<![CDATA[OpenStack benchmark logs are widely used in log anomaly detection, but the official release also supports a more specific task: failure-injection-aware explanation. It provides normal logs and abnormal cases with injected failures, which makes it possible to evaluate anomaly ranking and case-based explanation on the same corpus. This paper reports a complete empirical evaluation of the official OpenStack files. We parsed 207,820 raw lines, constructed 2,070 file-scoped virtual-machine cases, and evaluated template, timing, and retrieval-based methods against the four officially labeled injected anomalies. The labeled failures are not characterized by anomaly-exclusive templates. Instead, they preserve the normal template vocabulary and are dominated by a large creating_image→vm_started delay, together with increased /servers/detail polling. A template-only Isolation Forest fails in this setting, achieving ROC-AUC 0.418 and F1@4 0.000, whereas timing-aware baselines reach ROC-AUC values between 0.978 and 0.997. We then introduce FIA-RAG, a deliberately simple and auditable explanation pipeline. FIA-RAG scores each case with three standardized benchmark-aligned signals case duration, detail-polling count, and create-to-start delay and retrieves nearby normal cases as prototypes for counterfactual repair. On the official abnormal file, it ranks all four labeled anomalies in the top four alerts and identifies the create-to-start delay as the dominant explanation signal. These results show that the official OpenStack failure cases are timing-and-context anomalies rather than lexical anomalies. More broadly, the study argues that failure-injection benchmarks should be characterized before model complexity claims are made. The three features used here are OpenStack-specific, but the protocol, case construction, prototype retrieval, and counterfactual validation, can be adapted to other cloud-log benchmarks after system-appropriate milestones and context counters are defined.]]>
Copyrights © 2025
