From General Agents to RCA Experts: A Self-Evolving Harness for Root Cause Analysis
cs.SE, cs.AI
Submitted: 2026-08-26
Updated: 2026-08-26
Code: https://github.com/sst/opencode
License: http://creativecommons.org/licenses/by/4.0/
The gist: Automated root cause analysis (RCA) with large language models (LLMs) has drawn growing attention.
Terminology
Abstract
Automated root cause analysis (RCA) with large language models (LLMs) has drawn growing attention. Today, SREs typically automate RCA with LLMs in one of two ways: directly using a general-purpose agent (e.g., Codex or Claude Code) for diagnosis, or building a specialized RCA agent from scratch. As mainstream general agents grow more capable and iterate quickly, our quantitative study finds that the former now often surpasses the latter. Its accuracy, however, still falls short of production needs, and this gap stems mainly from the external adaptation layer outside the agent's general capabilities, namely the harness. We therefore argue that LLM-based RCA should focus on this external harness, reusing the strong general capabilities of a modern agent rather than rebuilding an agent from scratch. A key capability of such a harness is to self-evolve, accumulating system-specific experience from past diagnoses so that it gets better the more it is used. We introduce OpsHarness, a self-evolving RCA harness that turns diagnosis experience into reusable expertise. Its data plane combines layered operational knowledge with an idea-card tool library, while its control plane coordinates setup, diagnosis, evolution, and verification. During evolution, OpsHarness contrasts successful and failed trajectories, converts their evidence into atomic proposals, and admits updates only through a dual-gate verification process designed to prevent overfitting and regression. Across two public benchmarks and an industrial deployment, OpsHarness achieves 59.0% top-1 accuracy, improving over a bare general agent by 63.4% and over baseline RCA agents by 4.02 times.
Sources
- Failure Diagnosis in Microservice Systems: A Comprehensive Survey and Analysis
- Automatic Root Cause Analysis via Large Language Models for Cloud Incidents
- RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models
- Flow-of-Action: SOP Enhanced LLM-Based Multi-Agent System for Root Cause Analysis
- SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering
- RCAEval: A Benchmark for Root Cause Analysis of Microservice Systems with Telemetry Data
- Xpert: Empowering Incident Management with Query Recommendations via Large Language Models
- Recommending Root-Cause and Mitigation Steps for Cloud Incidents using Large Language Models
- Assess and Summarize: Improve Outage Understanding with Large Language Models
- Automated Root Causing of Cloud Incidents using In-Context Learning with GPT-4
- Cognitive Architectures for Language Agents
- Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering
- MemGPT: Towards LLMs as Operating Systems
- Voyager: An Open-Ended Embodied Agent with Large Language Models
- ExpeL: LLM Agents Are Experiential Learners
- GLM-5: from Vibe Coding to Agentic Engineering
- DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence
- AutoTSG: Learning and Synthesis for Incident Troubleshooting
- Mining Root Cause Knowledge from Cloud Service Incident Investigations for AIOps
- A Survey on In-context Learning
Related papers
- Falsification-Based Verification of LLM-Generated Optimization Models: Sound Test Batteries and Their Detection Limits
- GitSkills: A Dataset of Agent Skills on GitHub
- For Coding Agents, the Repository Matters
- SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces
- PackMonitor: Enabling Zero Package Hallucinations Through Decoding-Time Monitoring
- IntentCoding: Amplifying User Intent in Code Generation