Detect, Localize, and Explain: Interactive Hierarchical Log Anomaly Analytics with LLM Augmentation
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866915998136795136 |
|---|---|
| author | Ma, Lei Chaudhary, Suhani Shanbaum, Ethan Tassiadamis, Athanasios VanNostrand, Peter M. Hofmann, Dennis M. Xu, Haowen Rundensteiner, Elke |
| author_facet | Ma, Lei Chaudhary, Suhani Shanbaum, Ethan Tassiadamis, Athanasios VanNostrand, Peter M. Hofmann, Dennis M. Xu, Haowen Rundensteiner, Elke |
| contents | Logs are ubiquitous in modern systems. Unfortunately, their unstructured nature in flat sequences limits understanding of execution behaviors, hindering effective anomaly diagnosis. To address this, Krone introduces a novel hierarchical log abstraction that transforms flat log sequences into semantically coherent units across entity, action, and status levels. Building on this abstraction, Krone introduces a hierarchical orchestration framework that decomposes flat log sequences into hierarchical execution units and performs modular detection over them. It executes and optimizes the modular detection tasks across levels, enabling precise anomaly detection, localization, and explanation with selective invocation of LLM-based reasoning. In this work, we present Krone-viz, an interactive visualization system based on Krone, which makes hierarchical log analysis interpretable and actionable for software engineers and system operators. Demonstrated on the widely used HDFS benchmark dataset, Krone-viz supports: 1) examining hierarchical decompositions of flat log sequences, 2) inspecting detection results and abnormal segments identified by Krone with LLM-generated explanations, and 3) reusing, reviewing, and revising knowledge generated by LLMs with human-in-the-loop guardrails. The code of Krone-viz is available at https://github.com/LeiMa0324/KRONE_Demo_official, and we deploy a live demo at https://leima0324.github.io/KRONE_Demo_official. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_09222 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Detect, Localize, and Explain: Interactive Hierarchical Log Anomaly Analytics with LLM Augmentation Ma, Lei Chaudhary, Suhani Shanbaum, Ethan Tassiadamis, Athanasios VanNostrand, Peter M. Hofmann, Dennis M. Xu, Haowen Rundensteiner, Elke Databases Artificial Intelligence Software Engineering Logs are ubiquitous in modern systems. Unfortunately, their unstructured nature in flat sequences limits understanding of execution behaviors, hindering effective anomaly diagnosis. To address this, Krone introduces a novel hierarchical log abstraction that transforms flat log sequences into semantically coherent units across entity, action, and status levels. Building on this abstraction, Krone introduces a hierarchical orchestration framework that decomposes flat log sequences into hierarchical execution units and performs modular detection over them. It executes and optimizes the modular detection tasks across levels, enabling precise anomaly detection, localization, and explanation with selective invocation of LLM-based reasoning. In this work, we present Krone-viz, an interactive visualization system based on Krone, which makes hierarchical log analysis interpretable and actionable for software engineers and system operators. Demonstrated on the widely used HDFS benchmark dataset, Krone-viz supports: 1) examining hierarchical decompositions of flat log sequences, 2) inspecting detection results and abnormal segments identified by Krone with LLM-generated explanations, and 3) reusing, reviewing, and revising knowledge generated by LLMs with human-in-the-loop guardrails. The code of Krone-viz is available at https://github.com/LeiMa0324/KRONE_Demo_official, and we deploy a live demo at https://leima0324.github.io/KRONE_Demo_official. |
| title | Detect, Localize, and Explain: Interactive Hierarchical Log Anomaly Analytics with LLM Augmentation |
| topic | Databases Artificial Intelligence Software Engineering |
| url | https://arxiv.org/abs/2605.09222 |