PhD Oral Exam - Zeyang Ma, Computer Science

When studying for a doctoral degree (PhD), candidates submit a thesis that provides a critical review of the current state of knowledge of the thesis subject as well as the student’s own contributions to the subject. The distinguishing criterion of doctoral graduate research is a significant and original contribution to knowledge.

Once accepted, the candidate presents the thesis orally. This oral exam is open to the public.

Abstract

Software logs are essential runtime evidence for modern software systems. Yet they are difficult to analyze automatically because they are high-volume, semi-structured, system-specific, and continuously evolving. Log parsing is foundational: it separates stable template text from dynamic values and produces structured events for downstream analysis.

Syntax-based parsers are efficient and deployable, but surface regularities make them brittle under template drift, rare events, and ambiguous static-dynamic boundaries. Large language models (LLMs) can infer templates from heterogeneous log text, but practical LLM-based parsing faces limited labels, per-line inference cost, sensitive operational data, weak prompt-only adaptation, reproducibility concerns, and deployment risk.

The dissertation develops four studies. LLM4Log maps LLM-based log analysis and positions parsing as a representation bottleneck. LLMParser evaluates open-source LLMs for limited-label parsing, showing exact-template gains but limits on unseen templates and cross-system transfer. The base LibreLog replaces labels with unsupervised grouping, representative-log retrieval, validation, bounded self-reflection, and template memory, and evaluates LogHub-2.0-scale parsing. The LibreLog extension analyzes template-level evaluation, grouping strategy, selective larger-model reflection, and residual errors.

Across these studies, practical LLM-based parsing is a pipeline problem. Model capability helps infer static-dynamic boundaries, but accuracy, efficiency, and deployment depend on evidence selection, validation, repair, and template reuse. The thesis takeaway is that log-specific pipeline design makes LLM-based parsing accurate, efficient, privacy-conscious, and deployable.