Recommending Root-Cause and Mitigation Steps for Cloud Incidents using Large Language Models
Not on the map. Why?
Abstract (arXiv)
Incident management for cloud services is a complex process involving several steps and has a huge impact on both service health and developer productivity. On-call engineers require significant amount of domain knowledge and manual effort for root causing and mitigation of production incidents. Recent advances in artificial intelligence has resulted in state-of-the-art large language models like GPT-3.x (both GPT-3.0 and GPT-3.5), which have been used to solve a variety of problems ranging from question answering to text summarization. In this work, we do the first large-scale study to evaluate the effectiveness of these models for helping engineers root cause and mitigate production incidents. We do a rigorous study at Microsoft, on more than 40,000 incidents and compare several large language models in zero-shot, fine-tuned and multi-task setting using semantic and lexical metrics. Lastly, our human evaluation with actual incident owners show the efficacy and future potential of using artificial intelligence for resolving cloud incidents.
Key facts. Cited by 38 papers in the map (data through 7 Oct 2026). Builds on 33 of its 67 references that are in the map. First posted on arXiv 10 Jan 2023.
Builds on
33 of 67 references.
References · 33
- 2017Attention Is All You Needcited by 59,932
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
- 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
- 2021Evaluating Large Language Models Trained on Codecited by 8,053
- 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,874
- 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
- 2014Neural Machine Translation by Jointly Learning to Align and Translatecited by 4,530
- 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
21 more
- 2014Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modelingcited by 2,341
- 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,286
- 2020BLEURT: Learning Robust Metrics for Text Generationcited by 1,196
- 2021CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generationcited by 890
- 2021CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generationcited by 732
- 2019CodeSearchNet Challenge: Evaluating the State of Semantic Code Searchcited by 638
- 2020GraphCodeBERT: Pre-training Code Representations with Data Flowcited by 600
- 2021Unified Pre-training for Program Understanding and Generationcited by 361
- 2022A Systematic Evaluation of Large Language Models of Codecited by 360
- 2022Few-shot training LLMs for project-specific code-summarizationcited by 128
- 2021Jigsaw: Large Language Models meet Program Synthesiscited by 103
- 2022Repair Is Nearly Generation: Multilingual Program Repair with LLMscited by 68
- 2022NatGen: Generative pre-training by "Naturalizing" source codecited by 53
- 2021On the Evaluation of Neural Code Summarizationcited by 47
- 2021Multilingual training for Software Engineeringcited by 43
- 2022Code Generation Tools (Almost) for Free? A Study of Few-Shot, Pre-Trained Language Models on Codecited by 39
- 2020NUBIA: NeUral Based Interchangeability Assessor for Text Generationcited by 34
- 2020Code to Comment "Translation": Data, Metrics, Baselining & Evaluationcited by 28
- 2019DeCaf: Diagnosing and Triaging Performance Issues in Large-Scale Cloud Servicescited by 16
- 2022Mining Root Cause Knowledge from Cloud Service Incident Investigations for AIOpscited by 7
- 2021Picking Pearl From Seabed: Extracting Artefacts from Noisy Issue Triaging Collaborative Conversations for Hybrid Cloud Servicescited by 6
Built on by
Citing papers per year: 2023: 8; 2024: 8; 2025: 3; 2026: 19.
38 papers.
