[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83391-en":3,"doc-seo-83391-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83391,13056703020460,"Valentina","https://ap-avatar.wpscdn.com/avatar/be000253dac470eee5d?_k=1778207105932848923",6,"Technology","Log-Insight Automating Microservice Incident Diagnosis via Neuro-Symbolic Log Analysis","Diagnosing production incidents in large-scale microservice systems is labour-intensive and time-critical for Site Reliability Engineers (SREs). A single 30-minute incident window can produce over two million log lines (about 1.2 billion characters), making direct LLM-based Root Cause Analysis impractical. Log-Insight automates the SRE triage workflow using symbolic stages for sampling, schema inference, clustering, entropy-guided compression, skew analysis, and LLM synthesis of a compact evidence dossier. Evaluations on 11 incidents show MRR=0.790 and correct root cause in top-3 hypotheses for over 90% of runs within under one minute end-to-end latency.","Log-Insight: Automating Microservice Incident Diagnosis via  \nNeuro-Symbolic Log Analysis  \nCarlos Garcia-Hernandez∗  \nHuawei Ireland Research Centre Dublin, Ireland  \nMingxue Wang  \nHuawei Ireland Research Centre Dublin, Ireland  \nAymane Abdali∗ Huawei Ireland Research Centre Dublin, Ireland  \nFei Shen  \nHuawei Dongguan R&D Centre Dongguan, China  \nGuangyu Wu  \nHuawei Ireland Research Centre Dublin, Ireland  \nZhaoyu Pang  \nHuawei Dongguan R&D Centre Dongguan, China  \nYanbin Zhang  \nHuawei Dongguan R&D Centre Dongguan, China  \narXiv :2607 .08529v 1 [ cs .IR] 9 Jul 2026  \nAbstract  \nDiagnosing production incidents in large-scale microservice systems is labour-intensive and time-critical for Site Reliability Engineers (SREs) . A single 30-minute incident window in our deployment can generate over two million log lines across many interdependent services—approximately 1.2 billion characters, or 26,000× the 46,000-character per-request budget of our enterprise LLM API—making direct LLM-based Root Cause Analysis (RCA) infeasible. Existing approaches each leave a gap: template-based parsers compress volume but produce no semantic anomaly reasoning; deep-learning anomaly detectors emit black-box binary signals; and LLM-based pipelines suffer context overflow and domain hallucination on raw telemetry.  \nWe present Log-Insight, an automated incident-diagnosis system deployed in production at Huawei. The key design principle is to automate the SRE’s manual triage workflow: symbolic stages replicate the structured investigation a skilled SRE would perform—sampling, schema understanding, pattern clustering, statistical anomaly ranking—and hand the LLM only a compact, preranked evidence dossier to synthesise into a ranked hypothesis report. A six-stage pipeline (Two-Pass Sampling, Schema Inference & Memory, Drain3 Pattern Clustering, Two-Layer Entropy-Guided Compression, Contrastive Skew Analysis, Generative Synthesis) reduces millions of raw events by 1,000–7,000× while preserving statistically significant failure signals.  \nEvaluated on 11 historical production incidents (110 runs, SREvalidated ground truth), Log-Insight achieves MRR = 0.790, returning the correct root cause within the top-3 hypotheses in over 90% of runs in under a minute of end-to-end latency. We report two systematic failure modes, two active mitigations, and four open research directions. The Forensic Evidence section—listing exact  \n∗ Equal contribution.  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s) .  \nASE’26, Munich, Germany  \n© 2026 Copyright held by the owner/author(s) .  \nACM ISBN 978-x-xxxx-xxxx-x/YYYY/MM [https://doi.org/10.1145/nnnnnnn.nnnnnnn](https://doi.org/10.1145/nnnnnnn.nnnnnnn)  \nlog templates and skew statistics—was consistently identified by operators as a key adoption factor, shifting the system’s perceived role from opaque oracle to investigative assistant.  \nCCS Concepts  \n• Software and its engineering → Software reliability; • Information systems → Retrieval tasks and goals; • Computing methodologies → Natural language generation.  \nKeywords  \nAIOps, Log Analysis, Root Cause Analysis, Incident Management, Automated Software Engineering, Entropy, Neuro-Symbolic Systems, Site Reliability Engineering  \nACM Reference Format:  \nCarlos Garcia-Hernandez, Aymane Abdali, Guangyu Wu, Mingxue Wang, Fei Shen, Zhaoyu Pang, and Yanbin Zhang. 2026. Log-Insight: Automating Microservice Incident Diagnosis via Neuro-Symbolic Log Analysis. In Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE ’26). ACM, New York, NY, USA, 8 pages. [https:](https:)//[doi.org/10.1145/nnnnnn","cbCaijZQSYiyRLtf","https://ap.wps.com/l/cbCaijZQSYiyRLtf","pdf",547930,1,8,"English","en",105,"# Abstract\n# Introduction\n## Problem: incident diagnosis in microservices\n## Existing automated approaches and gaps\n# Log-Insight overview\n## Symbolic triage workflow and LLM synthesis\n# Evaluation results\n## Metrics and latency\n# Findings and research directions","[{\"question\":\"Why is microservice incident diagnosis difficult in production environments?\",\"answer\":\"It is labour-intensive and time-critical for SREs, and incident windows can generate millions of log lines, creating an overwhelming volume for manual inspection.\"},{\"question\":\"What limitation prevents direct LLM-based root cause analysis on raw telemetry?\",\"answer\":\"The context window overflows with massive log volume, and raw telemetry can lead to domain hallucination and unreliable reasoning.\"},{\"question\":\"How does Log-Insight automate SRE triage while reducing log volume?\",\"answer\":\"It uses a six-stage neuro-symbolic pipeline to sample logs, infer schemas and memory, cluster patterns, compress via entropy guidance, perform contrastive skew analysis, and then provide the LLM a compact ranked evidence dossier.\"}]",1784187182,20,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"log-insight-automating-microservice-incident-diagnosis-via-neuro-symbolic-log-analysis","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/technology/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/log-insight-automating-microservice-incident-diagnosis-via-neuro-symbolic-log-analysis/83391/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why is microservice incident diagnosis difficult in production environments?","Question",{"text":75,"@type":76},"It is labour-intensive and time-critical for SREs, and incident windows can generate millions of log lines, creating an overwhelming volume for manual inspection.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What limitation prevents direct LLM-based root cause analysis on raw telemetry?",{"text":80,"@type":76},"The context window overflows with massive log volume, and raw telemetry can lead to domain hallucination and unreliable reasoning.",{"name":82,"@type":73,"acceptedAnswer":83},"How does Log-Insight automate SRE triage while reducing log volume?",{"text":84,"@type":76},"It uses a six-stage neuro-symbolic pipeline to sample logs, infer schemas and memory, cluster patterns, compress via entropy guidance, perform contrastive skew analysis, and then provide the LLM a compact ranked evidence dossier.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,113,118,122,126,129,133],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":111,"slug":112},50,"technology",{"id":114,"doc_module":4,"doc_module_name":45,"category_name":115,"show_sort_weight":116,"slug":117},7,"Healthcare",40,"healthcare",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":119,"show_sort_weight":120,"slug":121},"Research & Report",30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":28,"slug":125},9,"Religion & Spirituality","religion-spirituality",{"id":28,"doc_module":4,"doc_module_name":45,"category_name":127,"show_sort_weight":28,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":45,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":45,"category_name":135,"show_sort_weight":106,"slug":136},19,"General","general"]