Abstract: With the widespread deployment of IoT terminal devices in scenarios such as industrial control, intelligent transportation, smart homes, and smart healthcare, massive amounts of semi-structured logs are continuously generated at the edge. Existing methods either rely on log template IDs and shallow sequence models, making it difficult to model complex semantics, or rely on large-scale pre-trained models, which cannot meet the constraints of real-time performance and resource consumption of terminal devices. To address these issues, this paper proposes a log anomaly detection technology for IoT terminal devices. First, a semantic enhancement detection model based on BERT and Llama is designed, employing regularization replacement and windowing modeling to suppress dynamic parameter noise. A semantic projection module is used to align the representation spaces of the encoder and decoder, and a three-stage fine-tuning method is used to improve the sequence-level anomaly detection capability. Second, a cloud-edge collaborative detection framework for terminal devices is constructed, proposing a two-stage confidence distillation and latency-sensitive dynamic routing strategy. This allows the small edge model to undertake most of the low-cost detection tasks, with only low-confidence samples uploaded to the large cloud model for verification. Our experiments on the public datasets HDFS, BGL, and Thunderbird show that the proposed semantic detection model achieves F1 scores of 99.7%, 91.6%, and 96.6%, respectively. The cloud-edge collaborative framework maintains an overall F1 score of 95.5% while requiring only an average cloud routing ratio of 26.6%, which is equivalent to reducing the amount of large model calls by 73.4%.