{
  "schema_version": "0.1.0",
  "record_type": "research-topic",
  "topic_id": "observability",
  "label": "Observability",
  "title": "Systems Observability Research",
  "description": "Research papers on observability, tracing, monitoring, runtime evidence, and diagnosis of complex software systems.",
  "introduction": "This topic covers the collection and interpretation of runtime evidence needed to understand complex software systems. It links work on tracing, monitoring, dependency context, anomaly detection, adaptive evidence collection, and runtime governance for applications, services, cloud platforms, and agentic systems.",
  "aliases": [
    "software observability",
    "runtime observability",
    "systems monitoring"
  ],
  "search_terms": [
    "observability",
    "runtime monitoring",
    "distributed tracing",
    "performance diagnosis",
    "runtime governance"
  ],
  "related_topics": [
    "system-tracing",
    "kernel-tracing",
    "trace-analysis",
    "root-cause-analysis",
    "microservices"
  ],
  "canonical_url": "https://threadslab.org/research-publications/topics/observability.html",
  "paper_count": 20,
  "papers": [
    {
      "paper_id": "lmat-adaptive-tracing-language-models",
      "title": "LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models",
      "year": 2026,
      "authors": [
        "Kasra Darvishi",
        "Morteza Noferesti",
        "Yuvraj Sehgal",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/lmat-adaptive-tracing-language-models/",
      "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112890",
      "core_contribution": "LMAT combines multi-task language models for kernel-event and event-duration prediction with online change detection, lightweight error-vector root-cause analysis, and adaptive tracing control.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "llm-assisted-analysis",
        "observability",
        "anomaly-detection",
        "root-cause-analysis",
        "trace-reduction"
      ],
      "keywords": [
        "adaptive tracing",
        "LTTng",
        "kernel events",
        "system-call sequences",
        "event-duration modeling",
        "language models",
        "LSTM",
        "BERT",
        "multi-task learning",
        "HDBSCAN",
        "change detection",
        "root-cause analysis",
        "Apache",
        "Sock Shop",
        "OpenTelemetry",
        "Prometheus",
        "stress-ng",
        "trace reduction",
        "trace overhead"
      ]
    },
    {
      "paper_id": "observability-runtime-governance-agentic-ai-systems",
      "title": "Observability and Runtime Governance for Agentic AI Systems",
      "year": 2026,
      "authors": [
        "Naser Ezzati-Jivan",
        "Maryam Ekhlasi"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/observability-runtime-governance-agentic-ai-systems/",
      "canonical_source_url": "https://doi.org/10.1145/3803437.3804904",
      "core_contribution": "The tutorial presents an end-to-end AgentOps workflow that connects task intent and model decisions to tool calls, memory access, inter-agent communication, external side effects, and runtime-governance decisions.",
      "tags": [
        "observability",
        "llm-assisted-analysis",
        "performance-analysis"
      ],
      "keywords": [
        "agentic AI",
        "AgentOps",
        "runtime governance",
        "AI observability",
        "software agents",
        "agent tracing",
        "silent failures",
        "goal drift",
        "tool-use failures",
        "cross-layer evidence",
        "policy checks",
        "human escalation",
        "FSE 2026"
      ]
    },
    {
      "paper_id": "rethinking-performance-debugging-from-optimization-to-collaborative-reasoning",
      "title": "Rethinking Performance Debugging: From Optimization to Collaborative Reasoning",
      "year": 2026,
      "authors": [
        "Mahsa Panahandeh",
        "Naser Ezzati-Jivan",
        "Abdelwahab Hamou-Lhadj"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/rethinking-performance-debugging-from-optimization-to-collaborative-reasoning/",
      "canonical_source_url": "https://doi.org/10.1145/3803437.3805578",
      "core_contribution": "The paper reframes performance debugging as collaborative reasoning over multiple evidence-grounded hypotheses rather than optimization for one supposedly best explanation.",
      "tags": [
        "performance-analysis",
        "microservices",
        "llm-assisted-analysis",
        "root-cause-analysis",
        "observability"
      ],
      "keywords": [
        "performance debugging",
        "collaborative reasoning",
        "AgentDebug",
        "Reasoning Surface",
        "hypothesis generation",
        "hypothesis critique",
        "hypothesis curation",
        "Gemini 2.5 Flash",
        "CART",
        "DeLag",
        "Train-Ticket",
        "E-Shopper",
        "fault injection",
        "RPC latency",
