💻 computer science

MARCA: Multi-Agent Root Cause Analysis with Multi-Modal Data

The paper proposes MARCA, a multi-agent framework that addresses the challenges of root cause analysis in distributed systems by using a controller-executor-voter architecture to achieve high accuracy and efficiency while reducing token usage and ensuring data privacy.

Original authors: Yidan Wang

Published 2026-09-22

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yidan Wang

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Modern software systems are no longer single, monolithic machines; they are vast, intricate cities of tiny, independent programs called microservices that talk to one another constantly. When one part of this digital city stumbles, the entire network can grind to a halt, causing everything from delayed payments to crashed websites. Finding out exactly which tiny program caused the collapse is a task known as Root Cause Analysis. For decades, engineers have tried to automate this search, but the sheer volume of data—logs, performance numbers, and error codes—makes it difficult for traditional tools to keep up. Recently, powerful computer programs known as Large Language Models have shown promise in reading and understanding these messy data streams, much like a human expert would. However, these models face their own hurdles: they can get overwhelmed by too much information at once, they are expensive to run, and sending sensitive company data to outside servers raises serious privacy concerns.

A researcher at the University of Luxembourg has developed a new approach to solve these problems, called MARCA. Instead of relying on a single, massive computer program to read everything and guess the answer, MARCA breaks the job down into a small team of specialized digital workers. Imagine a detective team where one person directs the investigation, another gathers specific clues, and a third weighs the evidence to make a final call. This team works together in a loop, asking questions, gathering data, and refining their theory until they are confident they have found the true source of the failure. By dividing the work, the system avoids getting bogged down by massive amounts of data, keeps the sensitive information on local servers for privacy, and uses less computing power than previous methods.

The researcher tested this multi-agent system on a simulated payment platform they built themselves, as well as on public benchmarks used by other scientists. They injected various types of faults into the system, such as overloading the processor, filling up the memory, or cutting off network connections, to see if MARCA could correctly identify the culprit. The results were clear: the new system found the root cause correctly about 77 percent of the time, a significant improvement over the best existing methods, which hovered around 62 percent. It also proved much better at distinguishing between different types of failures, such as telling the difference between a network slowdown and a memory shortage, achieving a high score in accuracy that suggests it can handle the messy, overlapping signals found in real-world systems.

What makes this approach distinct is how it handles the flow of information. Traditional methods often try to feed all the available data into a single model at once, which can confuse the system or force it to ignore important details to fit everything in. MARCA, by contrast, acts more like a focused investigator. It starts at the point where the problem was noticed and then systematically checks the connections leading back to the source. At each step, a "controller" agent decides what to look at next, an "executor" agent uses specialized tools to fetch the relevant logs or performance numbers, and a "voter" agent combines these findings to update the list of suspects. This process repeats until the evidence points strongly to one specific service. This method allows the system to ignore irrelevant data, keeping the task manageable and efficient.

The study also highlighted that simply using a more powerful language model is not enough to solve the problem. When the researcher compared their team-based approach to a single, powerful model trying to do the whole job alone, the team-based system still performed significantly better. This suggests that the structure of the investigation—the way the agents collaborate, filter out noise, and weigh different types of evidence—is more important than the raw intelligence of the individual model. The system was also designed to be adaptable; it can learn from past mistakes to adjust how much it trusts different types of data, such as whether to rely more on error codes or performance metrics, depending on what has worked best in previous scenarios.

While the results are promising, the researcher was careful to note the boundaries of their work. The system relies on having an accurate map of how the services are connected; if that map is missing or outdated, the investigation can go off track. Additionally, in cases where multiple problems happen at the exact same time, the system sometimes struggles to separate the overlapping symptoms. However, the core finding stands: by organizing the analysis into a collaborative, iterative process, it is possible to diagnose complex software failures more accurately and efficiently than before. This approach offers a practical path forward for keeping large-scale digital systems running smoothly, ensuring that when things go wrong, the right answer can be found quickly without compromising data security or overwhelming computing resources.

Technical Summary: MARCA – Multi-Agent Root Cause Analysis with Multi-Modal Data

1. Problem Statement

Root Cause Analysis (RCA) in large-scale, distributed microservice architectures faces significant challenges due to the heterogeneity of observability data (logs, metrics, traces, return codes) and the complexity of service dependencies. While Large Language Models (LLMs) offer potential for reasoning over unstructured data, their direct application to RCA is hindered by:

Context Limitations: Inability to process large-scale, multi-source diagnostic data without lossy summarization, which degrades accuracy.
Computational Efficiency: High inference costs and latency when processing raw system logs and metrics.
Data Privacy: Concerns regarding transmitting sensitive enterprise data to closed-source commercial models.
Adaptability: Existing single-agent or rule-based systems struggle with dynamic failure modes, evolving data formats, and the need for cross-modal causal reasoning.

2. Methodology

The paper proposes MARCA, a Multi-Agent Root Cause Analysis framework that formalizes RCA as an iterative decision-making process. The system employs a Controller–Executor–Voter architecture to decompose complex diagnostic tasks, integrating tool-augmented execution with a weighted consensus mechanism.

