RCLAgent: Recursive Root Cause Localization

• RCLAgent is a framework that localizes faults in microservices by recursively analyzing a single anomalous request through multi-agent coordination.
• It employs both role-specialized and span-aligned agents to integrate traces, metrics, and logs, enhancing diagnostic accuracy and interpretability.
• Empirical studies show RCLAgent surpasses traditional RCA methods with improved Recall@1 and MRR, while reducing inference time by approximately 2x.

RCLAgent is a large-language-model-based framework for root cause localization in microservice systems that models diagnosis as a recursive, tool-augmented, multi-agent reasoning process. In the 2025 formulation, it is introduced as an adaptive method that leverages a multi-agent recursion-of-thought framework to localize the root cause from a single anomalous request, integrating traces and metrics through structured agent interaction (Zhang et al., 28 Aug 2025). A 2026 formulation presents RCLAgent as an in-depth root cause localization framework that addresses context explosion and serial reasoning by aligning agents to the trace graph and executing recursive diagnosis in parallel, with final synthesis derived from a Root-Level Diagnosis Report and a Global Evidence Graph (Zhang et al., 14 May 2026).

1. Problem formulation and design objective

RCLAgent is situated in the problem setting of root cause localization for contemporary microservice systems, where failures arise in environments with dynamic interactions, evolving runtime conditions, and dense invocation topologies. The papers identify several deficiencies in prior approaches: reliance on static, pre-defined schemas or causal graphs, limited interpretability, poor transferability across deployments, and dependence on aggregating multiple anomalous requests before diagnosis. The 2025 paper further emphasizes that existing methods either heavily rely on pre-defined schemas or lack interpretability, whereas the 2026 paper adds two specific failure modes for LLM-based approaches: context explosion, which dilutes critical evidence, and serial reasoning structures, which impede deep causal exploration and impair inference efficiency (Zhang et al., 28 Aug 2025, Zhang et al., 14 May 2026).

Within this framing, RCLAgent is designed to localize the root cause using only a single request while preserving an explicit reasoning process. This distinguishes it from methods that require request aggregation and from opaque statistical or deep models whose internal decision pathways are difficult for Site Reliability Engineers to inspect. The framework therefore treats diagnosis not as direct classification over a fixed schema, but as iterative evidence acquisition and recursive hypothesis refinement over the execution structure of a failing request (Zhang et al., 28 Aug 2025).

2. Empirical basis in Site Reliability Engineer practice

Both RCLAgent papers ground their design in a comprehensive study of professional Site Reliability Engineers across different organizations. That study identifies three recurrent properties of expert root cause analysis: recursiveness, multi-dimensional expansion, and cross-modal reasoning. Recursiveness refers to iterative drilling down from symptoms to deeper causes along request traces. Multi-dimensional expansion refers to correlation across spans, pods, services, and infrastructure nodes rather than strictly linear path following. Cross-modal reasoning refers to combining trace evidence with corroborative signals from metrics, and in the later formulation, logs as well (Zhang et al., 28 Aug 2025, Zhang et al., 14 May 2026).

These observations are not presented as a loose inspiration but as the organizing principle of the framework. RCLAgent operationalizes recursive traversal, inter-component expansion, and multi-modal evidence collection as explicit agent behaviors. A plausible implication is that the framework’s interpretability derives less from free-form chain-of-thought and more from its attempt to encode a recognizable SRE diagnostic workflow into the orchestration layer.

3. Agent organization and system architecture

The 2025 formulation divides the system into Data Agents, Thought Agents, and a Coordinator. The Data Agents include a Trace Agent, which extracts diagnostically relevant spans and operations from traces; a Metric Agent, which selectively surfaces metrics with significant fluctuation in a relevant time window; and a Format Agent, which standardizes output into a structured format such as JSON with root_cause and reason. The Thought Agents include a Recursion Agent, which performs step-wise recursive reasoning and decides whether to drill deeper, query metrics, or backtrack, and an Intermodal Agent, which bridges trace context to metric queries by generating keyword-timewindow queries of the form $q = I(X) = (K, \tau)$. The Coordinator orchestrates these agents across three ordered phases (Zhang et al., 28 Aug 2025).

