Upload 4 files

HF/test/test_llm.py

@@ -0,0 +1,197 @@
+"""
+tests/test_llm.py — Tests for Tier 3: LLM Classifier
+
+Tests verify:
+  1. Cache hit avoids API call
+  2. Retry logic on transient failure
+  3. Returns "Unclassified" on all error paths (never crashes pipeline)
+  4. Response normalization handles edge cases
+  5. No HF_TOKEN → returns Unclassified gracefully
+
+Run:
+  pytest tests/test_llm.py -v
+"""
+import sys, os
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+
+import pytest
+from unittest.mock import patch, MagicMock, call
+import processor_llm as llm_module
+from processor_llm import (
+    classify_with_llm, get_cache_stats,
+    _cache_key, _cache_get, _cache_set, _normalize,
+    _RESPONSE_CACHE,
+)
+
+
+# ── Setup / teardown ──────────────────────────────────────────────────────────
+@pytest.fixture(autouse=True)
+def clear_cache():
+    """Clear LLM cache before each test."""
+    _RESPONSE_CACHE.clear()
+    yield
+    _RESPONSE_CACHE.clear()
+
+
+# ── Normalize ─────────────────────────────────────────────────────────────────
+class TestNormalize:
+    def test_exact_match(self):
+        assert _normalize("Workflow Error") == "Workflow Error"
+
+    def test_case_insensitive(self):
+        assert _normalize("workflow error") == "Workflow Error"
+
+    def test_deprecation_warning(self):
+        assert _normalize("Deprecation Warning") == "Deprecation Warning"
+
+    def test_random_text_returns_unclassified(self):
+        assert _normalize("I don't know") == "Unclassified"
+
+    def test_empty_string_returns_unclassified(self):
+        assert _normalize("") == "Unclassified"
+
+    def test_partial_match(self):
+        # Model might return "Category: Workflow Error" → still should match
+        assert _normalize("Category: Workflow Error") == "Workflow Error"
+
+    def test_strips_quotes(self):
+        assert _normalize('"Deprecation Warning"') == "Deprecation Warning"
+
+
+# ── Cache ─────────────────────────────────────────────────────────────────────
+class TestCache:
+    def test_cache_miss_returns_none(self):
+        assert _cache_get("totally new log message xyz") is None
+
+    def test_cache_set_and_get(self):
+        log = "test log message for caching"
+        _cache_set(log, "Workflow Error")
+        assert _cache_get(log) == "Workflow Error"
+
+    def test_cache_key_is_deterministic(self):
+        log = "same log every time"
+        assert _cache_key(log) == _cache_key(log)
+
+    def test_different_logs_different_keys(self):
+        k1 = _cache_key("log message A")
+        k2 = _cache_key("log message B")
+        assert k1 != k2
+
+    def test_cache_hit_avoids_api_call(self):
+        log = "Case escalation for ticket 7324 failed."
+        _cache_set(log, "Workflow Error")  # Pre-populate cache
+
+        with patch("processor_llm.InferenceClient") as mock_client:
+            result = classify_with_llm(log)
+
+        mock_client.assert_not_called()
+        assert result == "Workflow Error"
+
+    def test_cache_stats_size(self):
+        _cache_set("log1", "Workflow Error")
+        _cache_set("log2", "Deprecation Warning")
+        stats = get_cache_stats()
+        assert stats["size"] == 2
+
+
+# ── No token ──────────────────────────────────────────────────────────────────
+class TestNoToken:
+    def test_no_hf_token_returns_unclassified(self, monkeypatch):
+        monkeypatch.setattr(llm_module, "HF_TOKEN", None)
+        result = classify_with_llm("Case escalation for ticket 1234.")
+        assert result == "Unclassified"
+
+
+# ── Retry logic ───────────────────────────────────────────────────────────────
+class TestRetry:
+    def _make_mock_client(self, responses):
+        """responses: list of (Exception | str) — raised or returned in order."""
