Root cause analysis is crucial for cloud-native systems. However, existing supervised approaches ignore the potential of unlabeled data, which is frequent in the cloud-native root cause analysis scenarios. Moreover, the class-imbalanced distribution of faults presents obstacles to applying semi-supervised learning. To overcome these limitations, we propose STRCA, a metrics-based semi-supervised self-training approach for root cause analysis. Furthermore, STRCA employs minority priority self-training, which selects pseudo-labels of high quality during generations. Additionally, the stepwise distribution alignment is introduced to rebalance the predicted distribution with gradually decreasing strength. These two strategies mitigate the class-imbalance of data in semi-supervised learning. Experiments on the public dataset show the effectiveness of STRCA with limited labels.

Failure root cause analysis (RCA), which systematically identifies underlying faults, is essential for ensuring the reliability of widely adopted microservice-based applications and cloud-native systems. However, manual analysis by simple rules faces significant burdens due to the heterogeneous nature of resource entities and the massive amount of observability data. Furthermore, existing approaches for automating RCA struggle to perform in-depth fault analysis without extensive fault labels. To address the scarcity of fault labels, we examine an extreme RCA scenario where each fault type has only one example (one-shot). We propose LasRCA, a framework for one-hot RCA in cloud-native systems that leverages the collaboration of the large language model (LLM) and the small classifier. In the training stage, LasRCA initially trains a small classifier based on one-shot fault examples. The small classifier then iteratively selects high-confusion samples and receives feedback on their fault types from LLM-driven fault labeling. These samples are applied to retrain the small classifier. In the inference stage, LasRCA performs a joint RCA through the collaboration of the LLM and small classifier, achieving a trade-off between effectiveness and cost. Experiment results on public datasets with heterogeneous nature and prevalent fault types show the effectiveness of LasRCA in one-shot RCA.

Microservices are widely adopted in large IT enterprises, leveraging the scalability, resiliency, and elasticity of the cloud-native architecture. Effective root cause analysis is crucial for ensuring the reliability of such cloud-native systems. Many efforts have focused on using the three modalities of observability data–traces, metrics, and logs. However, existing approaches are limited by inconsistent problem definitions and cloud-native heterogeneity. To address these challenges, we proposeHolisticRCA, a root cause analysis framework in cloud-native systems from a holistic perspective.HolisticRCAformally defines root cause analysis through three dimensions. ThenHolisticRCAuses an “assembling building blocks” strategy to address the cloud-native heterogeneity. It maps each observability feature into a shared vector space and concatenates the vector embeddings associated with each resource entity for standardized resource entity vector embeddings. Then it applies Graph Attention Network to capture intertwined resource entity relations and incorporates mask embeddings to enable holistic analysis. The evaluation results on three public datasets show thatHolisticRCAoutperforms existing approaches in holistic root cause analysis of cloud-native systems.

Modern large-scale systems and networks necessitate automated anomaly detection to support the high availability and quality of services. Since logs are an essential data source that can accurately reflect the state of a system, log anomaly detection has attracted a lot of attention from researchers in both academia and industry. As the technology of artificial intelligence advances, plenty of work has adopted deep learning to detect log anomalies and achieved promising results. Nevertheless, it usually suffers from a lack of labels, excessive log sequence length, and low throughput problems when deploying to real-world systems. To address these challenges, we propose Log-Fold, an unsupervised Transformer-based log anomaly detection approach. In LogFold, we propose fold embedding, which can compress long log sequences to enhance the efficiency of anomaly detection. And we design a sequence reconstruction technique to enhance the effectiveness of anomaly detection. Our evaluation shows LogFold achieves 90.55% and 99.90% Fl-score on HDFS and BGL datasets, respectively, outperforming state-of-the-art methods. Besides, the fold embedding layer achieves compression rates of 36.55% and 64.86% on HDFS and BGL datasets, respectively, which helps to improve the throughput of LogFold.

Root cause analysis for multi-dimensional time series from large scale micro-service scenarios aims at identifying the set of anomaly attributes by monitoring operational metrics. The online metrics provide a general indication to investigate these attributes' inter-dependencies and can guide the overall exploration process. However, the problem space for the root cause localization still remains largely challenging due to the combinatorial explosion of possible attribute combinations. This leads researchers and practitioners to (a) assume some prior distributions on the data set; (b) assume some data patterns on the attribute combinations; (c) perform pruning techniques to reduce the search space. Furthermore, state-of-the-art root cause analysis methods are often tied to one or more of these assumptions, which makes it difficult to be robust to general scenarios. In this paper, we conclude the heterogeneity in the data patterns by analyzing several open and industrial datasets. A uniform analytical framework, PatternRCA, is proposed such that it can be aware of the patterns in the metrics while avoiding explicit assumptions about them. We design an offline learning procedure that enables the framework to detect existing data patterns, which then can guide it to do fine-grain exploration in online metrics. Our extensive evaluation results show that PatternRCA outperforms state-of-the-art models with better benchmark results in public datasets. Meanwhile, it can scale to complex root cause analysis tasks on datasets with hybrid patterns in production environments.