Graph-Free Root Cause Analysis

TL;DR

This work tackles root-cause analysis in distributed systems when the dependency graph is unknown. It introduces PRISM, a graph-free RCA framework built on the Component-Property Model to separate internal properties (causal) from external properties (observable) and to aggregate evidence via deviation-based scores $S^I_i$ and $S^E_i$, combined with scoring functions $M_{ ext{add}}$ or $M_{ ext{conj}}$ to rank root causes. The paper provides theoretical guarantees ensuring correct ranking under CPM axioms and demonstrates that deviation-based scoring outperforms IT-based approaches due to injectivity, with robust performance across pooling strategies. Empirically, PRISM achieves $68 ext{%}$ Top-1 accuracy on $735$ failures across nine RCAEval datasets and runs in around $8$ ms per diagnosis, enabling scalable, real-time RCA without dependency graphs.

Abstract

Failures in complex systems demand rapid Root Cause Analysis (RCA) to prevent cascading damage. Existing RCA methods that operate without dependency graph typically assume that the root cause having the highest anomaly score. This assumption fails when faults propagate, as a small delay at the root cause can accumulate into a much larger anomaly downstream. In this paper, we propose PRISM, a simple and efficient framework for RCA when the dependency graph is absent. We formulate a class of component-based systems under which PRISM performs RCA with theoretical guarantees. On 735 failures across 9 real-world datasets, PRISM achieves 68% Top-1 accuracy, a 258% improvement over the best baseline, while requiring only 8ms per diagnosis.

Figures (6)

• Figure 1: Component-Property Model. Solid arrows denote causal influence between internal properties (e.g., configs) and external properties (e.g., response time). Faults originate in internal properties and propagate through external properties (Axioms \ref{['ax:direction']}--\ref{['ax:isolation']}).
• Figure 2: Overview of PRISM. Given observational data of internal and external properties for each component, PRISM first computes deviation-based anomaly scores, then pools property-level scores into component-level internal ($S^I_i$) and external ($S^E_i$) scores, and finally ranks root cause components. The root cause ($C_1$) exhibits substantially high anomaly scores for both internal and external properties.
• Figure 3: Running time per failure case (log scale). PRISM (8.2ms median) matches the efficiency of the fastest baseline (BARO).
• Figure 4: Sensitivity w.r.t. different post-fault data length.
• Figure 5: IT-score saturation on a disk fault in currencyservice. Despite vastly different anomaly magnitudes (max $\tau$ ranging from 10.7 to 133.4), all metrics receive identical IT-scores of approximately 6.58. The root cause metrics (currencyservice_cpu and currencyservice_latency, marked $\star$) cannot be distinguished from downstream effects (checkoutservice_latency, cartservice_latency) based on IT-scores alone. The summary table quantifies the saturation: a 12$\times$ difference in $\tau$ magnitude yields identical scores.

Theorems & Definitions (35)

• Definition 2.1
• Definition 2.2
• Definition 2.3
• Definition 3.1
• Definition 3.2: Monotonicity
• Definition 3.3: Injectivity
• Lemma 3.4
• Theorem 3.5: Deviation-based Scorers satisfy conditions
• Theorem 3.6
• Definition 3.7: Score Pooling