+        call_count = [0]
+
+        def mock_create(**kwargs):
+            idx = call_count[0]
+            call_count[0] += 1
+            if isinstance(responses[idx], Exception):
+                raise responses[idx]
+            mock_resp = MagicMock()
+            mock_resp.choices[0].message.content = responses[idx]
+            return mock_resp
+
+        mock_client = MagicMock()
+        mock_client.chat.completions.create.side_effect = mock_create
+        return mock_client
+
+    def test_success_on_first_try(self, monkeypatch):
+        monkeypatch.setattr(llm_module, "HF_TOKEN", "fake-token")
+        monkeypatch.setattr(llm_module, "RETRY_DELAY_SEC", 0)  # no sleep
+
+        client = self._make_mock_client(["Workflow Error"])
+
+        with patch("processor_llm.InferenceClient", return_value=client):
+            result = classify_with_llm("Case escalation for ticket 7324.")
+
+        assert result == "Workflow Error"
+        assert client.chat.completions.create.call_count == 1
+
+    def test_retry_on_transient_failure(self, monkeypatch):
+        monkeypatch.setattr(llm_module, "HF_TOKEN", "fake-token")
+        monkeypatch.setattr(llm_module, "RETRY_DELAY_SEC", 0)
+        monkeypatch.setattr(llm_module, "MAX_RETRIES", 2)
+
+        # Fail once, succeed on second attempt
+        client = self._make_mock_client([
+            ConnectionError("timeout"),
+            "Deprecation Warning",
+        ])
+
+        with patch("processor_llm.InferenceClient", return_value=client), \
+             patch("processor_llm.time.sleep"):  # skip actual sleep
+            result = classify_with_llm("Module will be retired in v4.")
+
+        assert result == "Deprecation Warning"
+        assert client.chat.completions.create.call_count == 2
+
+    def test_all_retries_exhausted_returns_unclassified(self, monkeypatch):
+        monkeypatch.setattr(llm_module, "HF_TOKEN", "fake-token")
+        monkeypatch.setattr(llm_module, "RETRY_DELAY_SEC", 0)
+        monkeypatch.setattr(llm_module, "MAX_RETRIES", 2)
+
+        client = self._make_mock_client([
+            ConnectionError("timeout"),
+            ConnectionError("timeout"),
+            ConnectionError("timeout"),
+        ])
+
+        with patch("processor_llm.InferenceClient", return_value=client), \
+             patch("processor_llm.time.sleep"):
+            result = classify_with_llm("Something that keeps failing.")
+
+        assert result == "Unclassified"
+        assert client.chat.completions.create.call_count == 3  # 1 initial + 2 retries
+
+    def test_successful_result_gets_cached(self, monkeypatch):
+        monkeypatch.setattr(llm_module, "HF_TOKEN", "fake-token")
+        monkeypatch.setattr(llm_module, "RETRY_DELAY_SEC", 0)
+
+        client = self._make_mock_client(["Workflow Error"])
+
+        log = "Case escalation for unique ticket 99999."
+        with patch("processor_llm.InferenceClient", return_value=client):
+            result = classify_with_llm(log)
+
+        assert result == "Workflow Error"
+        # Should now be in cache
+        assert _cache_get(log) == "Workflow Error"
+
+
+# ── Pipeline safety ───────────────────────────────────────────────────────────
+class TestPipelineSafety:
+    def test_classify_never_raises(self, monkeypatch):
+        """LLM failures must NEVER propagate as exceptions to the pipeline."""
+        monkeypatch.setattr(llm_module, "HF_TOKEN", "fake-token")
+        monkeypatch.setattr(llm_module, "RETRY_DELAY_SEC", 0)
+
+        with patch("processor_llm.InferenceClient", side_effect=RuntimeError("catastrophic")):
+            result = classify_with_llm("Any log message here.")
