Tools, Not Code: Microservice Root Cause Analysis with Cost-Effective Language Models

Automated root cause analysis (RCA) in microservice systems has recently been framed as a code-generation task, where an LLM agent writes and executes analysis scripts over telemetry data. While effective with frontier models, this approach degrades substantially with non-frontier models, whose weaker coding abilities often cause execution failures. We present a tool-augmented multi-agent RCA system that replaces ad-hoc code generation with 11 structured diagnostic tools for anomaly detection, causal analysis, and multi-signal integration. The system uses a four-stage pipeline combining deterministic triage, LLM-based hypothesis formation, targeted hypothesis testing, and ensemble prediction. On the OpenRCA benchmark (335 failure scenarios across four microservice systems), our system with gpt-5-mini improves binary accuracy from 7.5% to 12.8% and partial score from 15.9% to 37.9% over the code-generation paradigm. A component contribution analysis reveals that deterministic triage—compiling domain knowledge into algorithmic preprocessing—accounts for the largest accuracy gain, while multi-agent investigation improves fault-type discrimination at the cost of occasional over-falsification, identifying a concrete improvement target. These results suggest that the most effective architectural decomposition for cost-effective RCA is deterministic evidence reduction first, with LLM reasoning applied to the residual ambiguity.