TAMO: Fine-Grained Root Cause Analysis via Tool-Assisted LLM Agent with Multi-Modality Observation Data in Cloud-Native Systems

TL;DR

TAMO addresses fine-grained RCA in cloud-native microservice systems by fusing multimodal observability (logs, metrics, traces) into time-aligned representations through a dual-branch diffusion-based Multi-modality Alignment Tool ($\mathscr{T}_1$). It then localizes root causes with a frequency-domain causal graph via FFT and a Graph Attention Network ($\mathscr{T}_2$), and classifies fault types using a Transformer+GAT architecture ($\mathscr{T}_3$); these outputs are synthesized by an RCA Expert Agent ($\mathscr{A}$) powered by GPT-4 to deliver detailed fault analyses and remediation strategies. Empirical results on two public datasets show TAMO achieving state-of-the-art performance in both root-cause localization (Acc@1 to Acc@5) and fault-type classification (MiPr/MiF1), with ablations confirming the necessity of each component. The approach demonstrates substantial improvements over prior multimodal RCA methods and enables real-time, context-aware diagnostics that can significantly reduce downtime in cloud-native operations.

Abstract

Implementing large language models (LLMs)-driven root cause analysis (RCA) in cloud-native systems has become a key topic of modern software operations and maintenance. However, existing LLM-based approaches face three key challenges: multi-modality input constraint, context window limitation, and dynamic dependence graph. To address these issues, we propose a tool-assisted LLM agent with multi-modality observation data for fine-grained RCA, namely TAMO, including multimodality alignment tool, root cause localization tool, and fault types classification tool. In detail, TAMO unifies multi-modal observation data into time-aligned representations for cross-modal feature consistency. Based on the unified representations, TAMO then invokes its specialized root cause localization tool and fault types classification tool for further identifying root cause and fault type underlying system context. This approach overcomes the limitations of LLMs in processing real-time raw observational data and dynamic service dependencies, guiding the model to generate repair strategies that align with system context through structured prompt design. Experiments on two benchmark datasets demonstrate that TAMO outperforms state-of-the-art (SOTA) approaches with comparable performance.

Figures (7)

• Figure 1: A failure case in a cloud-native system demonstrates three major challenges when using LLM directly for root cause analysis.
• Figure 2: The proposed TAMO framework consists of a Multi-modality Alignment Tool ($\mathscr{T}_1$), a Root Cause Localization Tool ($\mathscr{T}_2$), a Fault Types Classification Tool ($\mathscr{T}_3$), and an RCA Expert Agent ($\mathscr{A}$). In the framework, the agent $\mathscr{A}$ calls tools $\mathscr{T}_1$-$\mathscr{T}_3$ as perception tools to analyze the system contextual observation data in real time. The results of these perceptions are structured into text inputs that are fed back into the agent. By analyzing the perception results, the expert agent will provide the corresponding root cause analysis and repair suggestions.
• Figure 3: Prompt templates for this RCA expert agent.
• Figure 4: Hyperparameter sensitivity analysis across batch size, $\mu$, regularization strength ($\beta$), and hidden dimension.
• Figure 5: Comparision of training time and inference time of TAMO with Eadro.