        "Pareto-optimal hypotheses"
      ]
    },
    {
      "paper_id": "taaf-trace-abstraction-analysis-framework",
      "title": "TAAF: A Trace Abstraction and Analysis Framework Synergizing Knowledge Graphs and LLMs",
      "year": 2026,
      "authors": [
        "Alireza Ezaz",
        "Ghazal Khodabandeh",
        "Majid Babaei",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/taaf-trace-abstraction-analysis-framework/",
      "canonical_source_url": "https://doi.org/10.1145/3744916.3787832",
      "core_contribution": "TAAF combines time-indexed knowledge graphs with large language models to turn large execution traces into queryable, actionable explanations.",
      "tags": [
        "kernel-tracing",
        "trace-analysis",
        "knowledge-graphs",
        "llm-assisted-analysis",
        "observability"
      ],
      "keywords": [
        "TAAF",
        "TraceQA-100",
        "time-indexed knowledge graph",
        "natural-language trace queries",
        "multi-hop reasoning",
        "causal reasoning"
      ]
    },
    {
      "paper_id": "developing-a-taxonomy-for-advanced-log-parsing-techniques",
      "title": "Developing a Taxonomy for Advanced Log Parsing Techniques",
      "year": 2025,
      "authors": [
        "Issam Sedki",
        "Abdelwahab Hamou-Lhadj",
        "Otmane Ait Mohamed",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/developing-a-taxonomy-for-advanced-log-parsing-techniques/",
      "canonical_source_url": "https://doi.org/10.1109/ICPC66645.2025.00061",
      "core_contribution": "The paper introduces a taxonomy of log-event characteristics that explains why different log parsers fail across systems and parser families.",
      "tags": [
        "observability",
        "trace-analysis",
        "anomaly-detection",
        "performance-analysis"
      ],
      "keywords": [
        "log parsing",
        "log event characteristics",
        "LEC taxonomy",
        "LogHub",
        "Drain",
        "IPLoM",
        "AEL",
        "Spell",
        "LenMa",
        "LogMine",
        "SHISO",
        "ULP",
        "open coding",
        "regex",
        "NER",
        "chi-square",
        "parser errors",
        "token structure"
      ]
    },
    {
      "paper_id": "synthlogai-synthetic-linux-log-generation",
      "title": "SynthLogAI: Generative AI for Synthetic Linux Log Generation and Evaluation",
      "year": 2025,
      "authors": [
        "Hridoy Rahman",
        "Naser Ezzati-Jivan",
        "Blessing Ogbuokiri"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/synthlogai-synthetic-linux-log-generation/",
      "canonical_source_url": "https://doi.org/10.1109/CASCON66301.2025.00032",
      "core_contribution": "SynthLogAI benchmarks statistical, sequence, transformer, and prompt-based generative models for producing synthetic Linux logs while measuring fidelity, downstream utility, and privacy.",
      "tags": [
        "machine-learning",
        "observability",
        "anomaly-detection",
        "system-tracing"
      ],
      "keywords": [
        "synthetic Linux logs",
        "generative AI",
        "log generation",
        "log evaluation",
        "CASCON 2025"
      ]
    },
    {
      "paper_id": "an-adaptive-logging-system-als-enhancing-software-logging-with-reinforcement-learning-techniques",
      "title": "An Adaptive Logging System (ALS): Enhancing Software Logging with Reinforcement Learning Techniques",
      "year": 2024,
      "authors": [
        "Amirmahdi Khosravi Tabrizi",
        "Naser Ezzati-Jivan",
        "Francois Tetreault"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/an-adaptive-logging-system-als-enhancing-software-logging-with-reinforcement-learning-techniques/",
      "canonical_source_url": "https://doi.org/10.1145/3629526.3645033",
      "core_contribution": "ALS uses source-code features and reinforcement learning to recommend which Python functions to log and which log levels to use for performance-bug diagnosis.",
      "tags": [
        "observability",
        "performance-engineering",
        "machine-learning",
        "trace-reduction"
      ],
      "keywords": [
        "adaptive logging",
        "ALS",
        "reinforcement learning",
        "log placement",
        "log level selection",
        "performance bugs",
        "Python AST",
        "Stable-Baselines",
        "DQN",
        "A2C",
        "PPO",
        "Apache",
        "Django",
        "cross-project evaluation",
        "Ciena",
        "source-code features"
      ]
    },
    {
      "paper_id": "analyzing-performance-variability-in-alibaba-s-microservice-architecture-a-critical-path-based-p",
      "title": "Analyzing Performance Variability in Alibaba's Microservice Architecture: A Critical-Path-Based Perspective",
      "year": 2024,
      "authors": [
        "Alireza Ezaz",