Sort:
By area:
- 2024MarsCode Agent: AI-native Automated Bug Fixingcited by 68
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Modelscited by 62
- 2024Exploring LLM-based Agents for Root Cause Analysiscited by 60
- 2023Large Language Models and Simple, Stupid Bugscited by 45
- 2024Large Language Models can Deliver Accurate and Interpretable Time Series Anomaly Detectioncited by 26
- 2024A Survey on Large Language Models for Communication, Network, and Service Management: Application Insights, Challenges, and Future Directionscited by 25
- 2023LLM for SoC Security: A Paradigm Shiftcited by 22
- 2023Xpert: Empowering Incident Management with Query Recommendations via Large Language Modelscited by 22
- 2023CoachLM: Automatic Instruction Revisions Improve the Data Quality in LLM Instruction Tuningcited by 19
- 2023From Commit Message Generation to History-Aware Commit Message Completioncited by 16
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysiscited by 13
- 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
26 more
- 2024Adapting Large Language Models to Log Analysis with Interpretable Domain Knowledgecited by 6
- 2024Towards Unlocking Insights from Logbooks Using AIcited by 5
- 2024Knowledge graph enhanced retrieval-augmented generation for failure mode and effects analysiscited by 5
- 2023Configuration Validation with Large Language Modelscited by 4
- 2025Simplifying Root Cause Analysis in Kubernetes with StateGraph and LLMcited by 4
- 2026Graph-Free Root Cause Analysiscited by 3
- 2023PACE-LM: Prompting and Augmentation for Calibrated Confidence Estimation with GPT-4 in Cloud Incident Root Cause Analysiscited by 2
- 2025PRAXIS: Integrating Program Analysis with Observability for Root-Cause Analysiscited by 2
- 2026Towards Robust LLM Post-Training: Automatic Failure Management for Reinforcement Fine-Tuningcited by 2
- 2026Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safetycited by 2
- 2026Bridging Temporal and Textual Modalities: A Multimodal Framework for Automated Cloud Failure Root Cause Analysiscited by 1
- 2026CUJBench: Benchmarking LLM-Agent on Cross-Modal Failure Diagnosis from Browser to Backendcited by 1
- 2026DBA-Bench: A Production-Fidelity Benchmark for LLM-Based Database Operations Agentscited by 1
- 2026InfraBench: Evaluating Infrastructure Agents Across Layers, Lifecycle, and Riskcited by 1
- 2026LLM-Augmented Knowledge Base Construction For Root Cause Analysiscited by 0
- 2026OpsLLM: Construction of Large Language Model for Software Operations with Multi-stage Learningcited by 0
- 2026PropLLM: Propagation-Aware Scene Reconstruction for Network Fault Diagnosiscited by 0
- 2026A Topology-Aware, Memory-Centric Architecture that Separates Root-Cause Derivation from Root-Cause Explanationcited by 0
- 2026Safe Remediation as Risk-Constrained Intervention Decision in Microservice Systemscited by 0
- 2026Agentic Root Cause Analysis through Evidence-Grounded Reasoningcited by 0
- 2026Agentic Self-Healing for Data and AI Pipelines: An Affordable Vendor-Agnostic Architecture using Open-Source Softwarecited by 0
- 2026Evaluating Agentic Code Repair Capabilities in Distributed Systemscited by 0
- 2026Beyond Fault Localization: A Trajectory-Level Study of LLM Agents for Microservice Root Cause Analysiscited by 0
- 2026From General Agents to RCA Experts: A Self-Evolving Harness for Root Cause Analysiscited by 0
- 2026Don't Let the Model Write the YAML: Deterministic, Minimal-Diff GitOps Remediation from LLM-Proposed Field Changescited by 0
- 2026TriFleetRCA: On-Premise LLM Root Cause Analysis for Kubernetescited by 0
- 2026TriFleetRCA: On-Premise LLM Root Cause Analysis for Kubernetes20 Sep 2026
- 2026Don't Let the Model Write the YAML: Deterministic, Minimal-Diff GitOps Remediation from LLM-Proposed Field Changes31 Aug 2026
