TS2025 - TAAF: A Knowledge Graph and LLM-Driven Framework for Trace Abstraction and Analysis

Modern systems generate massive amounts of trace data, which is valuable for performance analysis, debugging, and anomaly detection. However, existing analysis workflows, including popular visualization tools like Trace Compass, often require significant manual effort, domain expertise, and are not scalable for complex or large datasets. Analysts are often overwhelmed by the volume and complexity of trace data, and even with advanced filtering or aggregation, meaningful insights can remain hidden or require tedious, repetitive work. This talk presents our research on the Trace Abstraction and Analysis Framework (TAAF), a new approach that integrates knowledge graphs and large language models (LLMs) to bridge the gap between raw trace data and actionable insight. TAAF enables users to interact with their trace data through natural language queries, reducing the need for deep domain expertise or manual, low-level exploration. The framework builds a time-indexed knowledge graph from trace events, capturing both structural and contextual information, such as interactions between threads, CPUs, and key system attributes. Generative AI models then use these knowledge graphs to answer a wide range of questions, from root-cause diagnosis to performance comparisons, delivering human-readable explanations. We will present our methodology, key design choices, and evaluation results, and discuss real-world scenarios where TAAF reduced manual effort and improved analysis accuracy. Our experiments show that combining knowledge graphs with generative AI improves answer quality and accuracy compared to manual methods or raw data alone. We will demonstrate use cases such as identifying performance bottlenecks, tracing causal chains, and generating summaries for user queries, all without the need for coding. We also examine the strengths and limitations of LLMs and knowledge graphs in practical trace analysis. This talk will benefit industry practitioners who need faster and more accessible diagnostics, as well as academic researchers interested in automated analysis, interactive tooling, and new AI-based methods for system trace data.