# Flow-of-Action: SOP Enhanced LLM-Based Multi-Agent System for Root Cause Analysis

arXiv: https://arxiv.org/abs/2502.08224 · HTML: https://mlsanity.com/paper/2502.08224/

## Key facts

- Cited by 34 papers in the map (data through 14 Oct 2026).
- Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use.
- Builds on 17 of its 41 references that are in the map.
- First posted on arXiv 12 Feb 2025.

## Placed in

- LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/)

## Builds on (most cited first, 17 of 17)

- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Reflexion: Language Agents with Verbal Reinforcement Learning](https://mlsanity.com/paper/2303.11366/) (2023)
- [Toolformer: Language Models Can Teach Themselves to Use Tools](https://mlsanity.com/paper/2302.04761/) (2023)
- [MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework](https://mlsanity.com/paper/2308.00352/) (2023)
- [Logic-LM: Empowering Large Language Models with Symbolic Solvers for Faithful Logical Reasoning](https://mlsanity.com/paper/2305.12295/) (2023)
- [Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications](https://mlsanity.com/paper/1802.03903/) (2018)
- [Chain of Code: Reasoning with a Language Model-Augmented Code Emulator](https://mlsanity.com/paper/2312.04474/) (2023)
- [Automatic Root Cause Analysis via Large Language Models for Cloud Incidents](https://mlsanity.com/paper/2305.15778/) (2023)
- [RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models](https://mlsanity.com/paper/2310.16340/) (2023)
- [Root Cause Analysis In Microservice Using Neural Granger Causal Discovery](https://mlsanity.com/paper/2402.01140/) (2024)
- [D-Bot: Database Diagnosis System using Large Language Models](https://mlsanity.com/paper/2312.01454/) (2023)
- [mABC: multi-Agent Blockchain-Inspired Collaboration for root cause analysis in micro-services architecture](https://mlsanity.com/paper/2404.12135/) (2024)
- [Revisiting VAE for Unsupervised Time Series Anomaly Detection: A Frequency Perspective](https://mlsanity.com/paper/2402.02820/) (2024)
- [Actionable and Interpretable Fault Localization for Recurring Failures in Online Service Systems](https://mlsanity.com/paper/2207.09021/) (2022)
- [CausIL: Causal Graph for Instance Level Microservice Data](https://mlsanity.com/paper/2303.00554/) (2023)
- [TraceDiag: Adaptive, Interpretable, and Efficient Root Cause Analysis on Large-Scale Microservice Systems](https://mlsanity.com/paper/2310.18740/) (2023)
- [Spectrum-Based Log Diagnosis](https://mlsanity.com/paper/2008.06948/) (2020)