- 2026From General Agents to RCA Experts: A Self-Evolving Harness for Root Cause Analysis26 Aug 2026
- 2026Beyond Fault Localization: A Trajectory-Level Study of LLM Agents for Microservice Root Cause Analysis21 Aug 2026
- 2026Evaluating Agentic Code Repair Capabilities in Distributed Systems14 Aug 2026
- 2026Agentic Self-Healing for Data and AI Pipelines: An Affordable Vendor-Agnostic Architecture using Open-Source Software3 Aug 2026
- 2026InfraBench: Evaluating Infrastructure Agents Across Layers, Lifecycle, and Risk31 Jul 2026
- 2026Agentic Root Cause Analysis through Evidence-Grounded Reasoning24 Jul 2026
- 2026DBA-Bench: A Production-Fidelity Benchmark for LLM-Based Database Operations Agents24 Jul 2026
- 2026Safe Remediation as Risk-Constrained Intervention Decision in Microservice Systems22 Jul 2026
- 2026A Topology-Aware, Memory-Centric Architecture that Separates Root-Cause Derivation from Root-Cause Explanation18 Jun 2026
- 2026PropLLM: Propagation-Aware Scene Reconstruction for Network Fault Diagnosis30 May 2026
26 more
- 2026Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety12 May 2026
- 2026Towards Robust LLM Post-Training: Automatic Failure Management for Reinforcement Fine-Tuning6 May 2026
- 2026CUJBench: Benchmarking LLM-Agent on Cross-Modal Failure Diagnosis from Browser to Backend25 Apr 2026
- 2026OpsLLM: Construction of Large Language Model for Software Operations with Multi-stage Learning6 Apr 2026
- 2026Graph-Free Root Cause Analysis29 Jan 2026
- 2026LLM-Augmented Knowledge Base Construction For Root Cause Analysis9 Jan 2026
- 2026Bridging Temporal and Textual Modalities: A Multimodal Framework for Automated Cloud Failure Root Cause Analysis8 Jan 2026
- 2025PRAXIS: Integrating Program Analysis with Observability for Root-Cause Analysis26 Dec 2025
- 2025Large Language Models for Security Operations Centers: A Comprehensive Survey13 Sep 2025
- 2025Simplifying Root Cause Analysis in Kubernetes with StateGraph and LLM3 Jun 2025
- 2024A Survey on Large Language Models for Communication, Network, and Service Management: Application Insights, Challenges, and Future Directions16 Dec 2024
- 2024Adapting Large Language Models to Log Analysis with Interpretable Domain Knowledge2 Dec 2024
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysis12 Oct 2024
- 2024MarsCode Agent: AI-native Automated Bug Fixing2 Sep 2024
- 2024Knowledge graph enhanced retrieval-augmented generation for failure mode and effects analysis26 Jun 2024
- 2024Towards Unlocking Insights from Logbooks Using AI25 May 2024
- 2024Large Language Models can Deliver Accurate and Interpretable Time Series Anomaly Detection24 May 2024
- 2024Exploring LLM-based Agents for Root Cause Analysis7 Mar 2024
- 2023Xpert: Empowering Incident Management with Query Recommendations via Large Language Models19 Dec 2023
- 2023CoachLM: Automatic Instruction Revisions Improve the Data Quality in LLM Instruction Tuning22 Nov 2023
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models25 Oct 2023
- 2023Configuration Validation with Large Language Models15 Oct 2023
- 2023LLM for SoC Security: A Paradigm Shift9 Oct 2023
- 2023PACE-LM: Prompting and Augmentation for Calibrated Confidence Estimation with GPT-4 in Cloud Incident Root Cause Analysis11 Sep 2023
- 2023From Commit Message Generation to History-Aware Commit Message Completion15 Aug 2023
- 2023Large Language Models and Simple, Stupid Bugs20 Mar 2023
- 2024MarsCode Agent: AI-native Automated Bug Fixingcited by 68
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Modelscited by 62
- 2024Exploring LLM-based Agents for Root Cause Analysiscited by 60
- 2026Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safetycited by 2
- 2026CUJBench: Benchmarking LLM-Agent on Cross-Modal Failure Diagnosis from Browser to Backendcited by 1
