LLM-Powered Orchestrator PRAXIS Improves Cloud Incident Root Cause Analysis

Global: LLM-Powered Orchestrator PRAXIS Improves Cloud Incident Root Cause Analysis

In December 2025, a preprint posted to arXiv introduced a system called PRAXIS that aims to streamline the diagnosis of cloud incidents caused by code and configuration errors. The authors note that unresolved production cloud incidents can cost more than $2M per hour, underscoring the financial stakes of rapid root‑cause analysis. By integrating large language models (LLMs) with structured graph traversals, PRAXIS seeks to reduce both the time and computational resources required for accurate failure localization.

Background on Cloud Incident Challenges

Prior studies have identified code‑related and configuration‑related issues as the dominant sources of cloud‑service disruptions. Traditional debugging tools often rely on manual inspection or static analysis, which can be slow and error‑prone in complex microservice environments. The need for automated, scalable solutions has motivated research into AI‑assisted diagnostic frameworks.

Graph‑Based Representation of Services and Code

PRAXIS constructs two complementary graphs. The service dependency graph (SDG) captures microservice‑level interactions, while the hammock‑block program dependence graph (PDG) encodes code‑level dependencies for each service. Together, these structures provide a unified view of both runtime and static relationships, enabling the LLM to navigate across service boundaries and code modules during analysis.

LLM‑Driven Traversal Policy

The system treats the LLM as a traversal policy that selects nodes and edges in the combined graph based on contextual clues from incident logs and error messages. By prompting the model to ask targeted questions and follow logical inference paths, PRAXIS can isolate the most likely faulty component and generate an explanatory narrative for operators.

Performance Evaluation

When benchmarked against state‑of‑the‑art ReAct baselines, PRAXIS achieved root‑cause analysis (RCA) accuracy improvements of up to 3.1×. Additionally, the orchestrator reduced token consumption by 3.8×, indicating more efficient use of LLM resources. The evaluation was conducted on a curated set of 30 real‑world cloud incidents that the authors are assembling into a public RCA benchmark.

Implications and Future Work

The reported gains suggest that LLM‑guided graph traversal can materially enhance incident response workflows in large‑scale cloud deployments. The authors plan to expand the benchmark, explore additional graph abstractions, and investigate integration with existing observability platforms. If adopted broadly, such techniques could lower the financial impact of downtime and improve overall system reliability.

This report is based on information from arXiv, licensed under Academic Preprint / Open Access. Based on the abstract of the research paper. Full text available via ArXiv.