This article introduces Alibaba Cloud's Operation Intelligence, an AI-native O&M paradigm shift from visibility to decisive action.
In the AI-native era, the complexity of digital systems far exceeds human intuition. While AI inference performs thousands of calls in milliseconds and microservices dependencies rival the complexity of neural networks, traditional monitoring remains stuck in a reactive "recording state." Manual troubleshooting takes hours, leaving enterprises to react to business risks after the fact. Enterprises need more than monitoring tools; they need systems with autonomous decision-making capabilities. This requires a shift from passive monitoring to holistic observability, culminating in a new paradigm of proactive, decisive O&M. Alibaba Cloud's Operation Intelligence empowers systems with human-like decision-making through three key elements:
● Enhanced sensing: breaks down data silos inherent in traditional monitoring to create a comprehensive sensing network, achieving end-to-end visibility from terminal devices to business workflows.
● Cognitive leap: integrates large language models (LLMs) and algorithmic operators to transform raw data into interpretable relationship graphs.
● Closed-loop action: leverages LLMs and algorithms to automate remediation, transitioning from reactive "manual firefighting" to proactive "self-healing."
As Norbert Wiener, the father of cybernetics, stated, "The essence of intelligence is the adaptive feedback that a system generates by perceiving its environment and taking action." Operation Intelligence enables this closed-loop of real-time sensing, cognition, and decision-making, granting digital systems human-like dynamic adaptability. Alibaba Cloud's Simple Log Service (SLS) and Cloud Monitor now offer new capabilities to help enterprises build their own Operation Intelligence.
- SLS: Building the Data Foundation and Application Engine for Operation Intelligence Operation Intelligence, the core engine driving business value, relies on efficiently refining, structuring, and processing massive volumes of heterogeneous and noisy operations data. This involves transforming dispersed, isolated, and semantically ambiguous data streams into traceable, analyzable, and actionable high-quality data assets. SLS, as an observability data platform, provides the critical infrastructure for this transformation. SLS not only handles fundamental data ingestion and storage, but also offers end-to-end capabilities across data acquisition, processing, modeling, querying, and analysis through a unified technical architecture. This empowers enterprises to complete the value loop from raw data to intelligent decision-making.
Analyzing Hundreds of Billions of Data Points in Seconds: SLS's Unified Architecture for Storage, Computation, and Semantic Modeling
SLS features a high-performance storage engine purpose-built for massive, heterogeneous data. With native support for time-series data, columnar storage, and vectorized computation, SLS delivers high-density compression and retrieval and analytics within seconds for hundreds of billions of log entries and metrics. When dealing with complex unstructured content such as application logs, user feedback, or error stacks, SLS leverages a vector engine to provide semantic understanding, interpreting key intentions and sentiment within text and effectively "comprehending" the meaning behind human language. By correlating and modeling the behavior of key entities such as users, devices, IP addresses, and services, SLS connects fragmented event records into comprehensive, dynamic behavioral graphs. This creates a contextualized, panoramic view, providing a robust data foundation for further analysis.
SLS also features a high-performance distributed compute engine capable of real-time queries and complex analysis on hundreds of billions of rows of data. The newly introduced fully accurate mode significantly increases the precision and concurrency of SQL tasks, supporting over 1,000 concurrent queries per task and processing hundreds of terabytes of data in a single operation. Combined with automatic materialized views, which continuously update frequently accessed intermediate results in the background, SLS dramatically reduces latency for interactive analysis and dashboard displays in the frontend. This transforms large-scale data analysis from a time-consuming process into an instantly available, everyday operation, empowering O&M, R&D, and business teams with increased responsiveness.
To unify the semantics and unlock the combined value of data from diverse sources and formats, SLS leverages the core modeling capability, UModel, to build standardized data models. UModel maps logs, metrics, traces, and entity data into well-structured "digital twins" with complete attributes and clearly defined relationships, enriching each raw data point with business context and logical meaning. This structured modeling approach not only enhances data interpretability but also provides high-quality input for training and inference in downstream AI models. This enables more accurate anomaly detection, risk prediction, and the discovery of hidden correlations, ultimately supporting more sophisticated automated decision-making.
From Data to Decisions: SPL and Workflow Orchestration Bridge the "Last Mile" of Operation Intelligence
To bridge the last mile in cross-domain analysis, SLS provides a unified query language, Search Processing Language (SPL), which spans multiple data layers including logs, metrics, traces, and entities. SPL ensures syntactic consistency and seamless operation across these layers. Using flexible operators such as extend and join, engineers can easily correlate log content with user profiles, service performance, and traces in a single query in real time, eliminating the data silos that plague traditional troubleshooting. Root cause analysis, which previously required cross-team collaboration and comparisons across multiple platforms, can now be accomplished quickly with a single SPL query. This represents a significant efficiency gain, moving from "data stitching" to "insight generation."
