Large language models (LLMs) have shown promise for event log analysis, but their high computational requirements, reliance on cloud infrastructure, and security concerns limit practical deployment. In addition, most existing approaches focus only on the identification of the problem and do not provide actionable remediation. Small language models (SLMs) present a light-weight alternative that can be fine-tuned for a specific purpose and hosted locally. This paper investigates whether SLMs, when fine-tuned for a specific task, can serve as a practical alternative for event log analysis while also generating solutions. We first create a large-scale synthetic Windows event log dataset that contains remediation actions using a high-performing LLM. We then fine-tune multiple SLMs and LLMs using the LoRA parameter-efficient fine-tuning technique and evaluate their performance by comparing with expert assessment. The results show that the dataset accurately reflects real-world scenarios and that fine-tuned SLMs consistently outperform LLMs in identifying issues and providing relevant remediation, while requiring fewer computational resources.

翻译：大型语言模型在事件日志分析中展现出潜力，但其高计算需求、对云基础设施的依赖以及安全隐患限制了实际部署。此外，现有方法大多仅关注问题识别，未能提供可操作的修复方案。小型语言模型作为一种轻量级替代方案，可通过针对性微调实现本地部署。本文探究经特定任务微调的小型语言模型能否成为事件日志分析中兼具解决方案生成能力的实用替代方案。我们首先利用高性能大型语言模型构建包含修复操作的大规模合成Windows事件日志数据集，随后采用LoRA参数高效微调技术对多个小型语言模型和大型语言模型进行微调，通过与专家评估对比验证其性能。实验结果表明，该数据集准确反映真实场景，微调后的小型语言模型在问题识别与修复方案提供方面始终优于大型语言模型，同时所需计算资源更少。