An Empirical Study on the Prevalence of Rare Logs and its Impact of Log Parsing

Abstract

Log parsing is a critical step in automated log analysis, enabling tasks such as debugging, monitoring, root cause analysis, and anomaly detection by transforming unstructured log messages into structured representations. Despite extensive research on log parsing, real-world log data exhibits a pronounced long-tail structure at the template level: a small number of frequent log templates dominate the data, while a large fraction of templates occur only a few times. These rare templates often correspond to failures, abnormal behaviors, or rare system events, yet they are severely underrepresented in commonly used benchmarks such as LogHub-2.0.In this paper, we conduct a comprehensive empirical study across multiple real-world log datasets to quantify the prevalence of rare log templates and to examine their impact on log parsing evaluation. Our analysis shows that, on average, approximately 12% of log templates are rare, while collectively accounting for less than 0.03% of log messages. In our research, rare log events defined as groups that having fewer than five associated log instances. We further demonstrate that commonly used evaluation metrics, such as Parsing Accuracy (PA) and Grouping Accuracy (GA), are dominated by frequent templates and can obscure substantial performance degradation on rare ones. Using template-level metrics, including F1_score of Template accuracy(FTA) and F1_score of grouping accuracy(FGA), we show that strong overall accuracy can coexist with poor performance on rare but operationally critical log templates. These findings highlight the need for evaluation protocols that explicitly account for template frequency when assessing log parsers in real-world settings.