        "Ghazal Khodabandeh",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/analyzing-performance-variability-in-alibaba-s-microservice-architecture-a-critical-path-based-p/",
      "canonical_source_url": "https://doi.org/10.1145/3629527.3651845",
      "core_contribution": "The paper identifies response-time variability in Alibaba microservice traces through critical-path extraction and variability analysis of service interactions.",
      "tags": [
        "microservices",
        "performance-analysis",
        "latency-analysis",
        "observability",
        "performance-engineering"
      ],
      "keywords": [
        "Alibaba microservice architecture",
        "critical path",
        "distributed traces",
        "response-time variability",
        "critical interactions",
        "microservice performance",
        "adaptive tracing",
        "cluster-trace-microservices-v2022",
        "mean response time",
        "standard deviation"
      ]
    },
    {
      "paper_id": "decoding-log-parsing-challenges-taxonomy",
      "title": "Decoding Log Parsing Challenges: A Comprehensive Taxonomy for Actionable Solutions",
      "year": 2024,
      "authors": [
        "Issam Sedki",
        "Abdelwahab Hamou-Lhadj",
        "Otmane Ait-Mohamed",
        "Naser Ezzati-Jivan",
        "Mohammed A. Shehab"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/decoding-log-parsing-challenges-taxonomy/",
      "canonical_source_url": "https://doi.org/10.1145/3639478.3643523",
      "core_contribution": "The paper derives a 30-item taxonomy of log event characteristics that induce parsing errors and quantifies the characteristics with the largest impact across eight parsers.",
      "tags": [
        "observability",
        "machine-learning",
        "trace-analysis",
        "benchmark-datasets"
      ],
      "keywords": [
        "log parsing",
        "log event characteristics",
        "LEC taxonomy",
        "LogHub",
        "open coding",
        "Drain",
        "IPLoM",
        "AEL",
        "Spell",
        "LenMa",
        "LogMine",
        "SHISO",
        "ULP",
        "log templates",
        "parsing errors",
        "ICSE 2024"
      ]
    },
    {
      "paper_id": "enhancing-performance-engineering-with-kernel-events",
      "title": "Enhancing empirical software performance engineering research with kernel-level events: A comprehensive system tracing approach",
      "year": 2024,
      "authors": [
        "Morteza Noferesti",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/enhancing-performance-engineering-with-kernel-events/",
      "canonical_source_url": "https://doi.org/10.1016/j.jss.2024.112117",
      "core_contribution": "The paper releases a reusable Linux kernel-event and system-call artifact with controlled application workloads, injected resource noise, and analysis scenarios for software performance engineering.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-engineering",
        "observability",
        "anomaly-detection"
      ],
      "keywords": [
        "LTTng",
        "Linux kernel events",
        "system calls",
        "kernel tracepoints",
        "Elasticsearch",
        "Kibana",
        "IoT dataset",
        "stress-ng",
        "CPU noise",
        "I/O noise",
        "network noise",
        "memory noise",
        "software phase detection",
        "24,263,691 events"
      ]
    },
    {
      "paper_id": "network-analysis-microservices-alibaba",
      "title": "Network Analysis of Microservices: A Case Study on Alibaba Production Clusters",
      "year": 2024,
      "authors": [
        "Ghazal Khodabandeh",
        "Alireza Ezaz",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/network-analysis-microservices-alibaba/",
      "canonical_source_url": "https://doi.org/10.1145/3629527.3651842",
      "core_contribution": "The paper applies graph community detection and service-graph clustering to expose recurring microservice communication structures in an Alibaba production-cluster snapshot.",
      "tags": [
        "microservices",
        "performance-analysis",
        "observability",
        "social-network-analysis"
      ],
      "keywords": [
        "microservice networks",
        "Alibaba production clusters",
        "service call graphs",
        "community detection",
        "Louvain",
        "Infomap",
        "Label Propagation",
        "graph clustering",
        "K-Means",
        "silhouette score",
        "modularity"
      ]
    },
    {
      "paper_id": "toward-adaptive-tracing-language-models",
      "title": "Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models",
      "year": 2024,
      "authors": [
        "Kasra Darvishi",
        "Morteza Noferesti",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/toward-adaptive-tracing-language-models/",
      "canonical_source_url": "https://doi.org/10.1145/3639476.3639778",
