一句话：提出 LogPilot，用 LLM 结合意图感知日志范围界定与时空日志链聚类，自动诊断大规模在线服务告警根因。
大规模在线服务系统中，值班工程师往往需要人工翻阅海量日志才能定位告警根因，现有自动化工具因日志范围界定与告警无关、且难以有效组织复杂数据供推理使用，在实际中效果不佳。本文提出 LogPilot，一个由大语言模型驱动、具备意图感知和可扩展性的日志告警诊断框架。它首先解析告警定义（如 PromQL）中的逻辑，精准识别与告警存在因果关联的日志与请求，避免无关日志干扰；随后将每个请求的执行过程重建为时空日志链，对相似链进行聚类以发现重复出现的执行模式，并把代表性样本交给 LLM 进行诊断，从而使输入既保留充足诊断细节又能压缩进 LLM 的上下文窗口。在火山引擎云真实告警上的评估显示，相比当前最优方法，LogPilot 将根因摘要的有用性提升 50.34%，精确根因定位准确率提升 54.79%，单条告警诊断耗时不到一分钟、成本仅 0.074 美元，并已在生产环境中成功部署。
Effective alert diagnosis is essential for ensuring the reliability of large-scale online service systems. However, on-call engineers are often burdened with manually inspecting massive volumes of logs to identify root causes. While various automated tools have been proposed, they struggle in practice due to alert-agnostic log scoping and the inability to organize complex data effectively for reasoning. To overcome these limitations, we introduce LogPilot, an intent-aware and scalable framework powered by Large Language Models (LLMs) for automated log-based alert diagnosis. LogPilot introduces an intent-aware approach, interpreting the logic in alert definitions (e.g., PromQL) to precisely identify causally related logs and requests. To achieve scalability, it reconstructs each request’s execution into a spatiotemporal log chain, clusters similar chains to identify recurring execution patterns, and provides representative samples to the LLMs for diagnosis. This clustering-based approach ensures the input is both rich in diagnostic detail and compact enough to fit within the LLM’s context window. Evaluated on real-world alerts from Volcano Engine Cloud, LogPilot improves the usefulness of root cause summarization by 50.34% and exact localization accuracy by 54.79% over state-of-the-art methods. With a diagnosis time under one minute and a cost of only $0.074 per alert, LogPilot has been successfully deployed in production, offering an automated and practical solution for service alert diagnosis.
DOI 原文 ·
@inproceedings{paperbot9531,
title = {LogPilot: Intent-aware and Scalable Alert Diagnosis for Large-scale Online Service Systems},
author = {Zhihan Jiang and Jinyang Liu and Yichen Li and Haiyu Huang and Xiao He and Tieying Zhang and Jianjun Chen and Yi Li and Rui Shi and Michael R. Lyu},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00272}
}