Headline accuracy - Loghub BGL
All three modes catch every one of the 206,847 alerts. Deep mode trims false positives further.
| Mode | Engine | Precision | Recall | F1 | Speed | Missed |
|---|---|---|---|---|---|---|
| fast | from-scratch statistical | 0.901 | 1.000 | 0.948 | ~6,700/s | 0 |
| turbo | optimized statistical | 0.901 | 1.000 | 0.948 | ~7,300/s | 0 |
| deep | AI semantic embeddings | 0.917 | 1.000 | 0.957 | ~3,400/s | 0 |
Precision · Recall · F1 by mode
Cross-dataset generality
Thunderbird - 500,000 all-normal lines, no retuning. A near-perfect specificity means almost no false alarms.
15+ log formats - detected automatically, zero config.
One detector, every stack - no parsers to configure, no schema to define. Point it at a file and it figures out the format.
…plus a generic fallback that handles anything else - timestamps, levels, and messages are extracted even from formats it hasn't seen.
100% incident recall across 6 real datasets.
30 injected critical incidents - kernel panic, OOM, disk failure, security breach, data corruption - hidden in normal traffic. LogLens caught every one, zero configuration. These are Loghub evaluation datasets used to measure detection accuracy - distinct from the auto-detected formats above.
Throughput
Statistical modes stream through hundreds of thousands of lines per minute. On the 810-line demo, loglens bench hits 14,999 lines/s and collapses them into 8 incident families.
Don't trust the numbers. Run them.
Point the benchmark at any line-labeled log and it prints precision, recall, and F1. A CI gate fails the build if F1 drops below your threshold.
Honesty notes
Accuracy is measured against Loghub's line-level labels - the same public ground truth other tools are evaluated on.
Deep mode embeds unique templates only, not every line. This is disclosed and is why it stays fast on huge files.
RCA and ask send only grouped summaries to the LLM - never your full logs. Detection itself is always local.
Alerting works fully offline. The optional LLM layer only enriches an alert that would have fired anyway.