Skip to main navigation Skip to search Skip to main content

Practitioners' Expectations on Log Anomaly Detection

Xiaoxue Ma, Yishu Li, Jacky Keung, Xiao Yu*, Huiqi Zou, Zhen Yang, Federica Sarro, Earl T. Barr

*Corresponding author for this work

Research output: Journal Publications and ReviewsRGC 21 - Publication in refereed journalpeer-review

Abstract

Log anomaly detection has become a common practice for software engineers to analyze software system behavior. Despite significant research efforts in log anomaly detection over the past decade, it remains unclear what are practitioners' expectations on log anomaly detection and whether current research meets their needs. To fill this gap, we conduct an empirical study, surveying 312 practitioners from 36 countries about their expectations on log anomaly detection. In particular, we investigate various factors influencing practitioners' willingness to adopt log anomaly detection tools. We then perform a literature review on log anomaly detection, focusing on publications in premier venues from 2015 to 2025, to compare practitioners' needs with the current state of research. Based on this comparison, we highlight the directions for researchers to focus on to develop log anomaly detection techniques that better meet practitioners' expectations. © 2025 IEEE.
Original languageEnglish
Pages (from-to)2455-2471
Number of pages17
JournalIEEE Transactions on Software Engineering
Volume51
Issue number9
Online published8 Jul 2025
DOIs
Publication statusPublished - Sept 2025

Funding

This work obtained ethics approval by the Research Ethics Committee of the Hong Kong Metropolitan University (HE-SF2025/19).

Research Keywords

  • Anomaly detection
  • Interviews
  • Surveys
  • Monitoring
  • Systematic literature review
  • Computer science
  • Real-time systems
  • Manuals
  • Debugging
  • Training
  • Automated log anomaly detection
  • empirical study
  • practitioners' expectations

Fingerprint

Dive into the research topics of 'Practitioners' Expectations on Log Anomaly Detection'. Together they form a unique fingerprint.

Cite this