- 2026DBA-Bench: A Production-Fidelity Benchmark for LLM-Based Database Operations Agentscited by 1
- 2026Agentic Self-Healing for Data and AI Pipelines: An Affordable Vendor-Agnostic Architecture using Open-Source Softwarecited by 0
- 2026Evaluating Agentic Code Repair Capabilities in Distributed Systemscited by 0
- 2026Beyond Fault Localization: A Trajectory-Level Study of LLM Agents for Microservice Root Cause Analysiscited by 0
- 2026From General Agents to RCA Experts: A Self-Evolving Harness for Root Cause Analysiscited by 0
- 2026From General Agents to RCA Experts: A Self-Evolving Harness for Root Cause Analysis26 Aug 2026
- 2026Beyond Fault Localization: A Trajectory-Level Study of LLM Agents for Microservice Root Cause Analysis21 Aug 2026
- 2026Evaluating Agentic Code Repair Capabilities in Distributed Systems14 Aug 2026
- 2026Agentic Self-Healing for Data and AI Pipelines: An Affordable Vendor-Agnostic Architecture using Open-Source Software3 Aug 2026
- 2026DBA-Bench: A Production-Fidelity Benchmark for LLM-Based Database Operations Agents24 Jul 2026
- 2026Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety12 May 2026
- 2026CUJBench: Benchmarking LLM-Agent on Cross-Modal Failure Diagnosis from Browser to Backend25 Apr 2026
- 2024MarsCode Agent: AI-native Automated Bug Fixing2 Sep 2024
- 2024Exploring LLM-based Agents for Root Cause Analysis7 Mar 2024
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models25 Oct 2023
- 2023Large Language Models and Simple, Stupid Bugscited by 45
- 2024Large Language Models can Deliver Accurate and Interpretable Time Series Anomaly Detectioncited by 26
- 2024A Survey on Large Language Models for Communication, Network, and Service Management: Application Insights, Challenges, and Future Directionscited by 25
- 2023LLM for SoC Security: A Paradigm Shiftcited by 22
- 2023Xpert: Empowering Incident Management with Query Recommendations via Large Language Modelscited by 22
- 2023CoachLM: Automatic Instruction Revisions Improve the Data Quality in LLM Instruction Tuningcited by 19
- 2023From Commit Message Generation to History-Aware Commit Message Completioncited by 16
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysiscited by 13
- 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
- 2024Adapting Large Language Models to Log Analysis with Interpretable Domain Knowledgecited by 6
- 2023Configuration Validation with Large Language Modelscited by 4
- 2025Simplifying Root Cause Analysis in Kubernetes with StateGraph and LLMcited by 4
12 most cited of 25 All 25 (JSON)
- 2026TriFleetRCA: On-Premise LLM Root Cause Analysis for Kubernetes20 Sep 2026
- 2026Don't Let the Model Write the YAML: Deterministic, Minimal-Diff GitOps Remediation from LLM-Proposed Field Changes31 Aug 2026
- 2026InfraBench: Evaluating Infrastructure Agents Across Layers, Lifecycle, and Risk31 Jul 2026
- 2026Safe Remediation as Risk-Constrained Intervention Decision in Microservice Systems22 Jul 2026
- 2026A Topology-Aware, Memory-Centric Architecture that Separates Root-Cause Derivation from Root-Cause Explanation18 Jun 2026
- 2026PropLLM: Propagation-Aware Scene Reconstruction for Network Fault Diagnosis30 May 2026
- 2026Towards Robust LLM Post-Training: Automatic Failure Management for Reinforcement Fine-Tuning6 May 2026
- 2026OpsLLM: Construction of Large Language Model for Software Operations with Multi-stage Learning6 Apr 2026
- 2026Graph-Free Root Cause Analysis29 Jan 2026
- 2026LLM-Augmented Knowledge Base Construction For Root Cause Analysis9 Jan 2026
- 2026Bridging Temporal and Textual Modalities: A Multimodal Framework for Automated Cloud Failure Root Cause Analysis8 Jan 2026
- 2025PRAXIS: Integrating Program Analysis with Observability for Root-Cause Analysis26 Dec 2025
12 newest of 25 All 25 (JSON)