      "core_contribution": "The paper proposes an adaptive tracing loop that combines language-model prediction of kernel-event sequences and event durations with change detection and root-cause analysis, so detailed tracing is activated only around significant behavior shifts.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "llm-assisted-analysis",
        "observability",
        "anomaly-detection",
        "root-cause-analysis",
        "trace-reduction"
      ],
      "keywords": [
        "adaptive tracing",
        "LTTng",
        "kernel events",
        "system-call sequences",
        "event-duration modeling",
        "language models",
        "LSTM",
        "BERT",
        "multi-task learning",
        "change detection",
        "root-cause analysis",
        "Apache2",
        "trace reduction",
        "trace overhead"
      ]
    },
    {
      "paper_id": "towards-a-classification-of-log-parsing-errors",
      "title": "Towards a Classification of Log Parsing Errors",
      "year": 2023,
      "authors": [
        "Issam Sedki",
        "Abdelwahab Hamou-Lhadj",
        "Otmane Ait Mohamed",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/towards-a-classification-of-log-parsing-errors/",
      "canonical_source_url": "https://doi.org/10.1109/ICPC58990.2023.00023",
      "core_contribution": "The paper classifies recurring log-parsing errors and connects them to token and event characteristics that can guide parser design and logging practice.",
      "tags": [
        "observability",
        "trace-analysis",
        "anomaly-detection",
        "performance-analysis"
      ],
      "keywords": [
        "log parsing",
        "parser errors",
        "Drain",
        "AEL",
        "Spell",
        "ULP",
        "LogHub",
        "tokenization",
        "logging practices",
        "dynamic tokens",
        "static tokens",
        "delimiter-aware logging",
        "parser error taxonomy"
      ]
    },
    {
      "paper_id": "combining-distributed-kernel-tracing-cloud",
      "title": "Combining Distributed and Kernel Tracing for Performance Analysis of Cloud Applications",
      "year": 2021,
      "authors": [
        "Loïc Gelle",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/combining-distributed-kernel-tracing-cloud/",
      "canonical_source_url": "https://doi.org/10.3390/electronics10212610",
      "core_contribution": "The paper combines Jaeger distributed traces with LTTng kernel and user-space events and extends critical-path analysis from threads to distributed requests so request latency can be related to low-level scheduling and resource behavior.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "observability",
        "lttng"
      ],
      "keywords": [
        "distributed tracing",
        "kernel tracing",
        "cloud applications",
        "cross-layer performance analysis",
        "LTTng",
        "Jaeger",
        "Trace Compass",
        "Babeltrace",
        "Common Trace Format",
        "HotROD",
        "Cassandra",
        "Apache ab",
        "cassandra-stress",
        "critical-path analysis",
        "snapshot tracing",
        "CPU control groups",
        "liblttng-ust",
        "request synchronization"
      ]
    },
    {
      "paper_id": "distributed-architecture-for-an-integrated-development-environment-large-trace-analysis-and-visu",
      "title": "Distributed Architecture for an Integrated Development Environment, Large Trace Analysis, and Visualization",
      "year": 2021,
      "authors": [
        "Yonni Chen Kuang Piao",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/distributed-architecture-for-an-integrated-development-environment-large-trace-analysis-and-visu/",
      "canonical_source_url": "https://doi.org/10.3390/s21165560",
      "core_contribution": "The paper presents a modular client-server architecture for large-trace storage, analysis, and visualization inside an integrated development environment.",
      "tags": [
        "system-tracing",
        "trace-analysis",
        "observability",
        "performance-optimization",
        "multicore-systems"
      ],
      "keywords": [
        "distributed architecture",
        "Trace Compass",
        "TraceScape",
        "LTTng 2.10.3",
        "Trace Analysis Server Protocol",
        "TASP",
        "Protobuf",
        "GZip JSON",
        "large traces",
        "state models",
        "trace visualization",
        "PixiJS",
        "Chart.js",
        "HighCharts"
      ]
    },
    {
      "paper_id": "malware-system-calls-detection-using-hybrid-system",
      "title": "Malware System Calls Detection Using Hybrid System",
      "year": 2021,
      "authors": [
        "Yue Guan",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/malware-system-calls-detection-using-hybrid-system/",
      "canonical_source_url": "https://doi.org/10.1109/SysCon48628.2021.9447094",
      "core_contribution": "The paper combines LTTng system-call monitoring with recurrent and Transformer-style models for malware and anomalous system-behavior detection.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "anomaly-detection",
