HolisticRCA: Multimodal Cloud RCA

• HolisticRCA is a multimodal, cross-level root cause analysis framework that integrates metrics, logs, traces, and topology data to diagnose faults across hosts, Pods, and services.
• It processes metrics with LSTM, logs using Drain and TF-IDF, and traces via GNN, then fuses these modalities through a static heterogeneous graph using Graph Attentional Networks.
• HolisticRCA demonstrates strong empirical performance with 89% entity localization accuracy and 85% fault type classification F1, establishing it as a robust baseline for cloud-native RCA research.

HolisticRCA is characterized in recent full-stack observability literature as a multimodal, cross-level root cause analysis method for cloud-native systems. In that characterization, its defining objective is to combine metrics, logs, traces, and system relations so that faults can be diagnosed not only at the level of entity localization, but also through feature recognition and fault type classification. The method is presented as a representative “multi-modal/cross-level fusion” approach for RCA under Kubernetes-style cloud-native operation, especially across hosts, Pods, and services (Hou, 8 Sep 2025).

1. Conceptual identity and historical placement

HolisticRCA is situated in the literature as one of two mainstream research threads in recent RCA work under full-stack observability: FaultInsight, which emphasizes dynamic causal discovery, and HolisticRCA, which emphasizes multi-modal/cross-level fusion (Hou, 8 Sep 2025). In that framing, HolisticRCA addresses the limitation of single-modal RCA by treating microservice failures as phenomena that span several observability sources and several layers of the runtime stack.

The central conceptual label attached to HolisticRCA is a three-dimensional diagnostic framework consisting of entity localization, feature recognition, and type classification. The review literature also describes this as an “entity-feature-type” framework, which distinguishes HolisticRCA from simpler RCA systems that only rank suspicious nodes or only classify fault labels (Hou, 8 Sep 2025).

A crucial source caveat is that the currently available description is mediated through review and comparison papers rather than through the original HolisticRCA paper itself. This matters because later papers often treat HolisticRCA as a baseline or reference point, especially when motivating extensions in causal discovery, topology-aware reasoning, or LLM-based orchestration (Hou, 8 Sep 2025).

2. Observability scope and cross-level system model

HolisticRCA is described as operating on the standard observability triad of metrics, logs, and traces. In addition, it uses topology / call relationships and deployment relationships derived from the cloud-native system, so its coverage is broader than modality fusion alone (Hou, 8 Sep 2025). This design reflects the view that metrics capture resource or performance states, logs capture semantic error evidence, and traces capture invocation structure and execution-path information.

The cross-level aspect is equally central. The system is described as modeling a cloud-native hierarchy of hosts, Pods, and services. These entities are integrated in a heterogeneous graph whose nodes correspond to those levels and whose edges represent invocation relationships and deployment relationships. This makes HolisticRCA a graph-based RCA method, but the graph is specifically intended to cut across application, runtime, and infrastructure layers rather than staying within a single layer (Hou, 8 Sep 2025).

The review literature is explicit that this graph construction is static. It is built from static invocation and deployment relations and therefore does not model dynamic entity associations at fault time, such as transient service calls or incident-specific propagation paths. This static character is one of the main limitations later authors emphasize when contrasting HolisticRCA with temporal or topology-evolving RCA methods (Hou, 8 Sep 2025).

A later topology-aware RCA paper also summarizes HolisticRCA as a method that “standardiz[es] heterogeneous observability data and reason[s] over service dependencies to identify root causes across diverse failure scenarios.” That description is narrower than the survey characterization but consistent with the view of HolisticRCA as a dependency-aware multimodal baseline (Wang et al., 15 May 2026).

3. Representation learning and diagnostic workflow

The workflow attributed to HolisticRCA begins with modality-specific preprocessing. Metrics undergo normalization and temporal segmentation and are encoded with an LSTM. Logs are processed with Drain for template extraction, represented with TF-IDF, and summarized in the survey as using a CNN encoder. Traces contribute topology and span features and are encoded with a GNN (Hou, 8 Sep 2025).

These modality-specific encoders are then mapped into a unified embedding space. After that fusion stage, HolisticRCA performs reasoning over the previously described cross-level heterogeneous graph using Graph Attentional Networks (GAT). The resulting node representations support entity localization and fault type classification, which explains why the method is presented as broader than pure culprit ranking (Hou, 8 Sep 2025).

The interpretation mechanism described for HolisticRCA is mask learning. Inputs are partially masked, the output variation is observed, and influential features are inferred from the resulting sensitivity. This places HolisticRCA within the family of multimodal graph-neural RCA systems that rely on feature saliency rather than on explicit symbolic evidence chains (Hou, 8 Sep 2025).

What is notably absent from the review record is a reproduced formal objective function for HolisticRCA itself. The survey explicitly states that it does not provide a formal feature-fusion equation, a loss equation, or a graph-attention equation specific to HolisticRCA. This suggests that, in the currently available secondary literature, HolisticRCA is primarily specified architecturally rather than through a reproduced mathematical formulation (Hou, 8 Sep 2025).

4. Reported capabilities and empirical profile

The review literature attributes several strong empirical claims to HolisticRCA. It reports “89% entity localization accuracy” and “85% fault type classification F1”, and further states that this improved over single-modal methods by 20% and over non-hierarchical multimodal methods by 12% (Hou, 8 Sep 2025). These figures are presented as evidence that multimodal and cross-level fusion materially improve RCA quality in cloud-native settings.

