CodeAD: Synthesize Code of Rules for Log-based Anomaly Detection with LLMs

TL;DR

CodeAD addresses the need for accurate, interpretable, and efficient log-based anomaly detection by automatically synthesizing executable Python rule functions via LLMs. It introduces a two-phase framework (offline rule synthesis and online monitoring) that combines hierarchical window clustering, anchor-grounded sampling, and a multi-agent, agentic workflow to generate robust normal and abnormal detection rules. Through experiments on BGL, Hadoop, and Thunderbird, CodeAD consistently achieves higher F1 scores and lower costs than state-of-the-art baselines, while preserving interpretability and enabling real-time deployment. The work demonstrates practical impact for production systems by delivering transparent, lightweight, and scalable LogAD capable of guiding alerting and root-cause analysis with minimal infrastructure overhead.

Abstract

Log-based anomaly detection (LogAD) is critical for maintaining the reliability and availability of large-scale online service systems. While machine learning, deep learning, and large language models (LLMs)-based methods have advanced the LogAD, they often suffer from limited interpretability, high inference costs, and extensive preprocessing requirements, limiting their practicality for real-time, high-volume log analysis. In contrast, rule-based systems offer efficiency and transparency, but require significant manual effort and are difficult to scale across diverse and evolving environments. In this paper, We present CodeAD, a novel framework that automatically synthesizes lightweight Python rule functions for LogAD using LLMs. CodeAD introduces a hierarchical clustering and anchor-grounded sampling strategy to construct representative contrastive log windows, enabling LLMs to discern discriminative anomaly patterns. To ensure robustness and generalizability, CodeAD employs an agentic workflow that iteratively generates, tests, repairs, and refines the rules until it meets correctness and abstraction requirements. The synthesized rules are interpretable, lightweight, and directly executable on raw logs, supporting efficient and transparent online anomaly detection. Our comprehensive experiments on three public datasets (BGL, Hadoop, Thunderbird) demonstrate that CodeAD achieves an average absolute improvement of 3.6% F1 score over the state-of-the-art baselines, while processing large datasets up to 4x faster and at a fraction of the cost (total LLM invocation cost under 4 USD per dataset). These results highlight CodeAD as a practical and scalable solution for online monitoring systems, enabling interpretable, efficient, and automated LogAD in real-world environment.

Figures (7)

• Figure 1: A Python implementation of rule code for a JVM GC anomaly zhao2021empirical.
• Figure 2: The overall workflow of CodeAD.
• Figure 3: The rollout process of CodeAD for normal rules synthesis.
• Figure 4: Configuration Analysis of CodeAD.
• Figure 5: Real-time efficiency of CodeAD and baselines (second).