The Cost of Waiting in Early Log Anomaly Recognition: Stopping Rules and Evaluation Populations

Abstract A log monitor must decide whether another event is worth observing. We study this decision using a common prefix scorer and explicit false-alarm, missed anomaly, waiting and scoring charges. On 575,061 Hadoop Distributed File System (HDFS) sessions, a tuned two-threshold rule has reference costs of 0.1305, 0.2343 and 0.4186 at false-negative to false-positive cost ratios of 5, 10 and 20. A grouped multi-step anticipation rule costs an additional 0.01150, 0.000068 and 0.01202 per session. At ratio 5, its missed-anomaly savings are outweighed by waiting and scoring charges. However, exact-sequence cluster intervals include zero on all five reference splits, independent group-disjoint draws change the com parison sign, and alternative population weights can reverse the ratio-5 ordering. We reconstruct the saved decisions, perform a fresh raw-data rerun, and add validation-budgeted false-alarm controls. The contribution is a reproducible anal ysis of when stopping-rule comparisons depend on the scorer, price and evaluation population, rather than a new detector or a general claim against anticipa tion. Completed-session replay and corpus-derived templates limit deployment interpretation. MSC Classification: 68M20 , 68M15