R-Log: Multi-Task Log Analysis Framework

• R-Log is a log-analysis framework that reframes traditional mapping by generating explicit reasoning trajectories alongside final answers to tackle five distinct tasks.
• It employs a two-stage training process combining supervised cold-start on curated reasoning traces with reinforcement learning in a simulated operations-and-maintenance environment.
• Empirical evaluations show significant improvements, including a 228.05% gain in generalization and a fast variant offering 5x speedup with 93% of the original efficacy.

Searching arXiv for papers on “R-Log” and closely related log-analysis LLM methods.

R-Log is a log-analysis framework that trains a general-purpose LLM to map an input log and task instruction to a reasoning trajectory and final answer, rather than directly to an answer. In the formulation introduced in 2025, it targets five log-analysis tasks—log parsing, anomaly detection, log interpretation, root cause analysis, and solution recommendation—and combines supervised cold-start training on curated reasoning traces with reinforcement learning in a simulated operations-and-maintenance environment. The framework is presented as a response to two limitations of direct supervised fine-tuning on log–label pairs: domain discrepancy between natural-language pretraining and specialized logs, and token-level loss allocation that can let lengthy contexts overwhelm critical short details. The reported system uses a curated dataset of 2k+ reasoning trajectories, achieves gains across five tasks, improves performance in unseen scenarios by 228.05%, and includes an inference-oriented variant, R-Log-fast, with 5x speedup while retaining 93% of efficacy (Liu et al., 30 Sep 2025).

1. Definition and analytic scope

R-Log reframes log analysis from a direct mapping

$X \rightarrow Y$

to a structured mapping

$X \rightarrow (R, Y),$

where $X$ is the input log plus task instruction, $R$ is a reasoning trajectory, and $Y$ is the final answer. The intended behavior is explicitly modeled on the step-by-step analytical process of human operations-and-maintenance engineers, with the claim that reasoning trajectories expose reusable analytic rules rather than only task-specific correlations (Liu et al., 30 Sep 2025).

The framework is defined over five tasks: log parsing, anomaly detection, log interpretation, root cause analysis, and solution recommendation. The motivating problem is that modern logs are highly structured but non-natural in form, contain domain-specific tokens such as IPs, timestamps, paths, IDs, and error codes, and vary substantially across systems. Within this setting, the paper argues that direct supervised fine-tuning on log–answer pairs tends to learn $X \mapsto Y$ correlations by rote rather than the underlying analytic rules, and that token-level training is poorly aligned when short critical details are embedded in long outputs. The example used repeatedly is an interpretation error in which existing LLMs hallucinated “a minute” instead of the correct “1ms” (Liu et al., 30 Sep 2025).

This scope distinguishes R-Log from single-task log-analysis systems. It is not restricted to anomaly detection, template extraction, or free-form troubleshooting alone. Instead, it is presented as a multi-task training paradigm for heterogeneous log-analysis workloads, with task-specific reward definitions but a shared reasoning-first policy.

2. Human-aligned reasoning representation and the Log Reasoning Dataset

A central component of R-Log is a curated Log Reasoning Dataset of 2,632 $(X,R,Y)$ examples built from 13 reasoning templates derived from manual O&M practice, prior log-analysis rules, and practitioner interviews. The templates are distributed across the five tasks as follows: 2 for log parsing, 3 for anomaly detection, 2 for log interpretation, 3 for root cause analysis, and 3 for solution recommendation. The average reasoning length over the dataset is 171.01 words (Liu et al., 30 Sep 2025).

The template design is organized around two broad reasoning styles. Conceptual strategies abstract patterns and semantic cues from the log, while procedural strategies resemble checklist-like inspection of specific fields or attributes. For log parsing, the described strategies include both procedural replacement of dynamic fields such as IP addresses and time indicators, and conceptual identification of token patterns indicative of variables. For root cause analysis, the described chain is to recognize key problems, determine the direct cause, and trace backward to the root cause. For solution recommendation, the strategy is to reflect on the error and context, generate several candidate corrective actions, assess them, and select an optimized solution (Liu et al., 30 Sep 2025).

The dataset is constructed from an existing LogLM training set containing 2600+ $(X,Y)$ samples. For each sample, a task-specific template is selected, and an advanced LLM is prompted to generate a reasoning trajectory $R$ that follows that template step by step. The resulting supervision pairs therefore contain explicit intermediate analysis rather than only task labels or answers.

Task	Templates	Samples
Log parsing	2	1400
Anomaly detection	3	332
Log interpretation	2	300
Root cause analysis	3	300
Solution recommendation	3	300

For log parsing, the domain coverage includes HDFS, Hadoop, Zookeeper, BGL, HPC, Linux, and Proxifier, with 200 samples for each listed domain. For anomaly detection, the dataset includes BGL and Spirit. For the interpretation, root-cause, and solution-recommendation tasks, the table in the paper reports Apache-domain data and much longer average reasoning trajectories, consistent with the longer free-form answers required by those tasks (Liu et al., 30 Sep 2025).

