A Lightweight Log Anomaly Detection System for Containerized Applications on Resource-Constrained Edge Devices

Abstract

Log monitoring and anomaly detection are essential components in maintaining the reliability of containerized applications, particularly in resource-constrained edge environments. However, many existing log-based anomaly detection approaches rely on complex models that are difficult to deploy on low-power devices. This paper presents a lightweight log anomaly detection system designed for containerized applications running on edge devices with limited computational resources. The proposed system integrates containerized log collection, real-time traffic monitoring, and anomaly detection using simple statistical indicators as engineering tools. The system is implemented and evaluated on a Raspberry Pi-based platform using Dockerized services and four synthetic traffic scenarios: baseline, burst, drop, and traffic spike. Experimental results show that the proposed approach achieves a low false positive rate of 1.05% under normal workloads and successfully detects sustained traffic spikes with a detection latency of 69 seconds, while maintaining low computational overhead. The results also indicate that short-duration bursts may be partially absorbed by the EWMA-based baseline adaptation. Overall, the findings confirm that simple and interpretable detection mechanisms remain practical and effective for edge-based system monitoring, providing a feasible alternative to complex learning-based approaches in constrained environments.