๐ค AI Summary
While microservice failures are readily detectable, root cause analysis remains inefficient due to alarm flooding and the absence of structured memory capturing system dependencies and historical behaviors. This work proposes a topology-aware, operation-memory-driven multi-agent architecture that decouples root cause inference from explanation for the first time: the former relies on deterministic computation using a learned dependency graph and temporal anomaly thresholds, while the latter leverages a large language model to generate interpretable recommendations grounded in structured evidence. A novel four-layer operational memory mechanism enables traceable and reusable autonomous operations. Evaluated on an e-commerce benchmark platform with eight types of injected faults, the approach successfully reproduces and resolves two real-world cascading failures, significantly improving diagnostic accuracy and efficiency.
๐ Abstract
Modern microservice deployments fail in ways that are easy to detect and hard to explain. When a fault propagates along service dependencies, alerts fire in floods, dashboards multiply, and the scarce resource, an engineer who understands how the services relate, is consumed reconstructing context that the monitoring stack discarded. We argue that the missing ingredient in autonomous operations is not a better anomaly detector or a larger language model, but operational memory: a persistent, structured representation of how a system normally behaves, how its parts depend on one another, and how it has failed before. We present O PS C ORTEX, a working multi-agent prototype that organizes this memory into four tiers and uses it to separate two tasks the field usually conflates: deriving a root cause and explaining it. Root cause is computed deterministically from a learned dependency graph and the temporal ordering of threshold crossings; a large language model (LLM) is then asked only to explain, confirm, and recommend, using evidence the system has already assembled. We motivate the design with two documented production cascading failures, review representative literature on observability, anomaly detection, graph-based localization, and LLM-assisted diagnosis, and show how each architectural choice maps directly to a failure mode those incidents exhibit. The prototype is validated on an instrumented e-commerce benchmark with eight injectable failure scenarios.