# Groot: An Event-graph-based Approach for Root Cause Analysis in Industrial Settings

arXiv: https://arxiv.org/abs/2108.00344 · HTML: https://mlsanity.com/paper/2108.00344/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Aug 2021.

## Built on by (most cited first, 15 of 15)

- [Causal Inference-Based Root Cause Analysis for Online Service Systems with Intervention Recognition](https://mlsanity.com/paper/2206.05871/) (2022)
- [Root Cause Analysis In Microservice Using Neural Granger Causal Discovery](https://mlsanity.com/paper/2402.01140/) (2024)
- [A Survey of Graph-based Deep Learning for Anomaly Detection in Distributed Systems](https://mlsanity.com/paper/2206.04149/) (2022)
- [AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges](https://mlsanity.com/paper/2304.04661/) (2023)
- [A Comprehensive Survey on Root Cause Analysis in (Micro) Services: Methodologies, Challenges, and Trends](https://mlsanity.com/paper/2408.00803/) (2024)
- [StepFly: Agentic Troubleshooting Guide Automation for Incident Diagnosis](https://mlsanity.com/paper/2510.10074/) (2025)
- [Identifying Performance Issues in Cloud Service Systems Based on Relational-Temporal Features](https://mlsanity.com/paper/2307.10869/) (2023)
- [Knowledge-aware Alert Aggregation in Large-scale Cloud Systems: a Hybrid Approach](https://mlsanity.com/paper/2403.06485/) (2024)
- [Root Cause Localization for Microservice Systems in Cloud-edge Collaborative Environments](https://mlsanity.com/paper/2406.13604/) (2024)
- [KGroot: Enhancing Root Cause Analysis through Knowledge Graphs and Graph Convolutional Neural Networks](https://mlsanity.com/paper/2402.13264/) (2024)
- [Root Cause Analysis Method Based on Large Language Models with Residual Connection Structures](https://mlsanity.com/paper/2602.08804/) (2026)
- [EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems](https://mlsanity.com/paper/2605.00936/) (2026)
- [TopoEvo: A Topology-Aware Self-Evolving Multi-Agent Framework for Root Cause Analysis in Microservices](https://mlsanity.com/paper/2605.15611/) (2026)
- [LLM-Augmented Knowledge Base Construction For Root Cause Analysis](https://mlsanity.com/paper/2604.06171/) (2026)
- [EvoCause: LLM-Guided Evolution of Causal Graphs for Root Cause Analysis](https://mlsanity.com/paper/2607.27290/) (2026)

## Abstract (arXiv)

For large-scale distributed systems, it's crucial to efficiently diagnose the root causes of incidents to maintain high system availability. The recent development of microservice architecture brings three major challenges (i.e., operation, system scale, and monitoring complexities) to root cause analysis (RCA) in industrial settings. To tackle these challenges, in this paper, we present Groot, an event-graph-based approach for RCA. Groot constructs a real-time causality graph based on events that summarize various types of metrics, logs, and activities in the system under analysis. Moreover, to incorporate domain knowledge from site reliability engineering (SRE) engineers, Groot can be customized with user-defined events and domain-specific rules. Currently, Groot supports RCA among 5,000 real production services and is actively used by the SRE teamin a global e-commerce system serving more than 185 million active buyers per year. Over 15 months, we collect a data setcontaining labeled root causes of 952 real production incidents for evaluation. The evaluation results show that Groot is able to achieve 95% top-3 accuracy and 78% top-1 accuracy. To share our experience in deploying and adopting RCA in industrial settings, we conduct survey to show that users of Grootfindit helpful and easy to use. We also share the lessons learnedfrom deploying and adopting Grootto solve RCA problems inproduction environments.