LENS: A Log-Evidence-Grounded Neuro-Symbolic Agent for Large-Scale Analytics over 5G Log Traces

Logs are the language of engineered systems. In 5G networks, the resulting log traces may span millions of lines and use implementation-specific formats, while the meaning of an event often depends on internal protocol state transitions. These log traces can also expose sensitive operational information, motivating analysis on operator-controlled nearedge infrastructure where smaller open-weight models are deployable. Directly presenting such log traces to an LLM either exceeds its context window or requires aggressive truncation. Even when the log trace fits, attention alone does not reliably identify the sparse fields and cross-event relationships needed for correct analysis, particularly for questions involving event pairing, identifier-based joins, grouping, or arithmetic. We present LENS, a log-evidence-grounded neuro-symbolic agent for natural-language analytics over 5G log traces. Offline, LENS decomposes raw logs into structured events stored in DuckDB and derives an empirical finite-state model from recurring event transitions. The resulting Trace Analytics Ontology represents empirical sequence evidence for causal execution alongside event classes, extracted fields, system concepts, and analytical operations. At query time, LENS synthesizes a structured, query-specific analytics program that selects relevant fields, relates events, and composes the required operations. After structural validation, an executor interprets the program as analytical SQL calls that produce the answer. We collect real over-the-air traffic on a 5G testbed to construct three million-line datasets with different UE populations and traffic distributions under common cross-layer instrumentation. We generate and verify questions against each log and evaluate four models on 100 analytical questions per dataset. The results show that richer data alone can reduce accuracy for smaller models, while coupling it with planning produces their best results on every dataset. These gains recur across the evaluated traffic scenarios and event mixes, while a frontier model reaches perfect accuracy on only one dataset’s selected workload.