Evidence-Constrained Log Anomaly Detection and LLM-Ready Failure Narrative Generation with Selective Refusal on LogEval 2024

This paper presents ECLA, an evidence-constrained, LLM-ready pipeline for LogEval 2024-style log intelligence on the HDFS-2k corpus. The study links four tasks: log parsing, window-level anomaly detection, root-cause ranking, and deterministic failure-narrative generation with selective refusal. The corpus contains 2,000 HDFS log lines, 14 structured event templates, six components, 1,994 block identifiers, and 80 warning lines. Rather than asking a language model to infer causes from raw text, ECLA extracts parser templates, block and node evidence, and window-level event signals; it then verbalizes a diagnosis only when the evidence packet supports the claim. Evaluation used a fixed seed, non-overlapping 10-line windows, a stratified train/test split for anomaly detection, and a separate anomalous-window protocol for root-cause ranking. The ECLA parser achieved perfect mapped parsing accuracy while retaining near-gold template compactness. For anomaly detection, ECLA achieved F1 = 0.926 and PR-AUC = 0.994, outperforming the learned TF-IDF baselines. For root-cause ranking, ECLA obtained Top-1 = 0.935 and Top-2 = 1.000. The selective narrative layer answered 89 actionable windows and refused 111 non-actionable windows; under the study’s rule-based claim verifier, it produced no unsupported diagnoses. These results support selective refusal as a reproducible control for evidence-constrained log explanations, while not constituting an evaluation of a deployed LLM or human operator trust.

Keywords: Log anomaly detection, root-cause analysis, evidence-grounded generation, selective refusal, HDFS.

Full Text in PDF