Correlation-Driven Root Cause Analysis from Multi-Service Logs via Template-Aware Graph Inference: An Empirical Study on LogHub Hadoop and RCAEval Sock Shop
Article Sidebar
Main Article Content
Abstract
Root cause analysis (RCA) has become urgent in AIOps because modern incidents rarely stay inside one component: failures propagate across services and operators must identify the initiating service, not only the loudest symptom. Prior log analytics studies have mainly emphasized parsing and anomaly detection, while recent microservice RCA benchmarks have focused on service localization with multimodal telemetry. This paper studies a narrower and practical question: how far can correlation-driven RCA go when only multi-service logs and their event templates are used? We present a template-aware correlation-graph framework that converts raw logs into service-template events, learns directed lagged edges, and ranks root-cause candidates using direct anomaly evidence, one-step edge attribution, and reverse personalized PageRank. Experiments are conducted on the complete LogHub Hadoop logs and the RCAEval RE2-SS Sock Shop data. The Hadoop corpus contains 394,310 raw log lines, 55 applications, and 44 labeled abnormal applications. RE2-SS contains 90 fault cases, five root services, six fault types, and 7,566,220 log rows. On RE2-SS, the proposed HybridRCA reaches 0.267 Top-1, 0.456 Top-3, and 0.435 MRR for service-level root localization, improving Top-1 and MRR over frequency-only ranking. A metric-only reference reaches 0.578 Top-1, showing that log-only RCA remains limited for resource faults whose strongest symptoms appear in metrics rather than logs. The results support correlation graphs as useful diagnostic evidence while clarifying the unresolved weakness of log-only RCA in multimodal microservice incidents.
Article Details
Section
This work is licensed under a Creative Commons Attribution 4.0 International License.
How to Cite
References
[1] J. Zhu, S. He, P. He, J. Liu, and M. R. Lyu, “Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics,” Proceedings - International Symposium on Software Reliability Engineering, ISSRE, pp. 355–366, 2023, doi: 10.1109/ISSRE59848.2023.00071.
[2] J. Zhu, S. He, P. He, J. Liu, and M. R. Lyu, “Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics,” Proceedings - International Symposium on Software Reliability Engineering, ISSRE, pp. 355–366, 2020, doi: 10.1109/ISSRE59848.2023.00071. DOI: https://doi.org/10.1109/ISSRE59848.2023.00071
[3] J. Zhu et al., “Tools and Benchmarks for Automated Log Parsing,” Proceedings - 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice, ICSE-SEIP 2019, pp. 121–130, 2019, doi: 10.1109/ICSE-SEIP.2019.00021. DOI: https://doi.org/10.1109/ICSE-SEIP.2019.00021
[4] M. Du, F. Li, G. Zheng, and V. Srikumar, “DeepLog: Anomaly detection and diagnosis from system logs through deep learning,” Proceedings of the ACM Conference on Computer and Communications Security, pp. 1285–1298, 2017, doi: 10.1145/3133956.3134015. DOI: https://doi.org/10.1145/3133956.3134015
[5] W. Meng et al., “Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs,” IJCAI International Joint Conference on Artificial Intelligence, vol. 2019-August, pp. 4739–4745, 2019, doi: 10.24963/IJCAI.2019/658. DOI: https://doi.org/10.24963/ijcai.2019/658
[6] H. Guo, S. Yuan, and X. Wu, “LogBERT: Log Anomaly Detection via BERT,” Proceedings of the International Joint Conference on Neural Networks, vol. 2021-July, 2021, doi: 10.1109/IJCNN52387.2021.9534113. DOI: https://doi.org/10.1109/IJCNN52387.2021.9534113
[7] Z. Jiang et al., “A Large-Scale Evaluation for Log Parsing Techniques: How Far Are We?,” ISSTA 2024 - Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 223–234, 2024, doi: 10.1145/3650212.3652123. DOI: https://doi.org/10.1145/3650212.3652123
