Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SCOPE: Tree-based Self-Correcting Online Log Parsing via Syntactic-Semantic Collaboration

Dongyi Fan, Suqiong Zhang, Lili He, Ming Liu, Yifan Huo

Abstract

Log parsing is a critical step for automated log analysis in complex systems. Traditional heuristic-based methods offer high efficiency but are limited in accuracy due to overlooking semantic context. In contrast, recent LLM-based parsers improve accuracy via se mantic understanding but incur high latency from frequent model calls. To address this, we propose SCOPE, the first self-correcting online log parsing method that integrates the strengths of both heuristic and LLM-based paradigms. SCOPE introduces a novel bi-directional tree structure that enables efficient template match ing from both forward and reverse directions, resulting in a higher overall matching rate. Additionally, it adopts a two-stage syntactic semantic collaboration framework: a lightweight NLP model first utilizes part-of-speech (POS) information for syntax-based match ing, while the LLM is selectively invoked as a fallback to handle semantically complex cases when uncertainty remains. This design significantly reduces LLM API usage while maintaining high ac curacy, achieving a balance between efficiency and effectiveness. Extensive evaluations on diverse benchmark datasets show that SCOPE outperforms state-of-the-art methods in both accuracy and efficiency. The implementation and datasets are publicly released to facilitate further research.

SCOPE: Tree-based Self-Correcting Online Log Parsing via Syntactic-Semantic Collaboration

Abstract

Log parsing is a critical step for automated log analysis in complex systems. Traditional heuristic-based methods offer high efficiency but are limited in accuracy due to overlooking semantic context. In contrast, recent LLM-based parsers improve accuracy via se mantic understanding but incur high latency from frequent model calls. To address this, we propose SCOPE, the first self-correcting online log parsing method that integrates the strengths of both heuristic and LLM-based paradigms. SCOPE introduces a novel bi-directional tree structure that enables efficient template match ing from both forward and reverse directions, resulting in a higher overall matching rate. Additionally, it adopts a two-stage syntactic semantic collaboration framework: a lightweight NLP model first utilizes part-of-speech (POS) information for syntax-based match ing, while the LLM is selectively invoked as a fallback to handle semantically complex cases when uncertainty remains. This design significantly reduces LLM API usage while maintaining high ac curacy, achieving a balance between efficiency and effectiveness. Extensive evaluations on diverse benchmark datasets show that SCOPE outperforms state-of-the-art methods in both accuracy and efficiency. The implementation and datasets are publicly released to facilitate further research.

Paper Structure

This paper contains 33 sections, 2 equations, 4 figures, 7 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Motivation
  3. Methodology
  4. Overview
  5. Preprocessing
  6. BDPT: Bi-Directional Parse Tree
  7. Parse Tree Construct
  8. Parse Tree Match
  9. Parse Tree Update
  10. PTMP: Priority-based Template Match Pool
  11. NLPE: NLP-based Template Extractor
  12. Stage I: Syntactic Analysis with NLP Model
  13. Stage II: Semantic Analysis with LLM
  14. Evaluation
  15. Experiment Setup
  16. ...and 18 more sections

Figures (4)

  • Figure 1: Architecture of SCOPE
  • Figure 2: Example of log parsing in BDPT. ① A log template is constructed in the bi-directional parse tree. ② A new log is matched to the template in the reverse branch but is missing in the forward branch of the parse tree. ③ The log template is updated and the incorrect branch is obsoleted.
  • Figure 3: Prompt design illustration
  • Figure 4: Efficiency comparison with baseline parsers. SCOPE achieves the highest efficiency, with BDPT (219.5 s), PTMP (125.5 s), and NLPE (138 s).