In the current microservices ecosystem, multimodal telemetry —metrics, logs, and traces— generates massive volumes of data that should suffice to identify the root cause of a failure. However, both classical causal discovery methods and LLM-based multi-agent systems still achieve low accuracy on benchmarks like OpenRCA. This article analyzes why this happens, what the real limits of existing techniques are, and what advances allow overcoming them, all framed in a business perspective that connects with the solutions that Q2BSTUDIO offers in custom software development, artificial intelligence, cybersecurity, and cloud.
The first challenge is the scattered and heterogeneous nature of real telemetry. Each microservice emits signals in different formats and frequencies, and the causal relationships between those data are not obvious. Classical causality approaches, such as constraint-based or score-based discovery algorithms, assume variables are observable and well-defined, which rarely occurs in production. LLMs, on the other hand, have general domain knowledge but lack the ability to reason about complex temporal sequences and combinations of anomalous signals. The OpenRCA benchmark shows that even the best multi-agent systems fail in more than half of the cases when they must integrate metrics, logs, and traces to isolate the failure.
Faced with this reality, a structured multi-agent pipeline architecture emerges that not only processes telemetry but introduces a reverse reasoning agent: given the actual failure, this agent identifies which specific signals support the diagnosis and whether those signals were available during the anomaly extraction phase. Thus each failure is classified into two types: 'reasoning gap' (evidence was present but the model failed to use it) or 'data ambiguity' (evidence was genuinely missing). The results are revealing: in the vast majority of cases the bottleneck is not data access but the model's ability to reason correctly about it. This implies that improving the data pipeline or adding more sensors will not close the gap by itself; progress is needed at the model reasoning level.
To address this limitation, an automated rule mining pipeline has been developed that extracts discrimination rules from reverse reasoning reports. These rules systematize the knowledge needed to distinguish between likely causes, reducing reliance on domain engineers who manually curate business rules. The approach allows the system to operate both with explicit domain knowledge and without it, adapting to environments where documentation is scarce. In tests on real production data, the structured multi-agent pipeline significantly outperforms classical baselines and previous LLM multi-agent systems, even in knowledge-free modes.
From a business perspective, these capabilities are critical for any organization deploying cloud applications. DevOps and SRE teams need tools that not only alert anomalies but explain why they occurred and which service or component is responsible. This is where the integration of cloud services like AWS/Azure with AI agents becomes strategic. For example, a company using microservices on Azure can channel its metrics and logs into an AI-based causal analysis system that, after identifying a reasoning gap, automatically adjusts its inference model. Similarly, in cybersecurity environments, the ability to distinguish between a technical failure and an active attack depends on fine-grained causal reasoning, something classical pipelines fail to achieve.
Another key point is the relationship between model quality and the need for domain knowledge. Experiments show that larger, more advanced models (with more parameters and training) possess implicit domain knowledge that allows them to perform better even without explicit rules. However, when that knowledge is missing, explicit injection of discrimination rules —for example, 'if service A response time increases and error in B appears simultaneously, then A is likely the cause'— partially compensates for the gap. This suggests that for companies without access to the most powerful models (like GPT-4 or Claude 3.5), the most effective path is to combine AI agents with domain rules automatically extracted from their own historical data.
In practical terms, implementing an effective root cause analysis system requires considering three levels: the telemetry collection infrastructure (metrics, logs, traces), the reverse reasoning pipeline, and the rule extraction layer. Companies that already have a solid cloud computing foundation —whether AWS, Azure, or hybrid solutions— are better positioned to adopt these techniques because their data is already centralized and accessible. Q2BSTUDIO, with its experience in Business Intelligence and Power BI and process automation, can help design and implement these pipelines from data capture to root cause visualization.
However, the study also reveals a fundamental limit: neither the best agent scaffolding nor the most refined data pipelines will overcome the constraints of the underlying model if it cannot reason about complex causal relationships. This means that investment in more advanced language models, either through fine-tuning open source models or contracting proprietary model APIs, is inevitable if acceptable accuracy in real environments is to be achieved. The good news is that the combination of reverse reasoning and automatic rule mining has already proven effective in reducing the gap between what the data says and what the model understands.
In conclusion, root cause analysis in real telemetry is moving towards multi-agent systems that integrate reverse reasoning and automated rule extraction, overcoming the limitations of classical approaches and pure LLMs. The bottleneck has shifted from data availability to model reasoning capability, opening a new frontier for research and development. For businesses, the opportunity lies in adopting solutions that combine AI, cloud, and automation, such as those offered by Q2BSTUDIO, to transform telemetry into actionable information and drastically reduce incident resolution time in production.
