Download [This article belongs to Volume - 58, Issue - 3]
Gongcheng Kexue Yu Jishu/Advanced Engineering Science
Journal ID : AES-1673-3073-3080

Title : FROM QUERIES TO REASONING: LLM-ORCHESTRATED ITERATIVE LOG SEARCH FOR SCALABLE ROOT CAUSE ANALYSIS
Akila Balasubramanian

Abstract : Modern distributed systems generate log data at volumes exceeding one billion entries per day, creating a critical bottleneck for root cause analysis (RCA). Existing log search systems operated in a stateless query-response model — each query executed independently without retaining prior context — forcing engineers to manually carry diagnostic state across repeated full-dataset scans. This approach was computationally wasteful, cognitively demanding, and structurally mismatched with the iterative, hypothesis-driven nature of effective RCA. This paper presented a stateful iterative log search framework that transformed log exploration from retrieval into reasoning. The framework integrated three purpose-designed components: a vectorised statistical pre-scan that identified high-priority log clusters without full LLM processing, a token-aware condensation layer that produced structured LLM-compatible digests preserving anomaly signals, error patterns, and temporal dynamics within strict token budgets, and an LLM orchestrator that generated and refined queries based on evolving hypothesis state maintained by a persistent state manager. Evaluation on a production-scale corpus of over one billion log entries across 47 microservices demonstrated 23% improvement in RCA accuracy, 63% reduction in query execution cost, and 2.9× acceleration in time-to-resolution compared to stateless baselines. Ablation analysis confirmed that state persistence and token-aware condensation were the highest-impact individual components.

Keywords : Log Analysis; Root Cause Analysis; Large Language Models; Iterative Search; AIOps; Log Condensation; Stateful Reasoning