Agentic Structured Graph Traversal for Root Cause Analysis of Code-related Incidents in Cloud Applications

TL;DR

Praxis tackles cloud incident RCA costs and delays by introducing an LLM-driven, structure-aware traversal over a microservice SDG and per-service hammock-block PDGs to diagnose code- and configuration-related faults. The Cross-SDG-PDG approach constrains reasoning to relevant dependency paths, enabling multi-hop RCA and outputting a comprehensive root-cause report grounded in both observability and program context. In tests on a 30-scenario Code-Cloud-RCA Benchmark, Praxis yields up to $3.1\times$ improvements in RCA accuracy and $3.8\times$ token reduction over state-of-the-art ReAct baselines, demonstrating significant gains in precision and efficiency for cloud incident analysis. The work advances practical RCA by combining graph-structured reasoning with program analysis and provides a benchmark to drive future improvements in cloud-service RCA.

Abstract

Cloud incidents pose major operational challenges in production, with unresolved production cloud incidents cost on average over $2M per hour. Prior research identifies code- and configuration-related issues as the predominant category of root causes in cloud incidents. This paper introduces PRAXIS, an orchestrator that manages and deploys an agentic workflow for diagnosing code- and configuration-caused cloud incidents. PRAXIS employs an LLM-driven structured traversal over two types of graph: (1) a service dependency graph (SDG) that captures microservice-level dependencies; and (2) a hammock-block program dependence graph (PDG) that captures code-level dependencies for each microservice. Together, these graphs encode microservice- and code-level dependencies and the LLM acts as a traversal policy over these graphs, moving between services and code dependencies to localize and explain failures. Compared to state-of-the-art ReAct baselines, PRAXIS improves RCA accuracy by up to 3.1x while reducing token consumption by 3.8x. PRAXIS is demonstrated on a set of 30 comprehensive real-world incidents that is being compiled into an RCA benchmark.

Figures (7)

• Figure 1: Incident: Degraded external database returned empty responses, triggering a silent retry loop in the Recommendation service that manifested solely as high latency alert associated with the Recommendation service, without explicit error logs or error traces. Cross-SDG-PDG traversal: (1) LLM selects the Recommendation service for investigation based on the observed alert. (2) Investigation of the Recommendation service reveals a silent retry loop with missing error logs. Code traversal shows that an unresponsive External Product Database triggers this loop. (3) Subsequent investigation shows a storage failure in the External Product DB as the root cause. (4) The ReAct agent baseline fails to pinpoint the precise root cause, whereas Praxis successfully isolates the root cause.
• Figure 2: Praxis Phase 1: Data gathering and dependency graph construction.
• Figure 3: Praxis Phase 2: Initial microservice candidate(s) selection.
• Figure 4: Praxis Phase 3: RCA decision-making. This process is repeated for the next focal entity that is (a) a dependee of the current focal entity and/or (b) suggested by the LLM based on the focal entity's RCA decision.
• Figure 5: Example LLM-driven PDG traversal.