Log-Insight Automating Microservice Incident Diagnosis via Neuro-Symbolic Log Analysis

Jul 16, 2026

Diagnosing production incidents in large-scale microservice systems is labour-intensive and time-critical for Site Reliability Engineers (SREs). A single 30-minute incident window can produce over two million log lines (about 1.2 billion characters), making direct LLM-based Root Cause Analysis impractical. Log-Insight automates the SRE triage workflow using symbolic stages for sampling, schema inference, clustering, entropy-guided compression, skew analysis, and LLM synthesis of a compact evidence dossier. Evaluations on 11 incidents show MRR=0.790 and correct root cause in top-3 hypotheses for over 90% of runs within under one minute end-to-end latency.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages8

Reading Time20 min

Abstract

Introduction

Problem: incident diagnosis in microservices

Existing automated approaches and gaps

Log-Insight overview

Symbolic triage workflow and LLM synthesis

Evaluation results

Metrics and latency

Findings and research directions

Log-Insight: Automating Microservice Incident Diagnosis via Neuro-Symbolic Log Analysis Carlos Garcia-Hernandez∗ Huawei Ireland Research Centre Dublin, Ireland Mingxue Wang Huawei Ireland Research Centre Dublin, Ireland Aymane Abdali∗ Huawei Ireland Research Centre Dublin, Ireland Fei Shen Huawei Dongguan R&D Centre Dongguan, China Guangyu Wu Huawei Ireland Research Centre Dublin, Ireland Zhaoyu Pang Huawei Dongguan R&D Centre Dongguan, China Yanbin Zhang Huawei Dongguan R&D Centre Dongguan, China arXiv :2607 .08529v 1 [ cs .IR] 9 Jul 2026 Abstract Diagnosing production incidents in large-scale microservice systems is labour-intensive and time-critical for Site Reliability Engineers (SREs) . A single 30-minute incident window in our deployment can generate over two million log lines across many interdependent services—approximately 1.2 billion characters, or 26,000× the 46,000-character per-request budget of our enterprise LLM API—making direct LLM-based Root Cause Analysis (RCA) infeasible. Existing approaches each leave a gap: template-based parsers compress volume but produce no semantic anomaly reasoning; deep-learning anomaly detectors emit black-box binary signals; and LLM-based pipelines suffer context overflow and domain hallucination on raw telemetry. We present Log-Insight, an automated incident-diagnosis system deployed in production at Huawei. The key design principle is to automate the SRE’s manual triage workflow: symbolic stages replicate the structured investigation a skilled SRE would perform—sampling, schema understanding, pattern clustering, statistical anomaly ranking—and hand the LLM only a compact, preranked evidence dossier to synthesise into a ranked hypothesis report. A six-stage pipeline (Two-Pass Sampling, Schema Inference & Memory, Drain3 Pattern Clustering, Two-Layer Entropy-Guided Compression, Contrastive Skew Analysis, Generative Synthesis) reduces millions of raw events by 1,000–7,000× while preserving statistically significant failure signals. Evaluated on 11 historical production incidents (110 runs, SREvalidated ground truth), Log-Insight achieves MRR = 0.790, returning the correct root cause within the top-3 hypotheses in over 90% of runs in under a minute of end-to-end latency. We report two systematic failure modes, two active mitigations, and four open research directions. The Forensic Evidence section—listing exact ∗ Equal contribution. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s) . ASE’26, Munich, Germany © 2026 Copyright held by the owner/author(s) . ACM ISBN 978-x-xxxx-xxxx-x/YYYY/MM [https://doi.org/10.1145/nnnnnnn.nnnnnnn](https://doi.org/10.1145/nnnnnnn.nnnnnnn) log templates and skew statistics—was consistently identified by operators as a key adoption factor, shifting the system’s perceived role from opaque oracle to investigative assistant. CCS Concepts • Software and its engineering → Software reliability; • Information systems → Retrieval tasks and goals; • Computing methodologies → Natural language generation. Keywords AIOps, Log Analysis, Root Cause Analysis, Incident Management, Automated Software Engineering, Entropy, Neuro-Symbolic Systems, Site Reliability Engineering ACM Reference Format: Carlos Garcia-Hernandez, Aymane Abdali, Guangyu Wu, Mingxue Wang, Fei Shen, Zhaoyu Pang, and Yanbin Zhang. 2026. Log-Insight: Automating Microservice Incident Diagnosis via Neuro-Symbolic Log Analysis. In Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE ’26). ACM, New York, NY, USA, 8 pages. [https:](https:)//[doi.org/10.1145/nnnnnn

FAQs

Why is microservice incident diagnosis difficult in production environments?

It is labour-intensive and time-critical for SREs, and incident windows can generate millions of log lines, creating an overwhelming volume for manual inspection.

What limitation prevents direct LLM-based root cause analysis on raw telemetry?

The context window overflows with massive log volume, and raw telemetry can lead to domain hallucination and unreliable reasoning.

How does Log-Insight automate SRE triage while reducing log volume?

It uses a six-stage neuro-symbolic pipeline to sample logs, infer schemas and memory, cluster patterns, compress via entropy guidance, perform contrastive skew analysis, and then provide the LLM a compact ranked evidence dossier.

Jul 16, 2026

Upload by Valentina