DA-MLAD: Drift-Decomposed Meta-Learning for Continual Log Anomaly Detection in Supercomputing Systems

Large-scale supercomputing systems generate massive, continuously evolving log streams essential for fault diagnosis, but log pattern drift - caused by system upgrades, workload variations, and hardware aging - rapidly degrades detection models, missing emerging failures or flooding operators with false alarms. Existing online methods adapt blindly whenever distribution shifts occur, unable to distinguish genuine fault evolution from superficial format changes - leading to either over-adaptation that discards relevant knowledge, or under-adaptation that misses emerging failures. We present DA-MLAD, a drift-decomposed online meta-learning framework that first decomposes observed drift into its critical sources, then adapts accordingly. Our key insight is that fault concepts (memory errors, network timeouts, I/O stalls) provide a stable semantic view even as log syntax evolves. The core contribution is the Semantic Drift Ratio (SDR), which exploits the aggregation structure of concept mapping to decompose observed drift: by measuring shift at both template and concept levels, SDR disentangles surface-level format changes from semantic-level fault evolution, enabling principled adaptation that preserves knowledge when only formats change while learning aggressively when fault semantics genuinely evolve. Experiments on three production supercomputer logs (BGL, Thunderbird, Spirit) under closed-budget protocol (2.5% labeled templates, no extra supervision for meta-update) demonstrate 3.3-4.4 F1-point improvements over state-of-the-art methods under sustained drift, with 68% less forgetting.