+
+        assert result == "Unclassified"  # Never raises, always returns string

HF/test/test_regex.py

@@ -0,0 +1,222 @@
+"""
+tests/test_regex.py — Unit tests for Tier 1: Regex Classifier
+
+Tests verify:
+  1. Every pattern category has positive matches
+  2. No false positives on known non-matching logs
+  3. Pattern order doesn't cause mis-labeling
+  4. Coverage improvement (should be > 35% on balanced test set)
+
+Run:
+  pytest tests/ -v
+  pytest tests/test_regex.py -v --tb=short
+"""
+import sys, os
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+
+import pytest
+from processor_regex import classify_with_regex, get_regex_coverage
+
+
+# ── Positive cases: must match and return correct label ───────────────────────
+class TestHTTPStatus:
+    def test_get_request(self):
+        assert classify_with_regex("GET /api/v2/resource HTTP/1.1 status: 200 len: 100 time: 0.1") == "HTTP Status"
+
+    def test_post_request(self):
+        assert classify_with_regex("POST /v1/users HTTP/1.1 status: 201 len: 42 time: 0.05") == "HTTP Status"
+
+    def test_delete_request(self):
+        assert classify_with_regex("DELETE /v1/users/123 HTTP/1.1 status: 204 len: 0 time: 0.02") == "HTTP Status"
+
+    def test_nova_style(self):
+        assert classify_with_regex(
+            "nova.osapi_compute.wsgi.server GET /v2/servers/detail HTTP/1.1 status: 404 len: 1583 time: 0.19"
+        ) == "HTTP Status"
+
+    def test_status_code_only(self):
+        assert classify_with_regex("API call /invoices returned HTTP 500 in 2.1s") == "HTTP Status"
+
+    def test_patch_request(self):
+        assert classify_with_regex("PATCH /v1/config HTTP/1.1 status: 200 len: 55 time: 0.04") == "HTTP Status"
+
+
+class TestSecurityAlert:
+    def test_login_failures(self):
+        assert classify_with_regex("Multiple login failures occurred on user 6454 account") == "Security Alert"
+
+    def test_ip_blocked(self):
+        assert classify_with_regex("IP 192.168.133.114 blocked due to potential attack") == "Security Alert"
+
+    def test_brute_force(self):
+        assert classify_with_regex("Alert: brute force login attempt from 10.0.0.5 detected") == "Security Alert"
+
+    def test_admin_escalation(self):
+        assert classify_with_regex("Admin access escalation detected for user 9429") == "Security Alert"
+
+    def test_privilege_elevation(self):
+        assert classify_with_regex("Privilege elevation detected for user Admin99") == "Security Alert"
+
+    def test_ddos(self):
+        assert classify_with_regex("Potential DDoS attack from 1.2.3.4 detected") == "Security Alert"
+
+    def test_suspicious_activity(self):
+        assert classify_with_regex("Suspicious login activity detected from 203.0.113.1") == "Security Alert"
+
+    def test_unauthorized_access(self):
+        assert classify_with_regex("Unauthorized access to data was attempted by User123") == "Security Alert"
+
+
+class TestUserAction:
+    def test_login(self):
+        assert classify_with_regex("User User12345 logged in.") == "User Action"
+
+    def test_logout(self):
+        assert classify_with_regex("User User99 logged out.") == "User Action"
+
+    def test_account_created(self):
+        assert classify_with_regex("Account with ID 456 created by Admin.") == "User Action"
+
+    def test_password_changed(self):
+        assert classify_with_regex("User User42 changed password successfully.") == "User Action"
+
+    def test_new_user_registered(self):
+        assert classify_with_regex("New user User9999 registered with email u@e.com.") == "User Action"
+
+
+class TestSystemNotification:
+    def test_backup_completed(self):
+        assert classify_with_regex("Backup completed successfully.") == "System Notification"
+
+    def test_backup_started(self):
+        assert classify_with_regex("Backup started at 2024-01-14 03:00:00.") == "System Notification"
+
+    def test_system_updated(self):
+        assert classify_with_regex("System updated to version 4.2.1.") == "System Notification"
+
+    def test_disk_cleanup(self):
+        assert classify_with_regex("Disk cleanup completed successfully.") == "System Notification"
+
+    def test_service_restarted(self):
+        assert classify_with_regex("Service payments restarted successfully.") == "System Notification"
+
+    def test_cpu_usage(self):
