Abstract:In large-scale online service systems, intricate dependencies among components often cause a single fault to trigger a massive number of correlated alerts, resulting in alert storms. Alert storms not only increase the workload of on-call engineers but also make fault diagnosis and root cause analysis more challenging. To address this issue, this study proposes Alert-CM, a graph representation learning-based alert clustering method that effectively groups alerts caused by the same fault, thereby alleviating engineers’ workloads. In alert management, an alert is typically generated by aggregating various types of underlying system data at the time of a fault, including related applications, metrics, logs, alert rules, and emergency scenarios. Alert-CM assumes that multiple alerts triggered by the same fault usually exhibit tight correlations at the underlying system data level, and that the core underlying system data better represents the abnormal system state associated with the alerts. Based on this assumption, Alert-CM constructs a fine-grained system data dependency graph using alert-related configuration data, abstracting and mapping the dependency relationships between alerts and graph nodes to further expand the alert feature space. On top of the system data dependency graph, a graph neural network model is built to perform graph representation learning, in which the contributions of core underlying system data to alerts are automatically learned, producing accurate alert vector representations. Finally, the DBSCAN algorithm is applied to cluster alerts based on the learned representations. Alert-CM is evaluated on a real-world industrial dataset, with a focus on clustering effectiveness and real-time efficiency. The experimental results demonstrate that Alert-CM significantly outperforms traditional alert aggregation methods in alert clustering tasks. Specifically, Alert-CM achieves an NMI of 0.901 and an ARI of 0.645, corresponding to average improvements of 31.7% and 153.9% over existing methods, respectively. In addition, Alert-CM exhibits strong performance in online real-time clustering tasks.