A more detailed baseline table in the same review reports, for HolisticRCA, Entity F1 83.8%, Fault Type Macro F1 81.2%, Causal Chain Accuracy 72.5%, and Inference Latency 3.2s on an enterprise production dataset; Entity F1 79.2%, Fault Type Macro F1 78.3%, Causal Chain Accuracy 69.2%, and Latency 3.0s on a public test dataset; and Entity F1 81.5%, Fault Type Macro F1 80.2%, Causal Chain Accuracy 71.3%, and Latency 3.1s on simulated faults (Hou, 8 Sep 2025). Within the review’s argument, these numbers position HolisticRCA as a strong baseline rather than a marginal method.

The same source also attributes to HolisticRCA practical compatibility with mainstream cloud-native platforms like Kubernetes and describes its deployment complexity as relatively low. It further notes that experiments examine robustness under varying data-quality conditions such as log missing rate and trace sampling rate (Hou, 8 Sep 2025). These claims reinforce the method’s reputation as an engineering-oriented observability-fusion framework rather than a purely academic graph model.

Later comparative work supports the view that HolisticRCA remained a meaningful baseline even as newer methods appeared. In TopoEvo’s reported results, HolisticRCA is included across service-, pod-, and node-level localization settings and on a production dataset, which indicates continued relevance as a comparison point for topology-aware, drift-aware RCA systems (Wang et al., 15 May 2026).

5. Limits, criticisms, and recurring misconceptions

The most persistent criticism is that HolisticRCA lacks temporal causal modeling. The survey describes it as using static graph modeling over time windows, which means it can struggle to distinguish root cause from downstream consequence in cascading failures. The review gives the canonical example of a database failure $\to$ service timeout $\to$ user error chain and argues that, without temporal causality, HolisticRCA may treat a downstream symptom such as service timeout as the root cause (Hou, 8 Sep 2025).

A second limitation concerns explainability. Although HolisticRCA uses mask learning, the review argues that this form of explanation does not include timing and does not produce a fault propagation evidence chain. The resulting explanations may therefore be too abstract for operators who need auditable propagation narratives rather than feature-importance saliency alone (Hou, 8 Sep 2025).

A third limitation is label dependence. The review states that HolisticRCA requires many labeled fault samples with annotations for entity, feature, and type, which may reduce portability to newly deployed systems, new fault types, or low-label environments. A fourth is the previously noted static graph construction, which can miss dynamic topology changes or incident-specific propagation structure. A fifth is that multimodal fusion may be too simple, because the review suggests that features may be directly concatenated without dynamic modality weighting, allowing noisy modalities to interfere with diagnosis (Hou, 8 Sep 2025).

A common misconception is therefore to equate HolisticRCA with fully causal RCA. The available literature does not support that reading. HolisticRCA is better described as full-stack observability fusion with cross-level graph reasoning than as a temporal or intervention-aware causal discovery system. A plausible implication is that its weaknesses would become more visible under evaluation protocols that require verified propagation paths, not only final culprit identification. Later benchmark work formalizes this concern through the notion of “ungrounded diagnosis”, where correct service identification is not accompanied by a verified causal path to the observed symptom (Fang et al., 25 Jun 2026).

6. Relation to adjacent methods and later developments

HolisticRCA is repeatedly treated as complementary to FaultInsight. In the review literature, FaultInsight contributes dynamic causal discovery and temporal directionality, whereas HolisticRCA contributes multi-modal, cross-level, graph-based reasoning across cloud-native observability layers. This complementarity is the explicit motivation for KylinRCA, which is proposed as an overview that retains HolisticRCA-style multimodal graph fusion while adding dynamic causal discovery, modal attention, Type-aware GAT, and evidence-chain generation (Hou, 8 Sep 2025).

Subsequent methods can be read as targeted responses to specific HolisticRCA limitations. OCEAN extends the multimodal idea into an online setting, combining metrics and logs with dilated temporal convolutions, multi-factor attention, and graph fusion for streaming RCA, but it remains only partially holistic because it omits traces and broader operational context (Zheng et al., 2024). TopoEvo treats HolisticRCA as a baseline and adds Metric-orthogonal Multimodal Alignment, Vector Quantization into symptom tokens, a topology-constrained Hypothesis–Evidence–Test workflow, and a Self-Evolving Mechanism for drift, explicitly aiming to reduce symptom-amplification bias and improve auditability (Wang et al., 15 May 2026).

LLM-centered systems diverge further. Flow-of-Action integrates metrics, traces, logs, and infrastructure evidence, but its core innovation is procedure-guided SOP-centric orchestration rather than explicit holistic system modeling (Pei et al., 12 Feb 2025). RC-LLM and MicroRCA-Agent both pursue multimodal observability fusion for microservices through staged preprocessing and LLM reasoning, yet they rely mainly on prompt-level or residual-like evidence integration rather than on the heterogeneous graph framework associated with HolisticRCA (Zhou et al., 9 Feb 2026); (Tang et al., 19 Sep 2025).

Taken together, these later systems clarify HolisticRCA’s place in the RCA canon. It is neither the earliest causal RCA method nor the most explicitly topology-aware or temporally grounded. Its distinct legacy is to have established multi-modal, cross-level fusion under full-stack observability as a first-class RCA design principle for cloud-native systems. In that sense, HolisticRCA functions as a canonical fusion backbone: later work either augments it with temporal causality, topology-aware verification, online adaptation, or agentic reasoning, but rarely abandons its central premise that accurate cloud-native RCA requires reasoning across heterogeneous signals and heterogeneous system layers (Hou, 8 Sep 2025).