+        assert classify_with_regex("CPU usage at 98% for the last 10 minutes on node-7") == "System Notification"
+
+    def test_health_check_passed(self):
+        assert classify_with_regex("Health check passed for service auth-api") == "System Notification"
+
+    def test_cron_executed(self):
+        assert classify_with_regex("Cron job cleanup-tokens executed successfully.") == "System Notification"
+
+    def test_certificate_renewed(self):
+        assert classify_with_regex("Certificate renewed successfully for domain api.example.com") == "System Notification"
+
+
+class TestError:
+    def test_system_crashed(self):
+        assert classify_with_regex("System crashed due to disk I/O failure on node-3") == "Error"
+
+    def test_db_connection_failed(self):
+        assert classify_with_regex("Database connection failed after 3 retries") == "Error"
+
+    def test_service_down(self):
+        assert classify_with_regex("Service payments-api is down") == "Error"
+
+    def test_request_timeout(self):
+        assert classify_with_regex("Connection timed out after 30s on shard-7") == "Error"
+
+
+class TestCriticalError:
+    def test_critical_prefix(self):
+        assert classify_with_regex("CRITICAL: data corruption detected on shard-14") == "Critical Error"
+
+    def test_fatal(self):
+        assert classify_with_regex("FATAL: kernel panic — system halted") == "Critical Error"
+
+    def test_data_loss(self):
+        assert classify_with_regex("data loss detected during write to replica-3") == "Critical Error"
+
+    def test_oom(self):
+        assert classify_with_regex("out-of-memory error: process killed (OOM)") == "Critical Error"
+
+
+# ── Negative cases: must return None (don't mis-classify) ────────────────────
+class TestNegativeCases:
+    @pytest.mark.parametrize("log", [
+        "Case escalation for ticket ID 7324 failed because the assigned support agent is no longer active.",
+        "The 'ReportGenerator' module will be retired in version 4.0.",
+        "The 'BulkEmailSender' feature will be deprecated in v5.0.",
+        "Invoice generation aborted for order ID 8910 due to invalid tax calculation module.",
+        "Hey bro chill ya!",
+    ])
+    def test_no_false_positives(self, log):
+        result = classify_with_regex(log)
+        assert result is None, f"Expected None but got '{result}' for: {log[:80]}"
+
+
+# ── Coverage test ─────────────────────────────────────────────────────────────
+class TestCoverage:
+    BALANCED_SAMPLE = [
+        # HTTP (6)
+        "GET /api/v2/resource HTTP/1.1 status: 200 len: 100 time: 0.1",
+        "POST /v1/users HTTP/1.1 status: 201 len: 42 time: 0.05",
+        "nova.osapi_compute.wsgi.server GET /v2/servers/detail HTTP/1.1 status: 200",
+        "DELETE /v1/items/99 HTTP/1.1 status: 204 len: 0 time: 0.01",
+        "PATCH /v1/config HTTP/1.1 status: 200 len: 55 time: 0.04",
+        "API call /invoices returned HTTP 500 in 2.1s",
+        # Security (6)
+        "Multiple login failures occurred on user 6454 account",
+        "IP 10.0.0.5 blocked due to potential attack",
+        "Brute force login attempt from 192.168.1.1 detected",
+        "Admin access escalation detected for user 9429",
+        "Suspicious login activity detected from 1.2.3.4",
+        "Potential DDoS attack from 203.0.113.1 detected",
+        # User Action (5)
+        "User User12345 logged in.",
+        "User User99 logged out.",
+        "Account with ID 456 created by Admin.",
+        "User User42 changed password successfully.",
+        "New user User9999 registered with email u@e.com.",
+        # System Notification (5)
+        "Backup completed successfully.",
+        "System updated to version 4.2.1.",
+        "Disk cleanup completed successfully.",
+        "CPU usage at 98% for the last 10 minutes on node-7",
+        "Cron job cleanup-tokens executed successfully.",
+        # Error (4)
+        "System crashed due to disk I/O failure on node-3",
+        "Database connection failed after 3 retries",
+        "Service auth-api is down",
+        "Connection timed out after 30s",
+        # Critical (3)
+        "CRITICAL: data corruption detected on shard-14",
+        "FATAL: kernel panic — system halted",
+        "data loss detected during write to replica-3",
+        # LegacyCRM / unmatched (5) → should NOT match
