FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection

FAME, or Failure-Aware Mixture-of-Experts, reframes log anomaly detection from window-level scoring to message-level classification by combining one offline LLM-driven semantic partition with fully on-premise inference. The method parses raw logs with Drain3, samples at most K labeled lines per EventID, then uses an LLM once to group templates into failure domains; a deterministic certification step keeps only partitions consistent with K-shot evidence. FAME exploits an asymmetric property of rare-anomaly sampling: if all K labels in a domain are anomalous, routing alone is statistically sufficient, while all-normal samples still require a classifier. This enables a sparse MoE with a DistilBERT gate, a multiclass selector, and per-domain BERT experts, with a special UNIVERSAL_NORMAL fallback expert calibrated to catch misrouted anomalies. On BGL, the hardest benchmark because normal and anomalous lines often share templates, FAME reaches F1 = 98.16 at K = 100 with 98.18 precision and 98.14 recall, using 53,287 labeled lines, a 76× reduction versus full line-level annotation; it also detects 86.3% of anomalies from unseen EventIDs. On Thunderbird, where anomalies are structurally separable, it achieves F1 = 99.95 with perfect recall. Compared with direct in-context LLM classification, which reaches up to F1 = 96.92 on BGL and incurs $6,698–$10,047 per run for frontier models, FAME costs $10.23 one-time and processes up to 1.20 million lines per hour on a single 4-GPU node. Ablations show that a single global BERT collapses to F1 = 29.65, while removing LLM grouping still leaves a strong TF-IDF variant at F1 = 93.01, indicating that routed specialization is the main source of gain.