Diviner system improves root-cause analysis in large distributed systems
Diviner: Agentic RCA with Human-Governed Adaptation for Large-Scale Infrastructure
Artificial IntelligenceMultiagent Systems
Summary
Finding the cause of problems in big computer systems is hard because issues can affect many parts and teams. The authors created Diviner, a system that helps organize information, experts, and tools to track down these causes more reliably. Diviner learns from past incidents and expert input, uses a special way to gather and check evidence, and adapts over time with human review to improve its knowledge. This makes investigating problems faster and more accurate in complex environments.
What this means in practice
- •For site reliability engineers: Use Diviner to coordinate expert inputs and evidence for diagnosing causes of outages in large distributed services.
- •For infrastructure operations teams: Improve operational knowledge updates and incident handling by integrating Diviner’s lifecycle into organizational workflows.
Authors
Pradipta Ghosh, Gaurav Mitra, Shripad Nadgowda, Akshil Shah, Junyu Liu, Canturk Isci, Syamla Bandla, Xinyao Hu, Onkar Deshpande, Anik Dasgupta
Abstract
Root-cause analysis (RCA) in large-scale distributed systems is challenging because a single symptom can cross service, data, configuration, compute, and organizational boundaries. Responders must assemble incomplete evidence and coordinate experts who hold different parts of the causal path. Generic language-model agents do not solve this problem through tool access alone: they can use stale or mistimed context, interpret failed queries as absent symptoms, report unsupported system state, and overload observability services designed for human-paced use. We present Diviner (Domain-Informed Verifiable Incident Navigation through Evidence and Review), an agentic RCA system operating at Meta and organized around a four-stage reliability lifecycle. Encode combines a large corpus of reviewed incidents with service-owner expertise to produce scoped, versioned skills, workflows, typed tools, and an incident knowledge graph. Execute uses an adaptive Lead and context-isolated workers to apply relevant knowledge to point-in-time evidence and maintain evidence-linked hypotheses. Evaluate compares saved investigation trajectories with responder-reviewed outcomes to measure exact cause, useful direction, and Groundedness. Adapt uses recurring gaps and on-call feedback to derive focused operational- knowledge updates, admitting them only after replay, quality checks, and owner approval.