Root Cause Analysis & AIOps

From telemetry to root causes

A failure in one service can surface as errors, slowdowns, or unusual resource usage elsewhere. Root cause analysis (RCA) connects these symptoms to the underlying fault. Doing so requires reasoning across heterogeneous telemetry and the dependencies between services.

We study how AI for IT operations (AIOps) can help engineers move from detecting an anomaly to understanding a failure and deciding what to do next. Our research brings together statistical analysis, graph structure, and LLM agents, with an emphasis on diagnoses and repair decisions grounded in operational evidence.

Graph-guided diagnosis and incident response

GALA, whose updated framework is called GALA+, uses service dependencies to guide LLM agents through local metrics, logs, and traces. It produces ranked diagnoses, incident summaries, and action recommendations. SURE-Score, developed with industry site reliability engineers, assesses diagnostic quality beyond text similarity.

Message-level anomaly detection

Effective investigation starts with finding useful signals in large volumes of telemetry. FAME studies anomaly detection at the level of individual log messages. It uses an LLM during offline preparation to help organize failure domains, then trains a lightweight router and specialized experts for online detection with limited labeling effort.

Telemetry-grounded repair

Diagnosis can also provide context for changing code and configuration. ORCA compares failure and reference telemetry to build a fault signature, locate candidate repair sites, and guide patch generation. Its verification process examines patch correctness, test integrity, and telemetry replay to connect automated repair with the incident that motivated it.

Reliable agents and realistic evaluation

AI agents are both tools for incident response and systems whose own failures need diagnosis. AgentChaosBench studies fault detection and localization from agent execution telemetry, including faults at tool, model, guardrail, and inter-agent boundaries.

SREGym evaluates SRE agents in live cloud-native environments with injected faults and ambient noise. These complementary settings help us examine whether an agent can identify a fault, locate its origin, and support incident resolution under realistic operating conditions.

GF-Bench extends failure detection to distributed GPU workloads, while SRE-Marathon studies continuous operation with overlapping incidents and code or configuration changes.

Current directions

• Correlating metrics, logs, and traces across service dependencies
• Graph-guided and evidence-grounded LLM investigation
• Connecting root cause diagnosis to remediation and automated repair
• Evaluating diagnostic quality, agent reliability, and operational usefulness

This research connects with our work in Data Management. We also continue research in distributed AI and machine learning, including resource allocation and scheduling for training and inference, privacy-preserving and federated learning on embedded and edge devices, and scalable graph processing and graph neural networks.