An eBPF-based intelligent root cause localization method for electric power information systems

Abstract

To address the problems of scattered multi-source heterogeneous monitoring data, complex system call relationships, and low efficiency in fault root cause localization in electric power information systems, this paper proposes an extended Berkeley Packet Filter (eBPF)-based intelligent fault root cause localization method for electric power information systems. First, eBPF technology is employed to achieve non-intrusive data collection at the operating system kernel layer and to construct a dynamic system execution graph. Then, a causal modeling method is introduced to design a multi-agent collaborative reasoning mechanism. Accurate fault root cause localization is achieved through the combination of path scoring and counterfactual verification. Finally, experiments are conducted on a labeled dataset constructed from State Grid cloud platform data, with ground-truth labels confirmed by operation records, expert troubleshooting reports, and controlled fault-injection logs. Compared with Key Performance Indicator (KPI)-based anomaly detection, log semantic analysis, call-chain graph localization, causal Root Cause Analysis (RCA), and traditional instrumentation-based Application Performance Monitoring (APM), the proposed method achieves an Accuracy@1 of 91.7% and an Accuracy@3 of 95.8%. Additional validation under concurrent multi-root-cause faults, cross-service cascading failures, and combined network jitter with storage I/O anomalies further verifies the robustness of the method while maintaining low system overhead.