3. Cold-start supervision and reinforcement learning

R-Log uses a two-stage training pipeline. The first stage is a supervised cold start on the reasoning dataset, initialized from Qwen2.5-7B. The model is trained to produce outputs with explicit tags, > R and <answer> Y </answer>, so that reasoning and answer segments are structurally separated. The cold-start objective is

$$\theta_c = \argmax_{\theta} \sum\limits_{(X,Y,R) \in D} \log P\big([R;Y]\mid[I;X],\theta\big),$$

where $X \rightarrow (R, Y),$0 is the Log Reasoning Dataset and $X \rightarrow (R, Y),$1 is a short task instruction such as “Find the root cause of errors in the following log” (Liu et al., 30 Sep 2025).

The reported cold-start implementation uses LLaMAFactory with 480 training steps, learning rate $X \rightarrow (R, Y),$2, and batch size 32. This stage is described as establishing an initial human-aligned reasoning capability and as a better starting policy for later reinforcement learning than direct answer-only supervision (Liu et al., 30 Sep 2025).

The second stage places the model in a simulated heterogeneous O&M environment. Here the state is the task instruction and input log, the action is a complete structured response containing reasoning and answer, and the reward is task-dependent. The RL algorithm is Group Relative Policy Optimization (GRPO), implemented with VeRL, using 480 training steps, learning rate $X \rightarrow (R, Y),$3, batch size 16, and 8 rollouts (Liu et al., 30 Sep 2025).

The reward begins with a format constraint: outputs must contain non-empty <think> and <answer> segments. If formatting fails, the model receives a penalty of $X \rightarrow (R, Y),$4; if formatting succeeds, it receives a bonus $X \rightarrow (R, Y),$5, with $X \rightarrow (R, Y),$6. Task-specific rewards then differ by task family. Log parsing uses a combination of variable-level F1 and edit-distance similarity; anomaly detection uses exact binary correctness; log interpretation, root cause analysis, and solution recommendation use BLEU together with ROUGE-1, ROUGE-2, and ROUGE-L. The paper states that all answer rewards are normalized to $X \rightarrow (R, Y),$7, yielding an overall reward range of $X \rightarrow (R, Y),$8 (Liu et al., 30 Sep 2025).

A notable design decision is that R-Log does not impose an explicit RL reward on the reasoning trajectory itself. The paper’s rationale is that multiple distinct reasoning paths may lead to the same correct answer. Reasoning is therefore shaped indirectly: first by cold-start supervision on curated trajectories, then by answer-centered RL.

4. Evaluation protocol and empirical results

The evaluation uses the open-source benchmark from LogLM and real-world logs across 10 domains. For log parsing and anomaly detection, the reported split is 1:9 train:test; for log interpretation, root cause analysis, and solution recommendation, the split is 8:2. For anomaly detection, the paper uses corrected annotations from Xu et al., who fixed around 10% annotation errors in the original datasets (Liu et al., 30 Sep 2025).

The baseline set includes task-specific systems such as Spell, Drain, LogParse, and LogStamp; general-purpose LLMs such as LLaMA-3-70B, LLaMA-3.1-405B, and Qwen2.5-7B-Instruct; and domain-specialized or multi-task systems such as LogPrompt, OWL-7B, SuperLog-7B, and LogLM-7B. A direct in-domain supervised baseline, Qwen2.5-7B-SFT, is also included (Liu et al., 30 Sep 2025).

On log parsing, the paper reports average performance of RI 0.987 and F1 0.956 for R-Log-7B, compared with RI 0.986 and F1 0.859 for SuperLog-7B, RI 0.849 and F1 0.794 for LogPrompt, and RI 0.822 and F1 0.702 for LogLM-7B. The strongest relative gains are in variable-recognition F1 rather than in the already-high clustering-like RandIndex (Liu et al., 30 Sep 2025).

On anomaly detection, the reported BGL results for R-Log are precision 0.493, recall 0.908, and F1 0.639; on Spirit they are precision 0.446, recall 0.934, and F1 0.603. In both cases these F1 values exceed the compared 7B baselines and the earlier prompting-based systems. The paper interprets this as an indication that R-Log avoids the common imbalance in which a model achieves very high recall but poor precision, or vice versa (Liu et al., 30 Sep 2025).

For the free-form tasks, the reported averages are also consistently higher. In log interpretation, R-Log reaches BLEU 16.671, ROUGE-1 48.593, ROUGE-2 24.754, and ROUGE-L 43.880. In root cause analysis, it reaches BLEU 13.064, ROUGE-1 41.453, ROUGE-2 19.518, and ROUGE-L 36.492. In solution recommendation, it reaches BLEU 6.759, ROUGE-1 33.587, ROUGE-2 12.838, and ROUGE-L 29.925. The paper reads the BLEU gains as evidence of more precise and readable answers with fewer hallucinated contents (Liu et al., 30 Sep 2025).

