LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnostics
Not on the map. Why?
Abstract (arXiv)
System log anomaly detection is critical for maintaining the reliability of large-scale software systems, yet traditional methods struggle with the heterogeneous and evolving nature of modern log data. Recent advances in Large Language Models (LLMs) offer promising new approaches to log understanding, but a systematic comparison of LLM-based methods against established techniques remains lacking. In this paper, we present a comprehensive benchmark study evaluating both LLM-based and traditional approaches for log anomaly detection across four widely-used public datasets: HDFS, BGL, Thunderbird, and Spirit. We evaluate three categories of methods: (1) classical log parsers (Drain, Spell, AEL) combined with machine learning classifiers, (2) fine-tuned transformer models (BERT, RoBERTa), and (3) prompt-based LLM approaches (GPT-3.5, GPT-4, LLaMA-3) in zero-shot and few-shot settings. Our experiments reveal that while fine-tuned transformers achieve the highest F1-scores (0.96-0.99), prompt-based LLMs demonstrate remarkablezero-shot capabilities (F1: 0.82-0.91) without requiring any labeled training data -- a significant advantage for real-world deployment where labeled anomalies are scarce. We further analyze the cost-accuracy trade-offs, latency characteristics, and failure modes of each approach. Our findings provide actionable guidelines for practitioners choosing log anomaly detection methods based on their specific constraints regarding accuracy, latency, cost, and label availability. All code and experimental configurations are publicly available to facilitate reproducibility.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 10 of its 25 references that are in the map. First posted on arXiv 14 Apr 2026.
Builds on
10 of 25 references.
References · 10
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
- 2020DeBERTa: Decoding-enhanced BERT with Disentangled Attentioncited by 2,181
- 2021LogBERT: Log Anomaly Detection via BERTcited by 118
- 2023Automatic Root Cause Analysis via Large Language Models for Cloud Incidentscited by 84
- 2020Loghub: A Large Collection of System Log Datasets for AI-driven Log Analyticscited by 70
- 2021Log-based Anomaly Detection Without Log Parsingcited by 59
- 2022Log-based Anomaly Detection with Deep Learning: How Far Are We?cited by 57
- 2018Tools and Benchmarks for Automated Log Parsingcited by 56
- 2023Log Parsing with Prompt-based Few-shot Learningcited by 29
Built on by
Citing papers per year: 2026: 1.
1 paper.