FAME

FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection

FAME is a label-efficient mixture-of-experts framework for fine-grained, message-level log anomaly detection in production systems. It uses an LLM once offline to partition log templates into failure domains and derive binary labels from at most K examples per template, then trains a lightweight router and domain experts for on-premise inference. On the BGL benchmark it achieves F1=98.16 at K=100 (76x annotation reduction) and on Thunderbird reaches F1=99.95 with perfect recall. The approach addresses the coarse granularity of session/window-level detectors while keeping continuous monitoring costs tractable.