2.1 Core Architecture

Controller Agent: Acts as the orchestration hub. It maintains the global state (candidate set, traversal path) and decomposes the RCA task into a sequence of actions (e.g., initiating analysis, decomposing tasks, managing loops). It constructs a directed dependency graph $G=(V, E)$ to confine the search space within the actual system topology.
Executor Agents: Specialized agents responsible for data-intensive retrieval. They interact with external tools to query specific observability modalities (logs, metrics, traces, return codes) based on Controller instructions. They return structured evidence tuples containing evidence scores, data quality scores, and textual rationales.
Voting Agent: Aggregates multi-modal evidence to resolve conflicts among competing root-cause hypotheses. Instead of simple majority voting, it uses a weighted consensus mechanism that considers modality reliability, current data quality, and evidence strength.

2.2 Reasoning Workflow

The framework operates in a closed-loop iterative process:

Topology Initialization: The Controller identifies the entry node of an anomaly and constructs the dependency graph.
Iterative Evidence Collection: The system performs a breadth-first traversal along the dependency graph. At each step, the Controller directs Executors to investigate neighboring services. A Causal Correlation Score ( $\xi$ $ξ$ ) is calculated to filter noise, combining temporal metric correlation ( $\rho$ $ρ$ ) and semantic consistency of return codes ($sim$).
- Equation: $\xi(v_i, v_j) = \lambda_1 \rho(x^{metric}_{v_i}, x^{metric}_{v_j}) + \lambda_2 sim(x^{ret}_{v_i}, x^{ret}_{v_j})$
Unified Scoring and Convergence: The Voting Agent updates candidate confidence scores using a weighted sum of evidence. The loop terminates when a candidate's confidence exceeds a dynamic threshold, the margin between top candidates is sufficient, or the maximum iteration count is reached.

2.3 Adaptive Reasoning and Learning

In-Context Learning (ICL): Agents follow adaptive reasoning guidelines (e.g., semantic anomaly identification, probabilistic correlation matching) rather than rigid heuristic rules. Few-shot examples are retrieved dynamically based on fault type and topology similarity.
Parameter Learning: The framework utilizes a two-stage learning paradigm:
- Offline Optimization: Bayesian optimization is used to tune causal correlation weights ( $\lambda_1, \lambda_2$ ) and modality reliability weights ( $w_m$ ) on historical fault datasets.
- Online Adaptation: Modality weights are updated via Exponential Moving Average (EMA) based on real-time diagnostic feedback, allowing the system to adapt to changing data quality or system conditions.

2.4 Tool-Augmented Execution

To address context length and efficiency, MARCA delegates low-level data processing to specialized external tools (log filtering, trace reconstruction, metric anomaly detection). This allows the LLM agents to maintain high-level task contexts while offloading resource-intensive operations, significantly reducing token usage.

3. Key Contributions

Iterative Decision-Making Formulation: The paper reformulates RCA as an iterative process over heterogeneous observability data, enabling step-wise reasoning rather than single-pass analysis.
Controller–Executor–Voter Architecture: A novel multi-agent design that decomposes RCA into planning, execution, and validation stages, facilitating scalable context handling and robust decision-making.
Weighted Consensus Mechanism: A method to improve robustness against noisy or conflicting diagnostic signals by dynamically weighting evidence based on modality reliability and data quality.
Empirical Validation: Extensive experiments demonstrating significant improvements over state-of-the-art baselines in both root cause localization and fault classification.

4. Experimental Results

The author evaluated MARCA on a self-built payment system (using Chaos Mesh for fault injection) and two public microservice benchmarks (TrainTicket and MicroSS).

Performance: On the self-built payment system, MARCA (using Llama-2) achieved a 76.87% Top-1 accuracy and a 0.7896 F1-score. This significantly outperformed the strongest multimodal baseline (HolisticRCA at 62.15% Acc@1) and single-agent LLM baselines.
Efficiency: The framework reduced token usage by approximately 60% compared to single-agent approaches by leveraging tool-augmented retrieval and structured evidence summarization, ensuring feasibility for real-time industrial deployment.
Ablation Studies: Removing Topology Guidance caused the most significant performance drop (32.1% relative drop in Acc@1), highlighting the necessity of constraining the search space with system dependency information. Removing Multi-Modal Evidence also substantially degraded the F1-score, confirming the importance of integrating heterogeneous data.
Generalization: MARCA maintained high accuracy on public benchmarks (e.g., 74.56% Acc@1 on TrainTicket), demonstrating better generalization to unseen system architectures compared to single-agent methods.

5. Significance and Claims

The paper claims that MARCA addresses critical bottlenecks in existing LLM-based RCA approaches, specifically regarding scalability, robustness, and practical deployment.

Industrial Feasibility: By reducing context dependency and enabling local execution, MARCA ensures data sovereignty and lowers computational costs, making it suitable for enterprise environments.
Adaptability: The dynamic collaboration mechanism allows the system to adapt to evolving objectives and system conditions without the rigidity of static single-agent architectures.
Diagnostic Effectiveness: The integration of specialized agents and cross-modal reasoning overcomes the limitations of monolithic processing, providing a more comprehensive basis for identifying root causes in complex distributed systems.

The author acknowledges limitations, noting that diagnostic fidelity depends on the completeness of topology metadata (particularly in serverless/ephemeral environments) and the discriminability of modalities in concurrent fault scenarios. Future work is proposed to focus on dynamic topology reconstruction and reinforcement learning-based weight calibration.