[8] N. Zhao et al., “An empirical investigation of practical log anomaly detection for online service systems,” ESEC/FSE 2021 - Proceedings of the 29th ACM Joint Meeting European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp. 1404–1415, 2021, doi: 10.1145/3468264.3473933. DOI: https://doi.org/10.1145/3468264.3473933
[9] L. Wu, J. Tordsson, E. Elmroth, and O. Kao, “MicroRCA: Root Cause Localization of Performance Issues in Microservices,” Proceedings of IEEE/IFIP Network Operations and Management Symposium 2020: Management in the Age of Softwarization and Artificial Intelligence, NOMS 2020, 2020, doi: 10.1109/NOMS47738.2020.9110353. DOI: https://doi.org/10.1109/NOMS47738.2020.9110353
[10] Z. Yao et al., “Chain-of-Event: Interpretable Root Cause Analysis for Microservices through Automatically Learning Weighted Event Causal Graph,” FSE Companion - Companion Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering, pp. 50–61, 2024, doi: 10.1145/3663529.3663827. DOI: https://doi.org/10.1145/3663529.3663827
[11] L. Pham, H. Ha, and H. Zhang, “Root Cause Analysis for Microservice System based on Causal Inference: How Far Are We?,” Proceedings - 2024 39th ACM/IEEE International Conference on Automated Software Engineering, ASE 2024, pp. 706–718, 2024, doi: 10.1145/3691620.3695065. DOI: https://doi.org/10.1145/3691620.3695065
[12] L. Pham, H. Zhang, H. Ha, F. Salim, and X. Zhang, “RCAEval: A Benchmark for Root Cause Analysis of Microservice Systems with Telemetry Data,” WWW Companion 2025 - Companion Proceedings of the ACM Web Conference 2025, pp. 777–780, 2025, doi: 10.1145/3701716.3715290. DOI: https://doi.org/10.1145/3701716.3715290
[13] Y. Wang, Z. Zhu, Q. Fu, Y. Ma, and P. He, “MRCA: Metric-level Root Cause Analysis for Microservices via Multi-Modal Data,” in 2024 39th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2024, pp. 1057–1068, doi: 10.1145/3691620.369548. DOI: https://doi.org/10.1145/3691620.3695485
[14] Z. Zhu, C. Lee, X. Tang, and P. He, “HeMiRCA: Fine-Grained Root Cause Analysis for Microservices with Heterogeneous Data Sources,” ACM Transactions on Software Engineering and Methodology, vol. 33, no. 8, pp. 1–25, 2024, doi: https://doi.org/10.1145/3674726. DOI: https://doi.org/10.1145/3674726
[15] PhamLuan, HaHuong, and ZhangHongyu, “BARO: Robust Root Cause Analysis for Microservices via Multivariate Bayesian Online Change Point Detection,” Proceedings of the ACM on Software Engineering, vol. 1, no. FSE, pp. 2214–2237, 2024, doi: 10.1145/3660805. DOI: https://doi.org/10.1145/3660805
[16] Z. Zhao et al., “CHASE: A Causal Hypergraph based Framework for Root Cause Analysis in Multimodal Microservice Systems,” IEEE Transactions on Big Data, pp. 1–14, 2025, doi: 10.1109/TBDATA.2026.3725931. DOI: https://doi.org/10.1109/TBDATA.2026.3725931
[17] N. Fu, G. Cheng, Y. Teng, G. Dai, S. Yu, and Z. Chen, “Intelligent Root Cause Localization in MicroService Systems: A Survey and New Perspectives,” ACM Computing Surveys, vol. 57, no. 12, 2025, doi: 10.1145/3736755. DOI: https://doi.org/10.1145/3736755
[18] P. He, J. Zhu, Z. Zheng, and M. R. Lyu, “Drain: An Online Log Parsing Approach with Fixed Depth Tree,” Proceedings - 2017 IEEE 24th International Conference on Web Services, ICWS 2017, pp. 33–40, 2017, doi: 10.1109/ICWS.2017.13. DOI: https://doi.org/10.1109/ICWS.2017.13
[19] A. Makanju, A. N. Zincir-Heywood, and E. E. Milios, “A lightweight algorithm for message type extraction in system application logs,” IEEE Transactions on Knowledge and Data Engineering, vol. 24, no. 11, pp. 1921–1936, 2012, doi: 10.1109/TKDE.2011.138. DOI: https://doi.org/10.1109/TKDE.2011.138
[20] J. Pearl, Causality: Models, Reasoning and Inference. New York: Cambridge University Press, 2009. DOI: https://doi.org/10.1017/CBO9780511803161
[21] Granger and C. W. J, “Investigating Causal Relations by Econometric Models and Cross-Spectral Methods,” Econometrica, vol. 37, no. 3, pp. 424–438, 1969. DOI: https://doi.org/10.2307/1912791
[22] L. Page, S. Brin, R. Motwani, and T. Winograd, The PageRank Citation Ranking : Bringing Order to the Web. 1999.