With unified data storage, computation, modeling, and querying capabilities, SLS leverages rule-based and AI-powered intelligent analysis workflows to automate multi-step investigations, mimicking expert troubleshooting processes to rapidly analyze and pinpoint the root cause of complex failures. Whether addressing performance degradation, service interruptions, or security threats, the platform automatically generates a list of probable causes with supporting evidence based on historical baselines, behavioral patterns, and contextual dependencies. This significantly reduces mean time to recovery (MTTR). Alerting mechanisms go beyond static thresholds, incorporating dynamic baselines, trend prediction, and anomaly scoring for more proactive and precise interventions.
- CloudMonitor 2.0: Focusing on AIOps for Faster, More Comprehensive Insights Operation Intelligence plays a crucial role across BizOps, SecOps, and DevOps, providing insights into business health, enabling rapid responses to security threats, and driving continuous optimization of R&D and delivery. CloudMonitor 2.0 focuses on AIOps, deeply integrating logs, metrics, traces, and entity behavior to provide a comprehensive O&M foundation. To address the challenges of the AI-native era, CloudMonitor 2.0 builds a full-stack, AI-driven observability system spanning application, platform, and infrastructure layers, creating a closed loop from data collection to intelligent decision-making.
More Comprehensive Insights: Global Coverage and Unified Semantics
Comprehensive awareness is the foundation of Operation Intelligence. Cloud Monitor 2.0 breaks down the silos between metrics, logs, traces, and events, building a unified data foundation. Efficient data collection and integration are achieved through unified probe management and a centralized "ingestion hub." This allows a single integration point for the same collection type across accounts, regions, and workspaces, enabling bulk resource onboarding and probe reuse for significantly improved management efficiency. Whether monitoring Elastic Compute Service (ECS) instance loads, Kubernetes container status, Prometheus custom metrics, real user monitoring (RUM), application performance monitoring (APM), GPU utilization, remote direct memory access (RDMA) network bandwidth, or Cloud Parallel File Storage (CPFS) storage performance, the system provides real-time data collection and aggregation.
Leveraging UModel, the core modeling capability of Alibaba Cloud's observability platform, Cloud Monitor 2.0 constructs a "unified entity graph." This graph serves as a framework for automatically extracting entities and their relationships from diverse observability data sources, including logs, metrics, traces, events, and changes. The result is a precise, dynamically updated "global map" where every database, application service, container, and even business process has a unique identity and clearly defined upstream and downstream dependencies. UModel consolidates information previously scattered across various monitoring tools into a single knowledge graph, eliminating the need to switch between platforms for troubleshooting. This accelerates fault resolution, significantly reduces root cause analysis time, and directly enables automated remediation. Furthermore, it provides structured, semantically rich data to LLMs, enhancing the accuracy and interpretability of intelligent diagnostics.
Faster Action: From "Manual Troubleshooting" to "Intelligent Automation"
The ultimate goal of Operation Intelligence is autonomous action. Alibaba Cloud's intelligent observability assistant, combined with the UModel entity graph, delivers powerful context awareness and semantic understanding, deeply integrating LLMs into O&M workflows. O&M engineers can use natural language queries like, "Which service had the highest error rate yesterday?" or "Is this slow call related to a code release?" The intelligent observability assistant initiates multi-turn dialogues, generating SQL/PromQL queries and leveraging topological relationships and algorithmic operators to automate the entire analysis process, from data retrieval and anomaly detection to root cause identification. It automatically plans troubleshooting paths: first, pinpointing anomalous entities, then drilling down through dependencies, applying anomaly detection, bottleneck analysis, and comparative analysis algorithms. Finally, it presents the root cause, impacted scope, and executable remediation plans such as rollback, restart, or scaling. Furthermore, it understands the microservices involved in "user order failures" or the resource constraints affecting "model inference latency." Combined with the rich Model Context Protocol (MCP) Server ecosystem and Alibaba Cloud's unified OpenAPI, it facilitates efficient issue resolution and recovery. Algorithm-enhanced observability operators push computation down to the underlying layers, significantly reducing analysis latency and token consumption, enabling real-time insights into hundreds of millions of data points. By unifying data, modeling cognition, and providing an intelligent interface, Cloud Monitor 2.0 advances AIOps to a new paradigm, empowering O&M teams to move from "seeing" to "understanding" and "deciding."
