LLM-based AIOps via Log Prioritization in Air-Gapped Systems

Large-scale computing systems generate massive volumes of operational logs across diverse components. Although LLMs offer new opportunities for automated AIOps analysis, directly applying them to raw log streams is impractical due to input length and resource constraints, especially in air-gapped and edge environments. In this paper, we propose an LLM-based AIOps pipeline that converts raw logs into structured events through rule-based transformation and temporal aggregation. The structured events are then prioritized to enable efficient LLM-driven diagnosis. We implement the pipeline in a real-world isolated edge environment and evaluate it using production-scale system logs. Experimental results show that our pipeline enables efficient LLM-guided analysis while preserving system-level diagnostic effectiveness. Our pipeline reduces log volume by 76% through the log transformation stage. After aggregation into structured events, the log prioritization stage further reduces the event set by 51% before LLM analysis, resulting in a 43% reduction in LLM token requirements compared to the non-prioritized case, significantly lowering resource consumption in constrained environments.