How raghavnimbalkar1/agentic-graphrag-for-root-cause-analysis- works
This is an autonomous AIOps root-cause and remediation system. A telemetry collector detects real service-health transitions and raises alerts; the API starts a LangGraph workflow that localises the deepest unhealthy dependency, retrieves graph-vetted SOP candidates, asks an LLM to select safely, executes the SOP in a Docker sandbox, and re-probes for recovery, using fallback SOPs when needed. Neo4j holds infrastructure and skill graphs plus observed status. The dashboard exposes live incidents, graphs, audit history, and evaluations. Core runtime wiring is supported by sampled source; several documented subsystem links are shown at directory level because their implementations were not sampled.
Main entry points: graph.py LangGraph workflow · app.py Streamlit dashboard · telemetry_collector.py Telemetry collector · main.py Alert API
Components 24
Detection
- Telemetry collector
simulation/telemetry_collector.py - Fault injector
simulation/fault_injector.py
RCA agent
- Alert API
agent/main.py - LangGraph workflow
agent/graph.py - Alert ingestion
agent/nodes/ingest.py - Graph retriever
agent/nodes/retriever.py - LLM reasoner
agent/nodes/reasoner.py - Recovery evaluator
agent/nodes/evaluator.py - SOP executor
agent/nodes/executor.py
Graph knowledge
- Graph client
graph/graph_client.py - Neo4j graph
- Graph population
graph/graph_populator.py - Graph schema
graph/schema_definitions.py
Remediation
- Docker sandbox
agent/tools/sandbox_tools.py
Product surface
- Streamlit dashboard
dashboard/app.py - RCA views
dashboard/components/rca_report.py - Incident audit
dashboard/components/agent_log.py - Graph visualizations
dashboard/components/graph_viz.py - RAG baselines
eval/baselines - Benchmarking
eval/benchmark_full.py
Other components
- Microservice stack
- LLM provider
- Docker engine
- Redis health
Connections 31
- Microservice stack → Telemetry collector: reports state
- Telemetry collector → Docker engine: probes containers
- Telemetry collector → Redis health: checks health
- Telemetry collector → Neo4j graph: syncs status
- Telemetry collector → Alert API: posts alerts
- Fault injector → Docker engine: injects faults
- Fault injector → Neo4j graph: records status
- Alert API → LangGraph workflow: invokes
- LangGraph workflow → Alert ingestion: dispatches
- LangGraph workflow → Graph retriever: dispatches
- LangGraph workflow → LLM reasoner: dispatches
- LangGraph workflow → SOP executor: dispatches
- LangGraph workflow → Recovery evaluator: dispatches
- Graph retriever → Graph client: queries
- Graph client → Neo4j graph: reads graph
- Graph client → Neo4j graph: writes status
- LLM reasoner → LLM provider: requests decision
- SOP executor → Docker sandbox: runs SOP
- Docker sandbox → Docker engine: runs container
- Recovery evaluator → Docker engine: re-probes
- Recovery evaluator → Redis health: verifies health
- SOP executor → Graph retriever: requests fallback
- Streamlit dashboard → Alert API: submits alerts
- Streamlit dashboard → RCA views: renders reports
- Streamlit dashboard → Incident audit: shows history
- Streamlit dashboard → Graph visualizations: renders graphs
- Streamlit dashboard → Neo4j graph: reads live state
- Graph population → Neo4j graph: loads graph data
- Graph schema → Graph population: defines graph
- Benchmarking → RAG baselines: compares systems
- Benchmarking → Alert API: runs agent alerts