        "machine-learning",
        "observability"
      ],
      "keywords": [
        "malware detection",
        "system-call analysis",
        "LTTng",
        "Trace Compass",
        "LSTM",
        "Transformer",
        "multi-head attention",
        "PyTorch",
        "Linux VMs",
        "sequence classification",
        "precision",
        "recall",
        "unknown attacks"
      ]
    },
    {
      "paper_id": "multi-level-host-based-intrusion-detection-system-for-internet-of-things",
      "title": "Multi-level Host-based Intrusion Detection System for Internet of Things",
      "year": 2020,
      "authors": [
        "Robin Gassais",
        "Naser Ezzati-Jivan",
        "Jose M. Fernandez",
        "Daniel Aloise",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/multi-level-host-based-intrusion-detection-system-for-internet-of-things/",
      "canonical_source_url": "https://doi.org/10.1186/s13677-020-00206-6",
      "core_contribution": "The paper combines host-level user/kernel tracing with machine learning to detect intrusion behavior on constrained IoT and home-automation systems.",
      "tags": [
        "iot-security",
        "kernel-tracing",
        "machine-learning",
        "anomaly-detection",
        "lttng",
        "observability"
      ],
      "keywords": [
        "IoT intrusion detection",
        "host-based IDS",
        "LTTng",
        "barectf",
        "Common Trace Format",
        "Babeltrace",
        "Raspberry Pi 3",
        "Home Assistant",
        "Decision Tree",
        "Random Forest",
        "Gradient Boosted Trees",
        "SVM",
        "MLP",
        "LSTM",
        "Mirai",
        "ransomware",
        "CPU overhead",
        "memory overhead"
      ]
    },
    {
      "paper_id": "efficient-cloud-tracing-levels",
      "title": "Efficient cloud tracing: From very high level to very low level",
      "year": 2018,
      "authors": [
        "Yves J. Bationo",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/efficient-cloud-tracing-levels/",
      "canonical_source_url": "https://doi.org/10.1109/ICCE.2018.8326353",
      "core_contribution": "The paper correlates OpenStack Nova, QEMU/KVM, and host/guest kernel evidence to diagnose live-migration behavior across cloud-system layers.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "observability"
      ],
      "keywords": [
        "cloud tracing",
        "high-level tracing",
        "low-level tracing",
        "cross-layer observability",
        "OpenStack Nova",
        "QEMU",
        "KVM",
        "Trace Compass",
        "live migration"
      ]
    },
    {
      "paper_id": "intrusion-response-systems-survey-taxonomy",
      "title": "Intrusion Response Systems: Survey and Taxonomy",
      "year": 2012,
      "authors": [
        "Alireza Shameli-Sendi",
        "Naser Ezzati-Jivan",
        "Masoume Jabbarifar",
        "Michel Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/intrusion-response-systems-survey-taxonomy/",
      "canonical_source_url": "https://publications.polymtl.ca/14629/",
      "core_contribution": "This survey organizes intrusion-response systems around automation, response cost, decision evaluation, adjustment, execution, attack paths, and risk assessment.",
      "tags": [
        "anomaly-detection",
        "root-cause-analysis",
        "observability"
      ],
      "keywords": [
        "intrusion response systems",
        "response cost",
        "automated response",
        "NIDS",
        "HIDS",
        "IDMEF",
        "adaptive response",
        "retroactive response",
        "attack paths",
        "risk assessment"
      ]
    },
    {
      "paper_id": "a-reliable-and-efficient-time-synchronization-protocol-for-heterogeneous-wireless-sensor-network",
      "title": "A Reliable and Efficient Time Synchronization Protocol for Heterogeneous Wireless Sensor Network",
      "year": 2010,
      "authors": [
        "Masoume Jabbarifar",
        "Alireza Shameli-Sendi",
        "Alireza Sadighian",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/a-reliable-and-efficient-time-synchronization-protocol-for-heterogeneous-wireless-sensor-network/",
      "canonical_source_url": "https://doi.org/10.4236/wsn.2010.212109",
      "core_contribution": "The paper proposes L-SYNCng, a time-synchronization protocol for heterogeneous wireless sensor networks that combines topology-aware clustering with convex-hull clock estimation.",
      "tags": [
        "performance-analysis",
        "resource-analysis",
        "observability"
      ],
      "keywords": [
        "wireless sensor networks",
        "time synchronization",
        "L-SYNCng",
        "convex hull",
        "clock drift",
        "NS-2.31",
        "heterogeneous topology",
        "clock offset",
        "clock skew"
      ]
    }
  ]
}