+        "Case escalation for ticket ID 7324 failed.",
+        "The 'BulkEmailSender' feature will be deprecated in v5.0.",
+        "Invoice generation aborted for order ID 8910.",
+        "Workflow stalled at approval step 3 for case 9021.",
+        "SLA breach detected for case ID 7701 (P1 4h breach).",
+    ]
+
+    def test_coverage_above_35_percent(self):
+        result = get_regex_coverage(self.BALANCED_SAMPLE)
+        pct    = result["coverage_pct"]
+        # 29 of 34 logs should match regex (29/34 = 85%)
+        # 5 LegacyCRM logs should NOT match → ~85% expected
+        assert pct >= 35.0, (
+            f"Regex coverage {pct}% is below 35% minimum. "
+            f"Check pattern additions in processor_regex.py"
+        )
+
+    def test_no_false_positive_on_legacy_logs(self):
+        legacy_logs = [
+            "Case escalation for ticket ID 7324 failed.",
+            "The 'BulkEmailSender' feature will be deprecated in v5.0.",
+            "Invoice generation aborted for order ID 8910.",
+        ]
+        for log in legacy_logs:
+            result = classify_with_regex(log)
+            assert result is None, f"False positive: '{result}' on legacy log: {log}"

HF/test/test_routing.py

@@ -0,0 +1,179 @@
+"""
+tests/test_routing.py — Pipeline Routing Tests
+
+Tests verify:
+  1. LegacyCRM source → LLM tier (always)
+  2. Regex match → Regex tier (never reaches BERT)
+  3. High-confidence BERT → BERT tier
+  4. Unclassified BERT → LLM fallback tier
+  5. Result schema is complete (all keys present)
+
+Run:
+  pytest tests/test_routing.py -v
+"""
+import sys, os
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+
+import pytest
+from unittest.mock import patch, MagicMock
+from classify import classify_log, classify_logs, pipeline_summary
+
+
+# ── Fixtures ──────────────────────────────────────────────────────────────────
+REGEX_HIT_LOG    = ("ModernCRM",   "User User123 logged in.")
+REGEX_HIT_LOG2   = ("BillingSystem", "GET /api/v1/invoices HTTP/1.1 status: 200 len: 100 time: 0.1")
+LEGACY_LOG       = ("LegacyCRM",   "Case escalation for ticket 9021 failed.")
+NON_REGEX_LOG    = ("ModernHR",    "The inventory sync completed without matching standard patterns.")
+
+
+# ── Schema completeness ───────────────────────────────────────────────────────
+class TestResultSchema:
+    def test_classify_log_has_required_keys(self):
+        with patch("classify.bert_batch", return_value=[("Error", 0.95)]):
+            result = classify_log(*NON_REGEX_LOG)
+        assert "label"      in result
+        assert "tier"       in result
+        assert "confidence" in result
+        assert "latency_ms" in result
+
+    def test_latency_ms_is_positive(self):
+        result = classify_log(*REGEX_HIT_LOG)
+        assert result["latency_ms"] > 0
+
+    def test_confidence_is_float_or_none(self):
+        result = classify_log(*REGEX_HIT_LOG)
+        assert result["confidence"] is None or isinstance(result["confidence"], float)
+
+
+# ── Regex tier routing ─────────────────────────────────────────────────────────
+class TestRegexRouting:
+    def test_regex_match_returns_regex_tier(self):
+        result = classify_log(*REGEX_HIT_LOG)
+        assert result["tier"] == "Regex"
+
+    def test_regex_match_has_full_confidence(self):
+        result = classify_log(*REGEX_HIT_LOG)
+        assert result["confidence"] == 1.0
+
+    def test_regex_match_http_log(self):
+        result = classify_log(*REGEX_HIT_LOG2)
+        assert result["tier"] == "Regex"
+        assert result["label"] == "HTTP Status"
+
+    def test_regex_match_skips_bert(self):
+        """If regex matches, bert_batch should never be called."""
+        with patch("classify.bert_batch") as mock_bert:
+            classify_log(*REGEX_HIT_LOG)
+            mock_bert.assert_not_called()
+
+
+# ── LegacyCRM routing ─────────────────────────────────────────────────────────
+class TestLegacyCRMRouting:
+    def test_legacy_crm_goes_to_llm(self):
+        with patch("classify.classify_with_llm", return_value="Workflow Error") as mock_llm:
+            result = classify_log(*LEGACY_LOG)
+        assert result["tier"] == "LLM"
+        mock_llm.assert_called_once()
+
+    def test_legacy_crm_skips_regex(self):
+        """LegacyCRM should skip regex entirely — go straight to LLM."""
