Explaining Performance Issues of Cloud Applications From Logs Using Rule Induction and Dempster–Shafer Theory

This study focuses on the explainability of AI operations for diagnosing degradations in cloud applications. Log data can provide essential contextual information on misbehaving applications in monitoring, evaluated against a key performance indicator (KPI). We describe an approach to learning conditions that lead to unacceptable KPI states using tree-based and rule-induction algorithms, including a rule-validation framework based on the Dempster-Shafer theory of evidence. The latter also provides a “what-if” analysis mechanism to test user or expert hypotheses about the application’s performance. These algorithms produce specific rules that explain anomalous behavior as disturbances in log event-type distributions. Event types (clusters of similar log messages) significantly reduce log volume and enable efficient analytics (e.g., anomaly and change detection) on these structures. Our methods infer event types exhibiting frequency imbalances, which can degrade application performance, and then trace those types back to raw log messages for complete interpretation and root-cause analysis (RCA). We present experimental insights from Elastic Sky X Integrated (ESXi) hosts in a private cloud environment that demonstrate the viability of the proposed framework for explainable cloud administration. The framework combines time-series data with unstructured event-log data collected from data-center resources. Experimental validation across three distinct failure scenarios (compute thrashing, network congestion, and storage saturation) demonstrated the model’s robustness. The approach achieved a true positive rate of 98% for compute anomalies, 97% for network failures, and 99% for storage bottlenecks. Compared to traditional threshold-based monitoring, the proposed method significantly reduces false positives by distinguishing benign high-latency states from true system failures. In particular, event-log-only models achieved low recall (0.118), while the proposed multimodal fusion substantially improved detection performance and interpretability.