LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models

Abstract

We introduce LMAT, a Language Model-based Adaptive Tracing framework designed for host-level observability that provides granular monitoring without excessive overhead. LMAT leverages a multi-task architecture to jointly predict kernel event sequences and classify event durations, thereby capturing both control-flow and temporal dynamics. By continuously comparing live trace data against model predictions, LMAT automatically signals deviations, dynamically adjusting trace granularity only when needed. This approach significantly reduces trace volume, along with associated energy and storage costs, achieving a 70.6% reduction in our experiments. Additionally, LMAT utilizes prediction discrepancies to drive an efficient root-cause classifier, mapping detected anomalies directly to their potential fault sources and providing actionable feedback for operations teams. We evaluate LMAT on two architecturally distinct single-host environments—an Apache2 web-server stack and the Sock Shop containerized microservice benchmark—using kernel traces that include standard workloads, duration-centric noise scenarios, and controlled CPU, disk, memory, and network stress injections. On the Apache workload, LMAT demonstrates up to 97.7% accuracy in anomaly detection and root-cause identification, surpassing state-of-the-art methods relying solely on event sequences. On Sock Shop, the same design remains effective for host-local change detection, while root-cause attribution in the microservice setting remains more challenging. A deployment-oriented overhead study shows that under a stable load, asynchronous LMAT inference introduces no measurable additional tail-latency overhead beyond tracing, while maintaining consistent throughput. Our findings illustrate that LMAT is a practical approach for adaptive tracing in the evaluated single-host environments, improving detection quality while keeping deployment overhead negligible.

Source: Exact author abstract from the CC BY 4.0 version of record, verified against the locally reviewed LMAT proof and Crossref license metadata on 2026-08-09.

Problem and motivation

Always-on or fixed-granularity tracing increases storage and processing cost, while sparse tracing can miss rare or timing-sensitive behavior; event-only models can also miss anomalies that preserve event order but change execution duration.

Method and contribution

LMAT collects host-level kernel events with LTTng and represents syscall identity, entry/exit phase, process/thread context, delay, return status, and tracepoint metadata. A shared LSTM or BERT/Transformer encoder predicts the next event and an ordinal event-duration category. Normalized event and duration losses drive a rolling-window change detector; misprediction counts become error vectors, HDBSCAN forms anomaly prototypes, and cosine similarity supports root-cause classification. The controller keeps a minimal event set during normal execution and escalates tracing when abnormal behavior crosses a configurable threshold.

Findings and evidence

On an Apache2 workload using the public Fournier et al. corpus plus added duration-anomaly scenarios, the integrated multi-task model reaches 97.7% average accuracy for combined change detection and root-cause analysis, while the abstract reports up to 70.6% less collected trace data with 3.2% trace/event loss. The evaluation also reports 99.0% average duration-vector RCA accuracy, 96.5% change F1 and 96.8% RCA accuracy with a 40-event subset at 97% volume, and 19.28 ms total latency for a reduced LSTM configuration. On a new Sock Shop Docker benchmark with LTTng, relayed OpenTelemetry spans, load logs, and Prometheus metrics, the five-category Transformer multi-task model reaches 84.6% detection recall and 32.5% end-to-end RCA accuracy; asynchronous inference changes throughput from 88.4 +/- 1.1 req/s with LTTng alone to 88.7 +/- 0.3 req/s and does not add measurable application-level tail latency at the tested load.

Limitations and future directions

Limitations: The evaluation covers two single-host environments and controlled Apache/Sock Shop scenarios, not synchronized multi-host distributed tracing. Duration binning can lose timing detail, threshold selection may not generalize, and Sock Shop end-to-end root-cause attribution remains difficult, especially for CPU perturbations. The prototype lacks pre-trigger buffering and a post-trigger linger window, and its notion of normal still requires online model maintenance.

Future work: Extend LMAT to synchronized multi-host traces, optional retroactive capture, write-heavy databases, streaming/back-pressure workloads, and online learning in CI/CD; broaden anomaly coverage and periodically refine models so accepted normal behavior does not cause tracing cost to grow.

Resources

• Code
• Data

Sources and identifiers

• Published version published

When to cite this paper

Cite this paper when designing adaptive host-level tracing that uses kernel-event and event-duration prediction to reduce trace volume while retaining change and root-cause evidence.

• LTTng kernel-event representation with syscall entry/exit context, process/thread identifiers, return status, and duration features.
• Multi-task LSTM/BERT prediction of next events and ordinal event durations for change detection and lightweight HDBSCAN-based root-cause classification.
• Apache and Sock Shop evaluations reporting trace reduction, event-loss, anomaly-detection, root-cause, and asynchronous deployment-overhead results.

Citation

@article{ezzatiJivan2026lmatan,
  author = {Kasra Darvishi and Morteza Noferesti and Yuvraj Sehgal and Naser Ezzati-Jivan},
  title = {LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models},
  year = {2026},
  journal = {Journal of Systems and Software},
  volume = {238},
  pages = {112890},
  eid = {112890},
  publisher = {Elsevier BV},
  issn = {0164-1212},
  doi = {10.1016/j.jss.2026.112890},
  url = {https://doi.org/10.1016/j.jss.2026.112890}
}

Darvishi, K., Noferesti, M., Sehgal, Y., & Ezzati-Jivan, N. (2026). LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models. Journal of Systems and Software, 238, 112890. https://doi.org/10.1016/j.jss.2026.112890

K. Darvishi, M. Noferesti, Y. Sehgal, and N. Ezzati-Jivan, "LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models," Journal of Systems and Software, vol. 238, Art. no. 112890, 2026, doi: 10.1016/j.jss.2026.112890