MicroRCA-Agent: Microservice Root Cause Analysis Method Based on Large Language Model Agents

2025-09-19

AI Summary

To address the insufficient intelligence and low efficiency of root cause analysis (RCA) in microservice systems, this paper proposes a multimodal RCA framework powered by large language model (LLM) agents. Methodologically, we design a three-tier technical architecture: (1) a lightweight log compression mechanism; (2) a dual-mode anomaly detection framework integrating Isolation Forest with HTTP status code validation; and (3) a statistical symmetric ratio filtering module coupled with a two-stage LLM reasoning strategy—enhanced by Drain-based log parsing and cross-modal prompt engineering to improve cross-modal understanding and logical attribution. Evaluated on complex fault scenarios, our framework achieves a comprehensive score of 50.71. Ablation studies confirm the effectiveness of each component. The implementation is publicly available as open-source code.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Cognitive Modeling & Cognitive Systems: Agent Architectures
• Multiagent Systems: Agent Communication

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Machine-in-the-loop, human agency and autonomy

Abstract

This paper presents MicroRCA-Agent, an innovative solution for microservice root cause analysis based on large language model agents, which constructs an intelligent fault root cause localization system with multimodal data fusion. The technical innovations are embodied in three key aspects: First, we combine the pre-trained Drain log parsing algorithm with multi-level data filtering mechanism to efficiently compress massive logs into high-quality fault features. Second, we employ a dual anomaly detection approach that integrates Isolation Forest unsupervised learning algorithms with status code validation to achieve comprehensive trace anomaly identification. Third, we design a statistical symmetry ratio filtering mechanism coupled with a two-stage LLM analysis strategy to enable full-stack phenomenon summarization across node-service-pod hierarchies. The multimodal root cause analysis module leverages carefully designed cross-modal prompts to deeply integrate multimodal anomaly information, fully exploiting the cross-modal understanding and logical reasoning capabilities of large language models to generate structured analysis results encompassing fault components, root cause descriptions, and reasoning trace. Comprehensive ablation studies validate the complementary value of each modal data and the effectiveness of the system architecture. The proposed solution demonstrates superior performance in complex microservice fault scenarios, achieving a final score of 50.71. The code has been released at: https://github.com/tangpan360/MicroRCA-Agent.

Problem

• Automating root cause analysis in microservice failures
• Integrating multimodal data for intelligent fault localization
• Enhancing anomaly detection with LLM-based reasoning capabilities

Innovation

• Combines Drain log parsing with multi-level filtering
• Uses Isolation Forest and status code validation
• Employs statistical symmetry ratio with two-stage LLM analysis