OpsLens-17M

A 17.05M-parameter decoder-only language model, trained from random weights on one RTX 3050 laptop GPU, that reads a raw server log line and writes compact JSON: the log template, variables, severity, an anomaly flag, an incident tag, a one-sentence meaning and up to three fix steps with the line's real values filled in. It runs on a laptop CPU with no network.

The model is one part of the OpsLens system (normaliser, template cache, knowledge-base grounding, rule-based incident graphs). Used alone, it gives the per-line JSON only.

Architecture

Type	Decoder-only transformer, Llama-compatible (RMSNorm pre-norm, RoPE, SwiGLU, tied embeddings)
Layers / d_model / heads	8 / 384 / 6 (head dim 64), MLP 1024
Context	512 trained (1024 positions supported)
Vocabulary	7,527 byte-level BPE, digits split one per token, trained from scratch
Parameters	17,052,672
Size	65 MB fp32 safetensors

Prompt format

<|sys:OpenSSH|><|log|>Failed password for root from 183.62.140.253 port 38895 ssh2<|out|>

The model continues with

{"t":"Failed password for <*> from <*> port <*> ssh2","v":["root","183.62.140.253","38895"],"s":"WARN","a":1,"g":"ssh_bruteforce","m":"A wrong password was sent for real user root from 183.62.140.253.","f":["block 183.62.140.253 if failures are repeated","disable password login for root","enable fail2ban for sshd"]}<|end|>

Systems: Apache, OpenSSH, Linux, HDFS, OpenStack. Pass the message part of the line (header stripped). Greedy decoding. Keys: t template, v variables, s severity, a anomaly, g incident tag, m meaning, f fix steps.

Training

• Data: Loghub-2.0 (5 systems), capped per template; 15% of templates per system held out (seed 42) and never trained on.
• Stage 1: next-token pretraining on 100M tokens of raw lines (val loss 0.67).
• Stage 2: fine-tuning on (line, JSON) pairs built from a 499-entry knowledge base written by a teacher model (Claude), plus copies with constant words swapped so the model copies text.
• Hardware: one RTX 3050 Laptop (4 GB), about 1.5 hours total.

Results (held-out test lines; "unseen" = templates never trained on)

Metric	Seen	Unseen
Template exact match (PA)	0.997	0.303
Variables exact	0.997	0.303
Grouping accuracy	1.000	0.595
Anomaly F1 vs teacher	1.00 (memorised)	0.71
Explanation + fix quality (1-5, Claude judge)	-	2.16

Baseline Drain + KB lookup: PA 0.355 seen / 0.352 unseen, and no explanation on unseen lines. CPU latency (4 threads, fp32) with the OpsLens decoder: 100 ms p50 for known templates; about 1.1 s for new patterns, which decode the full explanation.

Numbers above use the OpsLens decoder, which constrains the template to be the input line with <*> slots and copies variables byte-exact. Plain greedy decoding (transformers, llama.cpp, Ollama) is faster to set up but parses unseen templates worse.

Limitations

• Five log systems only. Other formats need retraining (a few hours on one GPU).
• On templates it has not seen, meanings and fixes are often wrong; the OpsLens UI marks such lines "low confidence, new pattern" and never presents fixes as verified.
• Knowledge labels come from a larger teacher model and were not all human-verified.
• It recommends; it never acts.

Use

• OpsLens server (full system): docker run -p 8000:8000 opslens then POST /analyze.
• transformers: AutoModelForCausalLM.from_pretrained("opslens-17m-llama") (Llama layout).
• llama.cpp / Ollama: opslens-17m-f32.gguf, see Modelfile.
• ONNX Runtime / Triton: opslens-17m.onnx, Triton repo opslens_lm.

Data: Loghub-2.0, Jiang et al., ISSTA 2024. Code and weights: MIT.