# Simplifying Root Cause Analysis in Kubernetes with StateGraph and LLM

arXiv: https://arxiv.org/abs/2506.02490 · HTML: https://mlsanity.com/paper/2506.02490/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 23 of its 72 references that are in the map.
- First posted on arXiv 3 Jun 2025.

## Builds on (most cited first, 23 of 23)

- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- [A Systematic Evaluation of Large Language Models of Code](https://mlsanity.com/paper/2202.13169/) (2022)
- [Jigsaw: Large Language Models meet Program Synthesis](https://mlsanity.com/paper/2112.02969/) (2021)
- [Automatic Root Cause Analysis via Large Language Models for Cloud Incidents](https://mlsanity.com/paper/2305.15778/) (2023)
- [Studying the Usage of Text-To-Text Transfer Transformer to Support Code-Related Tasks](https://mlsanity.com/paper/2102.02017/) (2021)
- [Repair Is Nearly Generation: Multilingual Program Repair with LLMs](https://mlsanity.com/paper/2208.11640/) (2022)
- [RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models](https://mlsanity.com/paper/2310.16340/) (2023)
- [Exploring LLM-based Agents for Root Cause Analysis](https://mlsanity.com/paper/2403.04123/) (2024)
- [Causal Inference-Based Root Cause Analysis for Online Service Systems with Intervention Recognition](https://mlsanity.com/paper/2206.05871/) (2022)
- [Recommending Root-Cause and Mitigation Steps for Cloud Incidents using Large Language Models](https://mlsanity.com/paper/2301.03797/) (2023)
- [Automated Root Causing of Cloud Incidents using In-Context Learning with GPT-4](https://mlsanity.com/paper/2401.13810/) (2024)
- [Robust Failure Diagnosis of Microservice System through Multimodal Data](https://mlsanity.com/paper/2302.10512/) (2023)
- [Eadro: An End-to-End Troubleshooting Framework for Microservices on Multi-source Data](https://mlsanity.com/paper/2302.05092/) (2023)
- [X-lifecycle Learning for Cloud Incident Management using LLMs](https://mlsanity.com/paper/2404.03662/) (2024)
- [Using Deep Learning to Generate Complete Log Statements](https://mlsanity.com/paper/2201.04837/) (2022)
- [Face It Yourselves: An LLM-Based Two-Stage Strategy to Localize Configuration Errors via Logs](https://mlsanity.com/paper/2404.00640/) (2024)
- [DeCaf: Diagnosing and Triaging Performance Issues in Large-Scale Cloud Services](https://mlsanity.com/paper/1910.05339/) (2019)
- [A Survey of AIOps for Failure Management in the Era of Large Language Models](https://mlsanity.com/paper/2406.11213/) (2024)
- [Picking Pearl From Seabed: Extracting Artefacts from Noisy Issue Triaging Collaborative Conversations for Hybrid Cloud Services](https://mlsanity.com/paper/2105.15065/) (2021)
- [Mutiny! How does Kubernetes fail, and what can we do about it?](https://mlsanity.com/paper/2404.11169/) (2024)
- [Dependency Aware Incident Linking in Large Cloud Systems](https://mlsanity.com/paper/2403.18639/) (2024)
- [On Byzantine Fault Tolerance in Multi-Master Kubernertes Clusters](https://mlsanity.com/paper/1904.06206/) (2019)

## Built on by (most cited first, 4 of 4)

- [Think Locally, Explain Globally: Graph-Guided LLM Investigations via Local Reasoning and Belief Propagation](https://mlsanity.com/paper/2601.17915/) (2026)
- [Towards In-Depth Root Cause Localization for Microservices with Multi-Agent Recursion-of-Thought](https://mlsanity.com/paper/2605.14866/) (2026)
- [From Natural Language to PromQL: A Catalog-Driven Framework with Dynamic Temporal Resolution for Cloud-Native Observability](https://mlsanity.com/paper/2604.13048/) (2026)
- [Auditable Graph-Guided Root Cause Analysis for Kubernetes Incidents](https://mlsanity.com/paper/2606.08590/) (2026)

## Abstract (arXiv)

Kubernetes, a notably complex and distributed system, utilizes an array of controllers to uphold cluster management logic through state reconciliation. Nevertheless, maintaining state consistency presents significant challenges due to unexpected failures, network disruptions, and asynchronous issues, especially within dynamic cloud environments. These challenges result in operational disruptions and economic losses, underscoring the necessity for robust root cause analysis (RCA) to enhance Kubernetes reliability. The development of large language models (LLMs) presents a promising direction for RCA. However, existing methodologies encounter several obstacles, including the diverse and evolving nature of Kubernetes incidents, the intricate context of incidents, and the polymorphic nature of these incidents. In this paper, we introduce SynergyRCA, an innovative tool that leverages LLMs with retrieval augmentation from graph databases and enhancement with expert prompts. SynergyRCA constructs a StateGraph to capture spatial and temporal relationships and utilizes a MetaGraph to outline entity connections. Upon the occurrence of an incident, an LLM predicts the most pertinent resource, and SynergyRCA queries the MetaGraph and StateGraph to deliver context-specific insights for RCA. We evaluate SynergyRCA using datasets from two production Kubernetes clusters, highlighting its capacity to identify numerous root causes, including novel ones, with high efficiency and precision. SynergyRCA demonstrates the ability to identify root causes in an average time of about two minutes and achieves an impressive precision of approximately 0.90.