Autonomous Log Root Cause Analysis: A Closed-Loop, Hypothesis-Driven Framework for Distributed Systems

Modern distributed applications emit enormous streams of logs, metrics and traces, and one failing component can set off a chain of failures in the services that depend on it. Locating the true origin of such an incident by hand is slow and depends heavily on the experience of on-call engineers. This paper presents an autonomous root cause analysis (RCA) framework, centred on log data, that detects abnormal behaviour, builds the surrounding incident context, proposes several competing root-cause hypotheses, and tests them against collected evidence before reporting a conclusion. The design is organised as eight cooperating layers, including an advanced reasoning layer (counterfactual analysis, a lightweight digital twin and a causal knowledge graph) and a verification and feedback loop. A working prototype of the detection stage has been built in Python using an Isolation Forest model combined with rule-based checks over JSON logs, while the remaining layers are described as planned work. We discuss the expected benefits of the approach, namely shorter detection and resolution times, fewer false leads caused by cascading faults, and a path toward predictive, self-healing operation.