024-11-20T18:56:22Z)
• SELF-GUIDE: Better Task-Specific Instruction Following via Self-Synthetic Finetuning [70.21358720599821]
  Large language models (LLMs) hold the promise of solving diverse tasks when provided with appropriate natural language prompts. We propose SELF-GUIDE, a multi-stage mechanism in which we synthesize task-specific input-output pairs from the student LLM. We report an absolute improvement of approximately 15% for classification tasks and 18% for generation tasks in the benchmark's metrics.
  arXiv  Detail & Related papers  (2024-07-16T04:41:58Z)
• FederatedScope-LLM: A Comprehensive Package for Fine-tuning Large Language Models in Federated Learning [70.38817963253034]
  This paper first discusses these challenges of federated fine-tuning LLMs, and introduces our package FS-LLM as a main contribution. We provide comprehensive federated parameter-efficient fine-tuning algorithm implementations and versatile programming interfaces for future extension in FL scenarios. We conduct extensive experiments to validate the effectiveness of FS-LLM and benchmark advanced LLMs with state-of-the-art parameter-efficient fine-tuning algorithms in FL settings.
  arXiv  Detail & Related papers  (2023-09-01T09:40:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.