The 2026 formulation restructures RCLAgent around Dedicated Agents assigned to individual spans in the trace graph. Agent topology follows the invocation topology: each span is handled by one Dedicated Agent, agents communicate recursively along parent-child relations, and independent branches are reasoned about in parallel under an Agents Pool constrained by $|\mathcal{A}_{\text{active}}| \leq K$. Final synthesis is performed by a Diagnosis Synthesizer, which combines the recursively aggregated diagnosis at the root with a retained graph of span-level evidence (Zhang et al., 14 May 2026).

Taken together, these formulations show two complementary architectural emphases. The earlier paper foregrounds role-specialized agents and staged interaction; the later paper foregrounds trace-aligned decomposition and bounded-context parallelism. The literature uses the same name for both formulations, and the shared through-line is multi-agent recursion-of-thought rather than monolithic prompting.

4. Reasoning protocol, tools, and evidence representations

In the 2025 formulation, RCLAgent operates through three explicit phases. Initial Reasoning begins at the entry span of an anomalous request and uses only the Trace Agent together with the Recursion Agent; the Metric Agent is intentionally hidden to avoid premature metric-driven reasoning. Critical Reflection then reopens both trace and metric access, pushing the model to validate or revise earlier suspicions and to probe deeper if necessary. Final Review forces the model, together with the Format Agent, to review the entire provenance of the reasoning process so that the final answer is not biased toward only the most recent context (Zhang et al., 28 Aug 2025).

The trace interface is formalized as

$$T(s) = \left\{ \langle t, s', svc, op, d, \sigma \rangle \mid s' \in \mathcal{C}(s) \right\},$$

where child spans of a span $s$ are exposed together with service, operation, duration, and status information. Metric selection is anomaly-focused:

$|m(t) - \mu_m| > n \times \sigma_m,$

and the query set relevant to a component $C$ around time $t_0$ is

$$Q(t_0, \delta, C) = \left\{ m(t) \mid m \in \mathcal{M}(C),\ t \in [t_0-\delta, t_0+\delta],\ |m(t) - \mu_m| > n \sigma_m \right\}.$$

This structure constrains the metric view to fluctuations deemed diagnostically salient rather than exposing full time series (Zhang et al., 28 Aug 2025).

The 2026 formulation adds explicit log filtering and formalizes local agent computation. Relevant logs for component $C$ in a local interval are retrieved by

$$L(t_0, \delta, C) = \{ l \in \mathcal{L}(C) \mid t(l) \in [t_0-\delta, t_0+\delta],\ \phi(l)=1 \}.$$

Each Dedicated Agent performs Self-State Verification

$|\mathcal{A}_{\text{active}}| \leq K$0

where

$|\mathcal{A}_{\text{active}}| \leq K$1

and then Evidence Consolidation

$|\mathcal{A}_{\text{active}}| \leq K$2

where

$|\mathcal{A}_{\text{active}}| \leq K$3

This local-first structure is the mechanism by which the framework attempts to avoid context explosion: each agent sees its own span-local evidence and summarized child evidence rather than the flattened trace or entire observability corpus (Zhang et al., 14 May 2026).

Final synthesis in the later paper combines two artifacts. The Root-Level Diagnosis Report captures the recursive aggregation outcome at the root, while the Global Evidence Graph

$|\mathcal{A}_{\text{active}}| \leq K$4

retains span-level summarized evidence with $|\mathcal{A}_{\text{active}}| \leq K$5. This dual representation is intended to preserve globally relevant evidence even when hierarchical consolidation suppresses detail at higher levels (Zhang et al., 14 May 2026).

5. Empirical evaluation and reported performance

The 2025 paper evaluates RCLAgent on six public subsets from the AIOPS 2022 microservices e-commerce dataset. It reports that RCLAgent’s Recall@1 surpasses the Recall@10 of state-of-the-art trace-based and metrics-based baselines, indicating that the top prediction is frequently the ground truth. When a naive majority vote is applied over per-request results so that outcomes are grouped similarly to competing methods, RCLAgent’s MRR improves by an average of 32.53% over the best competing method. The paper also states that RCLAgent significantly outperforms previous LLM-based approaches such as mABC and CoT in both accuracy and efficiency, and that ablation shows each stage—initial reasoning, critical reflection, and final review—contributes measurable accuracy, with critical reflection especially important for surfacing deeper or hidden causes (Zhang et al., 28 Aug 2025).

