Debugging Tabular Log as Dynamic Graphs

TL;DR

This paper tackles the challenge of debugging tabular logs without relying on heavyweight LLMs. It introduces GraphLogDebugger, which treats online tabular logs as evolving dynamic heterogeneous graphs and performs anomaly detection via a lightweight dynamic Graph Neural Network that predicts edge likelihoods. The approach unifies object, event, and text-embedded information within a dynamic graph, enabling online, scalable anomaly detection with negative sampling. Empirical results on four real-world datasets show that GraphLogDebugger achieves higher accuracy and throughput than LLM-based and MLP baselines, highlighting its practical relevance for real-time log debugging across domains.

Abstract

Tabular log abstracts objects and events in the real-world system and reports their updates to reflect the change of the system, where one can detect real-world inconsistencies efficiently by debugging corresponding log entries. However, recent advances in processing text-enriched tabular log data overly depend on large language models (LLMs) and other heavy-load models, thus suffering from limited flexibility and scalability. This paper proposes a new framework, GraphLogDebugger, to debug tabular log based on dynamic graphs. By constructing heterogeneous nodes for objects and events and connecting node-wise edges, the framework recovers the system behind the tabular log as an evolving dynamic graph. With the help of our dynamic graph modeling, a simple dynamic Graph Neural Network (GNN) is representative enough to outperform LLMs in debugging tabular log, which is validated by experimental results on real-world log datasets of computer systems and academic papers.

Figures (4)

• Figure 1: Comparing GraphLogDebugger with two existing lines of works. Processing log with domain-specific graphs requires custom text parsing, which lacks flexibility. LLM-based log processing overcomes this shortcoming by the general comprehension skills of LLMs, but suffers from poor efficiency. GraphLogDebugger combines the advantages of graph representation and those of LLMs and balances well generalizability and scalability.
• Figure 2: GraphLogDebugger framework. The framework checkpoints the GNN $\theta$ and the dynamic graph snapshot $G_n$. When a new log entry emerges, we first extract a sub-graph $g_n$ and use it to update the graph. Then, we predict the links introduced by $g_n$ in the dynamic graph by GNN $\theta$, whose results indicate the anomaly.
• Figure 4: Anomaly score distribution of five tasks by GraphLogDebugger. Score distributions of anomalies and normal examples separate for simpler tasks and mix up for more difficult tasks.
• Figure : GraphLogDebugger: Online training for dynamic-graph anomaly detection

Theorems & Definitions (2)

• Definition 3.1: Online Anomaly Detection of Tabular Log
• Definition 4.1: Online Anomaly Detection of Tabular Log (Dynamic Graph)