## Built on by (most cited first, 30 of 34)

- [Reasoning Language Models for Root Cause Analysis in 5G Wireless Networks](https://mlsanity.com/paper/2507.21974/) (2025)
- [SREGym: A Live Benchmark for AI SRE Agents with High-Fidelity Failure Scenarios](https://mlsanity.com/paper/2605.07161/) (2026)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [Agentic Memory Enhanced Recursive Reasoning for Root Cause Localization in Microservices](https://mlsanity.com/paper/2601.02732/) (2026)
- [MASPOB: Bandit-Based Prompt Optimization for Multi-Agent Systems with Graph Neural Networks](https://mlsanity.com/paper/2603.02630/) (2026)
- [Hypothesize-Then-Verify: Speculative Root Cause Analysis for Microservices with Pathwise Parallelism](https://mlsanity.com/paper/2601.02736/) (2026)
- [Agentic Services Computing](https://mlsanity.com/paper/2509.24380/) (2025)
- [OpsAgent: An Evolving Multi-agent System for Incident Management in Microservices](https://mlsanity.com/paper/2510.24145/) (2025)
- [StepFly: Agentic Troubleshooting Guide Automation for Incident Diagnosis](https://mlsanity.com/paper/2510.10074/) (2025)
- [Graph of States: Solving Abductive Tasks with Large Language Models](https://mlsanity.com/paper/2603.21250/) (2026)
- [A Survey on AgentOps: Categorization, Challenges, and Future Directions](https://mlsanity.com/paper/2508.02121/) (2025)
- [PRAXIS: Integrating Program Analysis with Observability for Root-Cause Analysis](https://mlsanity.com/paper/2512.22113/) (2025)
- [Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety](https://mlsanity.com/paper/2605.12729/) (2026)
- [GRIDAI: Generating and Repairing Intrusion Detection Rules via Collaboration among Multiple LLM-based Agents](https://mlsanity.com/paper/2510.13257/) (2025)
- [STAR: A Stage-attributed Triage and Repair framework for RCA Agents in Microservices](https://mlsanity.com/paper/2605.15581/) (2026)
- [TopoEvo: A Topology-Aware Self-Evolving Multi-Agent Framework for Root Cause Analysis in Microservices](https://mlsanity.com/paper/2605.15611/) (2026)
- [TeleCom-Bench: How Far Are Large Language Models from Industrial Telecommunication Applications?](https://mlsanity.com/paper/2605.18025/) (2026)
- [UModel: An Agent-Ready Observability Data Modeling Method at Scale](https://mlsanity.com/paper/2606.04799/) (2026)
- [JustDiag!: A Diagnostic Justification Engine for Accountable Root Cause Analysis](https://mlsanity.com/paper/2606.19407/) (2026)
- [A Multi-Dataset Benchmark for Evaluating LLM Agents in Microservice Failure Diagnosis](https://mlsanity.com/paper/2606.29193/) (2026)
- [OpsMem: Dual-Memory Reasoning with Cross-Memory Resonance for Failure Diagnosis](https://mlsanity.com/paper/2607.11357/) (2026)
- [SoK: Measuring What Matters for Closed-Loop Security Agents](https://mlsanity.com/paper/2510.01654/) (2025)
- [ViTs: Teaching Machines to See Time Series Anomalies Like Human Experts](https://mlsanity.com/paper/2510.04710/) (2025)
- [OpsLLM: Construction of Large Language Model for Software Operations with Multi-stage Learning](https://mlsanity.com/paper/2605.02906/) (2026)
- [Agent System Operations: Categorization, Challenges, and Future Directions](https://mlsanity.com/paper/2606.01581/) (2026)
- [Auditable Graph-Guided Root Cause Analysis for Kubernetes Incidents](https://mlsanity.com/paper/2606.08590/) (2026)
- [Notes2Skills: From Lab Notebooks to Certainty-Aware Scientific Agent Skills](https://mlsanity.com/paper/2606.11897/) (2026)
- [KRCA: An Efficient Root Cause Analysis System in Hyper-scale Microservice Systems via Agentic AI](https://mlsanity.com/paper/2607.01788/) (2026)
- [The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI](https://mlsanity.com/paper/2607.19433/) (2026)
- [Beyond Fault Localization: A Trajectory-Level Study of LLM Agents for Microservice Root Cause Analysis](https://mlsanity.com/paper/2608.21310/) (2026)

## Abstract (arXiv)

In the realm of microservices architecture, the occurrence of frequent incidents necessitates the employment of Root Cause Analysis (RCA) for swift issue resolution. It is common that a serious incident can take several domain experts hours to identify the root cause. Consequently, a contemporary trend involves harnessing Large Language Models (LLMs) as automated agents for RCA. Though the recent ReAct framework aligns well with the Site Reliability Engineers (SREs) for its thought-action-observation paradigm, its hallucinations often lead to irrelevant actions and directly affect subsequent results. Additionally, the complex and variable clues of the incident can overwhelm the model one step further. To confront these challenges, we propose Flow-of-Action, a pioneering Standard Operation Procedure (SOP) enhanced LLM-based multi-agent system. By explicitly summarizing the diagnosis steps of SREs, SOP imposes constraints on LLMs at crucial junctures, guiding the RCA process towards the correct trajectory. To facilitate the rational and effective utilization of SOPs, we design an SOP-centric framework called SOP flow. SOP flow contains a series of tools, including one for finding relevant SOPs for incidents, another for automatically generating SOPs for incidents without relevant ones, and a tool for converting SOPs into code. This significantly alleviates the hallucination issues of ReAct in RCA tasks. We also design multiple auxiliary agents to assist the main agent by removing useless noise, narrowing the search space, and informing the main agent whether the RCA procedure can stop. Compared to the ReAct method's 35.50% accuracy, our Flow-of-Action method achieves 64.01%, meeting the accuracy requirements for RCA in real-world systems.