arXiv · 2610.02297
From Alert Floods to Precedence Forests: Zero-Prior-Knowledge Incident Triage with LOGOS
Abstract
Commercial observability platforms rely on domain artifacts like distributed traces, topology maps, and baseline metrics. However, when troubleshooting proprietary software, enterprise operators are left with only raw, unannotated text logs. We explore the extreme boundary of log-only diagnosis: To what extent can we isolate failure propagation using strictly raw text logs? We present LOGOS, an unsupervised system that exploits entity-event co-occurrence and temporal precedence to collapse millions of raw log lines into a compact precedence forest. Evaluated across 25 production enterprise outages and 12 open-source issues, LOGOS operates with zero prior knowledge---requiring no seed queries, observed symptoms, or pre-defined incident boundaries. In a median wall-time of 4.5 minutes, LOGOS eliminates a median 99.8% of background noise, achieves 0.76 mean recall, and detects failure cascades with a 16-hour median diagnosis-verified lead time---consolidating alert floods 124x to enable 80% enterprise (100% open-source) zero-shot LLM root-cause accuracy.
Explore related subjects
Keep this discovery
Explore connections, maps & timelines
Radhika Niranjan Mysore. 2026-10-01. From Alert Floods to Precedence Forests: Zero-Prior-Knowledge Incident Triage with LOGOS. https://arxiv.org/abs/2610.02297
Cite the original work for its findings. Save a collection to share your selection of sources.