# Multivariate Log-based Anomaly Detection for Distributed Database

arXiv: https://arxiv.org/abs/2406.07976 · HTML: https://mlsanity.com/paper/2406.07976/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Jun 2024.

## Built on by (most cited first, 13 of 13)

- [AgentFM: Role-Aware Failure Management for Distributed Databases with LLM-Driven Multi-Agents](https://mlsanity.com/paper/2504.06614/) (2025)
- [A Survey of AIOps in the Era of Large Language Models](https://mlsanity.com/paper/2507.12472/) (2025)
- [Adaptive Root Cause Localization for Microservice Systems with Multi-Agent Recursion-of-Thought](https://mlsanity.com/paper/2508.20370/) (2025)
- [MicroRemed: Benchmarking LLMs in Microservices Remediation](https://mlsanity.com/paper/2511.01166/) (2025)
- [Agentic Memory Enhanced Recursive Reasoning for Root Cause Localization in Microservices](https://mlsanity.com/paper/2601.02732/) (2026)
- [Reducing Events to Augment Log-based Anomaly Detection Models: An Empirical Study](https://mlsanity.com/paper/2409.04834/) (2024)
- [Hypothesize-Then-Verify: Speculative Root Cause Analysis for Microservices with Pathwise Parallelism](https://mlsanity.com/paper/2601.02736/) (2026)
- [From Feedback Loops to Policy Updates: Reinforcement Fine-Tuning for LLM-Based Alpha Factor Discovery](https://mlsanity.com/paper/2605.15412/) (2026)
- [RuntimeSlicer: Towards Generalizable Unified Runtime State Representation for Failure Management](https://mlsanity.com/paper/2603.21495/) (2026)
- [E2E-REME: Towards End-to-End Microservices Auto-Remediation via Experience-Simulation Reinforcement Fine-Tuning](https://mlsanity.com/paper/2604.11094/) (2026)
- [Towards Robust LLM Post-Training: Automatic Failure Management for Reinforcement Fine-Tuning](https://mlsanity.com/paper/2605.04431/) (2026)
- [A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers](https://mlsanity.com/paper/2512.23380/) (2025)
- [Playing social deduction games with reinforcement fine-tuned large language models](https://mlsanity.com/paper/2610.04261/) (2026)

## Abstract (arXiv)

Distributed databases are fundamental infrastructures of today's large-scale software systems such as cloud systems. Detecting anomalies in distributed databases is essential for maintaining software availability. Existing approaches, predominantly developed using Loghub-a comprehensive collection of log datasets from various systems-lack datasets specifically tailored to distributed databases, which exhibit unique anomalies. Additionally, there's a notable absence of datasets encompassing multi-anomaly, multi-node logs. Consequently, models built upon these datasets, primarily designed for standalone systems, are inadequate for distributed databases, and the prevalent method of deeming an entire cluster anomalous based on irregularities in a single node leads to a high false-positive rate. This paper addresses the unique anomalies and multivariate nature of logs in distributed databases. We expose the first open-sourced, comprehensive dataset with multivariate logs from distributed databases. Utilizing this dataset, we conduct an extensive study to identify multiple database anomalies and to assess the effectiveness of state-of-the-art anomaly detection using multivariate log data. Our findings reveal that relying solely on logs from a single node is insufficient for accurate anomaly detection on distributed database. Leveraging these insights, we propose MultiLog, an innovative multivariate log-based anomaly detection approach tailored for distributed databases. Our experiments, based on this novel dataset, demonstrate MultiLog's superiority, outperforming existing state-of-the-art methods by approximately 12%.