- Continued Commitment to Academic Collaboration and Community Ecosystem: Launching the CnOps Community to Advance the O&M Landscape in China Alongside comprehensive product enhancements, Alibaba Cloud is collaborating with leading universities and institutions, including the Institute of Software, Chinese Academy of Sciences, and Zhejiang University. This collaboration aims to drive intelligent development, testing, O&M, and continuous evolution of cloud-native applications from the academic and industrial perspectives, focusing on improved maintainability, system resilience, and intelligent decision-making. This spans the entire innovation lifecycle, from fundamental technological breakthroughs to platform development and industry applications. Key areas of exploration include:
● Software development: Explore scenario-driven microservices decomposition and intelligent service methodologies. Combine lightweight container deployment with dynamic architecture evaluation models to enable quantitative assessment and adaptive adjustment of system evolvability.
● Resilience assurance: Leverage LLMs for end-to-end test case generation, full-link fault injection analysis, and health status diagnostics, creating a comprehensive resilience enhancement solution for application systems and O&M controllers.
● Intelligent O&M: Utilize multimodal data augmentation and spatiotemporal reasoning models to build robust and generalizable fault prediction capabilities. Combine fine-tuned LLMs, enhanced knowledge graphs, and multi-agent collaboration mechanisms to create an automated decision-making system for complex O&M scenarios.
Building on this collaboration, Alibaba Cloud and the Institute of Software, Chinese Academy of Sciences, jointly launched ChaosBlade-Box 2.0 at this conference. Through topology awareness, automated fault space exploration, and LLM-powered resilience assessment, ChaosBlade-Box 2.0 significantly enhances the visibility, usability, and automation of chaos engineering experiments. This transforms chaos engineering into a comprehensive resilience testing platform, simplifying resilience verification for large-scale microservices systems.
Furthermore, to foster a thriving community and democratize domain expertise, Alibaba Cloud, in partnership with these universities and institutions, launched the CnOps community. CnOps is an open, inclusive, and sharing neutral technical community focused on intelligent O&M and observability. It brings together technical experts, developers, and enthusiasts to discuss, learn, and share best practices and cutting-edge technologies in the O&M domain. More than a knowledge platform, CnOps serves as a "technology hub" for Operation Intelligence, facilitating collaboration on cross-domain technical challenges and driving innovation in the O&M domain. Since its launch, CnOps has attracted over one thousand active, grassroots developers daily, engaging with and learning about observability and intelligent O&M.
Conclusion: Operation Intelligence—Driving Efficiency and Transforming Business Scenarios
The evolution from monitoring to observability has led us to Operation Intelligence. Beyond technological advancements, the value of Operation Intelligence extends from cost optimization and end-to-end efficiency gains for business innovation to a fundamental reshaping of business scenarios, delivering measurable value across R&D, O&M, business, and security management. R&D teams can rapidly pinpoint performance bottlenecks in AI models, accelerating troubleshooting and iteration cycles. O&M teams, freed from alert overload, leverage intelligent aggregation and root cause recommendations to efficiently identify critical issues, reduce MTTR, and shift from reactive "firefighting" to proactive prevention. Business decision-makers gain precise insights into resource utilization and cost distribution across lines-of-business, informing budget planning, resource allocation, and fine-grained operations. For security and compliance, the system supports long-term retention of large-scale logs, sensitive data identification and masking, and access auditing, comprehensively addressing the requirements of highly regulated industries. Through the synergy of SLS and Cloud Monitor 2.0, Alibaba Cloud is building a digital operations hub that drives efficient, stable, and intelligent operations, making complex systems observable, manageable, and optimizable.
SLS not only refines and reshapes the value of operations data but also empowers enterprises to build a self-aware, self-diagnosing, and continuously evolving intelligent operations system. In this system, data transforms from passive records into active resources that drive decision-making, optimize experiences, and ensure stability. With its powerful integration capabilities and advanced intelligence, SLS helps enterprises enhance resilience, unlock potential, and embrace an intelligence-driven next-generation O&M paradigm within increasingly complex digital environments. The release of Cloud Monitor 2.0 marks a new era for observability. It transcends a simple system "dashboard," evolving into a "digital brain" with perception, cognition, and decision-making capabilities. We are progressing from "visibility" to "understanding," from reactive responses to proactive prevention, ultimately achieving self-healing systems, self-optimizing resources, and self-awareness of risks.
From academic partnerships and community ecosystems to product advancements, Operation Intelligence is no longer optional but essential infrastructure for building long-term competitive advantage. Alibaba Cloud continues to invest in data and intelligence, ensuring every computation, every API call, and every innovation is supported by the robust capabilities of Operation Intelligence. As Zhou Qi, head of Alibaba Cloud's Cloud Native Application Platform, stated, "Operation Intelligence isn't the end of O&M, but the beginning of intelligent business. When systems possess the ability to self-perceive, self-decide, and self-evolve, enterprises can transcend the 'black box' of technology, building core competitiveness through data-driven decision-making and intelligent value creation in the AI-native era."
Top comments (0)