Abstract
Root cause analysis (RCA) has become urgent in AIOps because modern incidents rarely stay inside one component: failures propagate across services and operators must identify the initiating service, not only the loudest symptom. Prior log analytics studies have mainly emphasized parsing and anomaly detection, while recent microservice RCA benchmarks have focused on service localization with multimodal telemetry. This paper studies a narrower and practical question: how far can correlation-driven RCA go when only multi-service logs and their event templates are used? We present a template-aware correlation-graph framework that converts raw logs into service-template events, learns directed lagged edges, and ranks root-cause candidates using direct anomaly evidence, one-step edge attribution, and reverse personalized PageRank. Experiments are conducted on the complete LogHub Hadoop logs and the RCAEval RE2-SS Sock Shop data. The Hadoop corpus contains 394,310 raw log lines, 55 applications, and 44 labeled abnormal applications. RE2-SS contains 90 fault cases, five root services, six fault types, and 7,566,220 log rows. On RE2-SS, the proposed HybridRCA reaches 0.267 Top-1, 0.456 Top-3, and 0.435 MRR for service-level root localization, improving Top-1 and MRR over frequency-only ranking. A metric-only reference reaches 0.578 Top-1, showing that log-only RCA remains limited for resource faults whose strongest symptoms appear in metrics rather than logs. The results support correlation graphs as useful diagnostic evidence while clarifying the unresolved weakness of log-only RCA in multimodal microservice incidents.