The 2026 paper broadens evaluation to AIOPS 2022, Augmented-TrainTicket, and RCAEval (RE2-OB), and compares against both non-LLM baselines and LLM-based baselines including CoT, RCAgent, mABC, and GALA. On AIOPS 2022, it reports MRR 69.73% for RCLAgent with Claude-3.5-Sonnet, compared with mABC 58.05%, GALA 42.06%, and TraceRCA 42.19%. For inference efficiency on AIOPS 2022, it reports CoT: 87s and RCLAgent: 41s per query, characterizing RCLAgent as approximately 2x faster than other LLM-based methods. The paper further states that improvements over strong baselines are statistically significant with $|\mathcal{A}_{\text{active}}| \leq K$6, that performance is best with Claude-3.5-Sonnet and Qwen-3.6-Plus, and that ablation confirms both the Root-Level Diagnosis Report and the Global Evidence Graph improve accuracy, with the combined formulation performing best (Zhang et al., 14 May 2026).

These results underwrite two claims central to the RCLAgent literature. First, the framework is presented as effective even in the low-data setting of single-request diagnosis. Second, the use of recursion-of-thought does not merely increase interpretability; in the reported experiments it is associated with higher localization accuracy and lower inference cost than serial LLM baselines (Zhang et al., 28 Aug 2025, Zhang et al., 14 May 2026).

6. Relation to adjacent RCA frameworks, misconceptions, and limitations

RCLAgent belongs to a rapidly developing line of LLM-based RCA systems for microservices, but it occupies a specific methodological position. It differs from frameworks that formulate diagnosis as reflection-guided tree search over hypotheses. For example, LATS-RCA casts RCA as a reflection-guided tree-structured search using a Language Agent Tree Search algorithm over logs and metrics, achieving 91.3% diagnostic accuracy on LO2 while showing lower accuracy and higher computational cost in a more heterogeneous production environment (Naakka et al., 5 May 2026). It also differs from modular multimodal pipelines such as MicroRCA-Agent, which combines Drain-based log parsing, Isolation Forest with status code validation for traces, and a two-stage LLM metric analysis, reporting a final score of 50.71 in the 2025 CCF International AIOps Challenge setting (Tang et al., 19 Sep 2025).

A later related framework, AMER-RCL, extends the same problem family with Agentic Memory that stores causal graphs and reasoning traces for alerts within a time window and reuses prior reasoning for highly similar or partially similar alerts. It reports improvements in both localization accuracy and inference efficiency, including average improvement over the previous best of approximately 15.75% in MRR and over 3.5× speedup in batch alert analysis. This suggests a distinct line of development in which recursive reasoning is combined with cross-alert memory reuse to reduce redundant exploration and latency (Zhang et al., 6 Jan 2026).

Several misconceptions are explicitly contradicted by the RCLAgent papers. One is that RCLAgent is simply a ReAct or chain-of-thought prompt with additional tools; both papers distinguish it from linear reasoning by emphasizing recursive exploration, multi-agent coordination, and, in the later formulation, span-aligned parallelism (Zhang et al., 28 Aug 2025, Zhang et al., 14 May 2026). Another is that accurate microservice RCA necessarily depends on aggregating many anomalous requests; the 2025 paper presents single-request localization as a defining property of the method (Zhang et al., 28 Aug 2025).

The limitations stated in the later formulation are also specific. RCLAgent assumes sufficient tracing coverage, so trace-blind spots may constrain diagnosis. It inherits general LLM weaknesses including latency, hallucination, and sensitivity to prompts, although the framework is presented as mitigating context and reasoning-depth constraints through bounded local contexts and recursive decomposition. In broader production settings, related work indicates that heterogeneity in logs, metrics, and multi-factor incidents remains a substantive challenge for LLM-based RCA systems more generally (Zhang et al., 14 May 2026, Naakka et al., 5 May 2026).