+        with patch("classify.classify_with_regex") as mock_regex, \
+             patch("classify.classify_with_llm", return_value="Workflow Error"):
+            classify_log(*LEGACY_LOG)
+            mock_regex.assert_not_called()
+
+    def test_legacy_crm_skips_bert(self):
+        with patch("classify.bert_batch") as mock_bert, \
+             patch("classify.classify_with_llm", return_value="Workflow Error"):
+            classify_log(*LEGACY_LOG)
+            mock_bert.assert_not_called()
+
+
+# ── BERT routing ──────────────────────────────────────────────────────────────
+class TestBERTRouting:
+    def test_high_confidence_bert_stays_bert(self):
+        with patch("classify.bert_batch", return_value=[("Security Alert", 0.95)]):
+            result = classify_log(*NON_REGEX_LOG)
+        assert result["tier"] == "BERT"
+        assert result["label"] == "Security Alert"
+        assert result["confidence"] == pytest.approx(0.95)
+
+    def test_low_confidence_bert_falls_back_to_llm(self):
+        """BERT returning 'Unclassified' should escalate to LLM."""
+        with patch("classify.bert_batch", return_value=[("Unclassified", 0.20)]), \
+             patch("classify.classify_with_llm", return_value="Workflow Error") as mock_llm:
+            result = classify_log(*NON_REGEX_LOG)
+        assert "LLM" in result["tier"]
+        mock_llm.assert_called_once()
+
+    def test_bert_batch_called_for_non_regex_log(self):
+        with patch("classify.bert_batch", return_value=[("Error", 0.88)]) as mock_bert:
+            classify_log(*NON_REGEX_LOG)
+            mock_bert.assert_called_once()
+
+
+# ── Batch routing ──────────────────────────────────────────────────────────────
+class TestBatchRouting:
+    def test_batch_returns_correct_length(self):
+        logs = [REGEX_HIT_LOG, REGEX_HIT_LOG2, LEGACY_LOG]
+        with patch("classify.classify_with_llm", return_value="Workflow Error"):
+            results = classify_logs(logs)
+        assert len(results) == len(logs)
+
+    def test_batch_mixed_tiers(self):
+        logs = [
+            REGEX_HIT_LOG,                # → Regex
+            ("ModernCRM", "GET /api HTTP/1.1 status: 200"),  # → Regex (HTTP)
+            LEGACY_LOG,                   # → LLM
+        ]
+        with patch("classify.classify_with_llm", return_value="Workflow Error"):
+            results = classify_logs(logs)
+
+        assert results[0]["tier"] == "Regex"
+        assert results[1]["tier"] == "Regex"
+        assert results[2]["tier"] == "LLM"
+
+    def test_pipeline_summary_structure(self):
+        logs = [REGEX_HIT_LOG, REGEX_HIT_LOG2]
+        results = classify_logs(logs)
+        summary = pipeline_summary(results)
+
+        assert "total"        in summary
+        assert "tier_stats"   in summary
+        assert "label_counts" in summary
+        assert summary["total"] == 2
+
+    def test_pipeline_summary_tier_pcts_sum_to_100(self):
+        logs = [REGEX_HIT_LOG, REGEX_HIT_LOG2, REGEX_HIT_LOG]
+        results = classify_logs(logs)
+        summary = pipeline_summary(results)
+        total_pct = sum(s["pct"] for s in summary["tier_stats"].values())
+        assert abs(total_pct - 100.0) < 1.0, f"Tier pcts don't sum to 100: {total_pct}"
+
+
+# ── Edge cases ────────────────────────────────────────────────────────────────
+class TestEdgeCases:
+    def test_empty_batch_returns_empty(self):
+        results = classify_logs([])
+        assert results == []
+
+    def test_single_log_batch(self):
+        with patch("classify.bert_batch", return_value=[("Error", 0.85)]):
+            results = classify_logs([NON_REGEX_LOG])
+        assert len(results) == 1
+
+    def test_all_regex_batch_never_calls_bert(self):
+        logs = [REGEX_HIT_LOG] * 10
+        with patch("classify.bert_batch") as mock_bert:
+            classify_logs(logs)
+            mock_bert.assert_not_called()
+
+    def test_llm_failure_returns_unclassified(self):
+        """LLM crashing should return Unclassified, not raise."""
+        with patch("classify.classify_with_llm", side_effect=Exception("LLM down")):
+            try:
+                result = classify_log(*LEGACY_LOG)
+                # If it doesn't raise, Unclassified should be label
+                assert result["label"] == "Unclassified"
+            except Exception:
+                pytest.fail("classify_log raised an exception — should have returned Unclassified")