5. Generalization, hallucination resistance, and R-Log-fast

The paper’s most prominent generalization result comes from an unseen-task setting in which log variable classification is excluded from training. The evaluation contains 14,000 logs from 7 domains and 29,711 variable-category annotations over the classes OID, LOI, OBN, TDA, CRS, and OBA. On this task, R-Log outperforms LogLM-7B by 228.05%, with especially large gains on categories such as TDA and OBA (Liu et al., 30 Sep 2025).

The reported per-category F1 values are 0.567 vs 0.226 for OID, 0.665 vs 0.269 for LOI, 0.188 vs 0.037 for OBN, 0.714 vs 0.166 for TDA, 0.244 vs 0.101 for CRS, and 0.344 vs 0.031 for OBA, where the first number is R-Log-7B and the second is LogLM-7B. The paper presents this as the clearest evidence that learning reasoning trajectories improves transfer to task structures not seen during training (Liu et al., 30 Sep 2025).

The hallucination argument is illustrated by the interpretation example in which existing LLMs hallucinated “a minute” when the log contained “1ms.” R-Log is said to avoid this by forcing step-by-step evidence inspection before conclusion. The evidence offered is therefore partly qualitative and partly indirect through the improved task metrics, especially BLEU in the long-form tasks (Liu et al., 30 Sep 2025).

To mitigate inference cost, the paper proposes R-Log-fast. The modification is to reverse the output order during training from “think before answer” to “answer before think,” then stop decoding as soon as the <think> token is produced. This preserves the reasoning-enriched training signal while suppressing most reasoning generation at inference time. The reported result is nearly 5x faster inference while keeping 93% of efficacy. The paper notes, however, that the largest degradation under this compression appears in log interpretation, a task for which explicit reasoning seems especially useful (Liu et al., 30 Sep 2025).

6. Ablations, limitations, and deployment constraints

The ablation study compares three settings: plain supervised fine-tuning on $X \rightarrow (R, Y),$9, cold-start training on $X$0, and full R-Log with cold start plus RL. The reported pattern is consistent across tasks: reasoning-trajectory supervision outperforms plain SFT, and RL further improves over cold-start-only training. The gains from RL are described as smaller on log parsing than on the more semantically demanding tasks, which the paper attributes to parsing being relatively easier (Liu et al., 30 Sep 2025).

A second ablation removes the human template guidance when generating reasoning traces. Performance drops on all tasks. The paper interprets this as evidence that curated manual strategies reduce drift and provide a higher-quality reasoning prior than unconstrained LLM-generated rationales (Liu et al., 30 Sep 2025).

The stated limitations are concrete. First, explicit reasoning increases latency and can burden online systems, which is the immediate motivation for R-Log-fast. Second, the reported experiments use only a 7B base model because of budget constraints. Third, the paper notes that some baselines are proprietary or were pretrained on different corpora, so full training-data parity cannot be guaranteed, even though the authors attempt partial alignment through shared task-specific data and token-aligned ablations (Liu et al., 30 Sep 2025).

The paper’s future directions are correspondingly pragmatic: testing on more datasets and tasks, scaling to larger models, and refining the reward design. No perturbation-level or mechanistic faithfulness guarantee for the reasoning traces is claimed; the framework is evaluated through task outcomes and transfer rather than through a separate proof that the generated trajectories are causally faithful explanations.

7. Terminological ambiguity and related research

The label “R-Log” is not unique across arXiv. In current log-analysis LLM literature it refers specifically to the reasoning-based reinforcement-learning framework described above (Liu et al., 30 Sep 2025). However, closely related names and mathematically unrelated uses also exist.

Within log-analysis for software systems, the nearest neighboring formulation is RAGLog, which uses a vector database of normal logs, dense retrieval, and a question-and-answer LLM pipeline for zero-shot anomaly detection. RAGLog operates on raw logs without parsing, uses only normal exemplars in retrieval memory, and reports strong anomaly-detection precision and F1, but it is restricted to anomaly detection rather than the five-task reasoning-RL formulation of R-Log (Pan et al., 2023).

In R software methodology, the name can be confused with logging or monitoring frameworks for the R language. The lumberjack package, for example, monitors how R data objects change while code runs, supports run_file() and %L>%, and separates transformation monitoring from user code; this is a data-state logging framework rather than an LLM log-analysis method (Loo, 2020).

In mathematics, the string “r-log” is widely used in the unrelated sense of $X$1-log-concavity or $X$2-log-convexity of sequences and partition functions. Representative treatments include generalized $X$3-factor infinite log-concavity (Raza et al., 2012), asymptotic $X$4-log-convexity for P-recursive sequences (Hou et al., 2016), and exact eventual $X$5-log-concavity criteria for restricted partition functions (Gajdzica, 2023). These works concern iterated positivity of algebraic log-operators and have no overlap with log-analysis LLMs except the accidental similarity of notation.

Taken in its contemporary systems-LLM sense, R-Log therefore denotes a specific training paradigm: supervised induction of human-aligned reasoning trajectories, followed by reinforcement learning with task-aware rewards, for multi-task analysis of software logs under domain shift and high semantic heterogeneity (Liu et al., 30 Sep 2025).