Groot: An Event-graph-based Approach for Root Cause Analysis in Industrial Settings

Abstract

For large-scale distributed systems, it is crucial to efficiently diagnose the root causes of incidents to maintain high system availability. The recent development of microservice architecture brings three major challenges (i.e., operation, system scale, and monitoring complexities) to root cause analysis (RCA) in industrial settings. To tackle these challenges, in this paper, we present GROOT, an event-graph-based approach for RCA. GROOT constructs a real-time causality graph based on events that summarize various types of metrics, logs, and activities in the system under analysis. Moreover, to incorporate domain knowledge from site reliability engineering (SRE) engineers, GROOT can be customized with user-defined events and domainspecific rules. Currently, GROOT supports RCA among 5,000 real production services and is actively used by the SRE team in a global e-commerce system serving more than 185 million active buyers per year. Over 15 months, we collect a data set containing labeled root causes of 952 real production incidents for evaluation. The evaluation results show that GROOT is able to achieve 95% top-3 accuracy and 78% top-1 accuracy. To share our experience in deploying and adopting RCA in industrial settings, we conduct survey to show that users of GROOT find it helpful and easy to use. We also share the lessons learned from deploying and adopting GROOT to solve RCA problems in production environments.

CausIL: Causal Graph for Instance Level Microservice Data

“…Multiple works [11,27,[45][46][47] aim to build a causal graph at the performance metric level to diagnose a system in terms of faulty metrics of a service. They utilize the PC algorithm [39], a causal structure estimation algorithm, to construct a causal dependency graph at the performance metric level, with each metric representing a node.…”