LLM-Augmented Multi-Source Root Cause Attribution for CPU and Network Faults in Microservices

Abstract

Microservice incidents rarely appear in one telemetry stream. A CPU saturation fault may first surface as elevated resource usage, while a network-delay or packet-loss fault may appear as slow spans, retry logs, and propagated request failures. This paper presents an LLM-augmented multi-source root cause attribution method for CPU-load, network-delay, and network-loss incidents in microservice systems. The method aligns metrics, logs, and traces around each injected fault interval, converts each source into service-level anomaly evidence, adds a constrained incident-summary channel, and ranks candidate services with a dependency-aware fusion score. In this revised manuscript, the empirical results are produced on the official Eadro SN and TT raw archives rather than on a deterministic fixture. The fault JSON files are expanded into 117 injection-level RCA cases: 36 Social Network cases and 81 Train Ticket cases. On these raw cases, the summary-adaptive fusion achieved Top-1 = 0.504, Top-3 = 0.650, Top-5 = 0.667, mean rank = 6.171, and MRR = 0.595. Metrics-only reached Top-1 = 1.000 on cpu_load incidents but was weak on network_delay and network_loss. Trace-only supplied stronger network-fault context, and the constrained summary gate improved the overall Top-1 accuracy over fixed multi-source fusion.