Abstract:The microservice architecture has been commonly adopted by large scale software systems exemplified by a wide range of online services. Service monitoring through anomaly detection and root cause analysis (RCA) is crucial for these microservice systems to provide stable and continued services. However, compared with monolithic systems, software systems based on the layered microservice architecture are inherently complex and commonly involve entities at different levels of granularity. Therefore, for effective service monitoring, these systems have a special requirement of multi-granular RCA. Furthermore, as a large proportion of anomalies in microservice systems pertain to problematic code, to timely troubleshoot these anomalies, these systems have another special requirement of RCA at the finest code-level. Microservice systems rely on telemetry data to perform service monitoring and RCA of service anomalies. The majority of existing RCA approaches are only based on a single type of telemetry data and as a result can only support uni-granular RCA at either application-level or service-level. Although there are attempts to combine metric and tracing data in RCA, their objective is to improve RCA's efficiency or accuracy rather than to support multi-granular RCA. In this article, we propose a new RCA solution TrinityRCL that is able to localize the root causes of anomalies at multiple levels of granularity including application-level, service-level, host-level, and metric-level, with the unique capability of code-level localization by harnessing all three types of telemetry data to construct a causal graph representing the intricate, dynamic, and nondeterministic relationships among the various entities related to the anomalies. By implementing and deploying TrinityRCL in a real production environment, we evaluate TrinityRCL against two baseline methods and the results show that TrinityRCL has a significant performance advantage in terms of accuracy at the same level of granularity with comparable efficiency and is particularly effective to support large-scale systems with massive telemetry data.

GRANO: Interactive Graph-based Root Cause Analysis for Cloud-Native Distributed Data Platform

Groot: An Event-graph-based Approach for Root Cause Analysis in Industrial Settings

Automated Root Cause Analysis with Observability Data - A Comprehensive Review

A Real-Time Trace-Level Root-Cause Diagnosis System in Alibaba Datacenters

CloudRCA: A Root Cause Analysis Framework for Cloud Computing Platforms

Root Cause Analysis for Cloud-Native Applications

RCInvestigator: Towards Better Investigation of Anomaly Root Causes in Cloud Computing Systems

KGroot: Enhancing Root Cause Analysis through Knowledge Graphs and Graph Convolutional Neural Networks

Root Cause Analysis In Microservice Using Neural Granger Causal Discovery

TrinityRCL: Multi-Granular and Code-Level Root Cause Localization Using Multiple Types of Telemetry Data in Microservice Systems

Causality Enhanced Graph Representation Learning for Alert-Based Root Cause Analysis

CloudRanger: Root Cause Identification for Cloud Native Systems

Mining Root Cause Knowledge from Cloud Service Incident Investigations for AIOps

Disentangled Causal Graph Learning for Online Unsupervised Root Cause Analysis

RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models

GRU-Based Interpretable Multivariate Time Series Anomaly Detection in Industrial Control System

G-RCA: a Generic Root Cause Analysis Platform for Service Quality Management in Large IP Networks

Online Multi-modal Root Cause Analysis

Griffon: Reasoning about Job Anomalies with Unlabeled Data in Cloud-based Platforms

PORCA: Root Cause Analysis with Partially Observed Data

Automated Root Causing of Cloud Incidents using In-Context Learning with GPT-4