ASE 2025 Multimodal AIOps

TrioXpert: An Automated Incident Management Framework for Microservice System

Yongqian Sun^1,7, Yu Luo¹, Xidao Wen^4,*, Yuan Yuan⁶, Xiaohui Nie², Shenglin Zhang^1,5, Tong Liu³, Xi Luo³

¹Nankai University ²Computer Network Information Center, Chinese Academy of Sciences ³Lenovo (Tianjin) Co., Ltd. ⁴BizSeer
⁵Key Laboratory of Data and Intelligent System Security, Ministry of Education, China ⁶National University of Defense Technology ⁷Tianjin Key Laboratory of Software Experience and Human Computer Interaction

ASE 2025

* Corresponding author

Paper Code Slide Story

TrioXpert incident management lifecycle — TrioXpert targets the automated stages of incident management: anomaly detection, failure triage, and root cause localization.

01 THE PAPER

Abstract

Automated incident management plays a pivotal role in large-scale microservice systems. However, many existing methods rely solely on single-modal data (e.g., metrics, logs, and traces) and struggle to simultaneously address multiple downstream tasks, including anomaly detection (AD), failure triage (FT), and root cause localization (RCL). Moreover, the lack of clear reasoning evidence in current techniques often leads to insufficient interpretability. To address these limitations, we propose TrioXpert, an end-to-end incident management framework capable of fully leveraging multimodal data. TrioXpert designs three independent data processing pipelines based on the inherent characteristics of different modalities, comprehensively characterizing the operational status of microservice systems from both numerical and textual dimensions. It employs a collaborative reasoning mechanism using large language models (LLMs) to simultaneously handle multiple tasks while providing clear reasoning evidence to ensure strong interpretability. We conducted extensive evaluations on two microservice system datasets, and the experimental results demonstrate that TrioXpert achieves outstanding performance in AD (improving by 4.7% to 57.7%), FT (improving by 2.1% to 40.6%), and RCL (improving by 1.6% to 163.1%) tasks. TrioXpert has also been deployed in Lenovo's production environment, demonstrating substantial gains in diagnostic efficiency and accuracy.

Project Overview

Multimodal Evidence

TrioXpert treats metrics, logs, and traces according to their own data characteristics, using numerical and textual views to describe the system state more completely.

Multi-Task Management

The framework covers anomaly detection, failure triage, and root cause localization in one end-to-end incident management workflow.

Interpretable Reasoning

LLM-based experts cooperate over structured evidence, producing reasoning traces that help OCEs inspect why a diagnosis was made.

02 DESIGN LESSONS

Key Takeaways

Takeaway 1

Every modality matters, but not every record helps.

Metrics, logs, and traces reflect distinct aspects of system behavior, and all of them carry valuable diagnostic signals. The key difficulty is that logs and traces are often dominated by redundant entries, so useful textual evidence must be filtered before reasoning.

Takeaway 2

A single LLM is not enough for reliable incident management.

Directly feeding complex multimodal incident data into one monolithic LLM can produce fluent but unreliable reports, with hallucinated steps, opaque reasoning, and context-window loss. TrioXpert therefore uses collaborative experts and structured prompts to make reasoning more stable and interpretable.

03 THE FRAMEWORK

Method

04 EVALUATION

Experimental Results

Table 1: Detailed information of datasets

Datasets: TrioXpert is evaluated on two microservice-system datasets containing multimodal traces, logs, and metrics across multiple failure types.

Table 2: Performance comparison on AD, FT, RCL, and time

Overall Performance: TrioXpert consistently improves AD, FT, and RCL performance over multimodal and task-specific baselines on both datasets.

Ablation Study: Removing modality coverage, collaborative reasoning, coordination, or hallucination mitigation weakens performance, confirming the need for the full design.

05 WHAT WE LEARNED

Key Insights

TrioXpert shows that multimodal fusion in AIOps cannot treat all observability data as the same kind of signal. Metrics should be understood through their temporal and statistical behavior, while logs and traces should be used for their rich semantic evidence. The important move is not simply to put more data into a model, but to preserve the diagnostic value that each modality naturally carries.

The paper also provides an early demonstration that multi-agent collaboration can be effective for AIOps root cause analysis. By separating numerical and textual expertise, coordinating expert outputs, and forcing evidence-backed reasoning, TrioXpert improves interpretability as well as task performance. This became a useful starting point for later work on more structured and reliable agentic diagnosis.

06 CITE THIS WORK

BibTeX

@inproceedings{sun2025trioxpert,
  title={TrioXpert: An Automated Incident Management Framework for Microservice System},
  author={Sun, Yongqian and Luo, Yu and Wen, Xidao and Yuan, Yuan and Nie, Xiaohui and Zhang, Shenglin and Liu, Tong and Luo, Xi},
  booktitle={2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE)},
  pages={3239--3250},
  year={2025},
  organization={IEEE}
}