Abstract
Log anomaly detection has become a common practice for software engineers to analyze software system behavior. Despite significant research efforts in log anomaly detection over the past decade, it remains unclear what are practitioners' expectations on log anomaly detection and whether current research meets their needs. To fill this gap, we conduct an empirical study, surveying 312 practitioners from 36 countries about their expectations on log anomaly detection. In particular, we investigate various factors influencing practitioners' willingness to adopt log anomaly detection tools. We then perform a literature review on log anomaly detection, focusing on publications in premier venues from 2014 to 2024, to compare practitioners' needs with the current state of research. Based on this comparison, we highlight the directions for researchers to focus on to develop log anomaly detection techniques that better meet practitioners' expectations. Index Terms-Automated log anomaly detection, empirical study, practitioners' expectations I. I NTRODUCTION Logs are a crucial source of information in software systems, capturing system runtime behavior and aiding in software engineering tasks like program comprehension [1], [2], anomaly detection [3]-[6], and failure diagnosis [7], [8]. Extensive machine learning and deep learning-based techniques have been proposed in research for automated log anomaly detection [9], [10], with the aim of reducing manual analysis costs. Concurrently, industrial log monitoring tools have emerged to provide log analysis services, including log anomaly detection. However, no prior studies have investigated practitioners' expectations of these techniques or tools. It remains unclear whether practitioners appreciate the current log anomaly detection techniques or log monitoring tools, the factors influencing their decisions to adopt them, and their minimum thresholds for adoption. Gaining insights from practitioners is essential to identify critical issues and guide researchers in developing solutions tailored to meet the needs of practitioners. Xiaoxue Ma and Yishu Li are with the Department of Electronic Engineering and Computer Science, H