The task of root cause analysis (RCA) is to identify the root causes of system faults/failures by analyzing system monitoring data. Efficient RCA can greatly accelerate system failure recovery and mitigate system damages or financial losses. However, previous research has mostly focused on developing offline RCA algorithms, which often require manually initiating the RCA process, a significant amount of time and data to train a robust model, and then being retrained from scratch for a new system fault. In this paper, we propose CORAL, a novel online RCA framework that can automatically trigger the RCA process and incrementally update the RCA model. CORAL consists of Trigger Point Detection, Incremental Disentangled Causal Graph Learning, and Network Propagation-based Root Cause Localization. The Trigger Point Detection component aims to detect system state transitions automatically and in near-real-time. To achieve this, we develop an online trigger point detection approach based on multivariate singular spectrum analysis and cumulative sum statistics. To efficiently update the RCA model, we propose an incremental disentangled causal graph learning approach to decouple the state-invariant and state-dependent information. After that, CORAL applies a random walk with restarts to the updated causal graph to accurately identify root causes. The online RCA process terminates when the causal graph and the generated root cause list converge. Extensive experiments on three real-world datasets with case studies demonstrate the effectiveness and superiority of the proposed framework.

翻译：根因分析（RCA）任务旨在通过分析系统监控数据，识别系统故障或失效的根本原因。高效的RCA能够极大加速系统故障恢复，减轻系统损害或经济损失。然而，以往研究主要集中于开发离线RCA算法，这些算法通常需要手动启动RCA过程，耗费大量时间和数据来训练鲁棒模型，并在面对新系统故障时需从头重新训练。本文提出CORAL，一种新颖的在线RCA框架，能够自动触发RCA过程并增量更新RCA模型。CORAL包含触发点检测、增量式解耦因果图学习以及基于网络传播的根因定位三个组件。触发点检测组件旨在自动且近实时地检测系统状态转换。为此，我们基于多变量奇异谱分析和累积和统计量，开发了一种在线触发点检测方法。为高效更新RCA模型，我们提出一种增量式解耦因果图学习方法，以分离状态不变信息和状态依赖信息。随后，CORAL对更新后的因果图应用带重启的随机游走，以准确识别根因。当因果图及生成的根因列表收敛时，在线RCA过程终止。基于三个真实世界数据集的广泛实验及案例研究，证明了所提框架的有效性和优越性。