Introduction
When a critical production service goes down, time is everything. In modern microservice architectures, Site Reliability Engineers (SREs) are flooded with fragmented logs, alerts, and metrics. Digging through dozens of microservices, databases, and recent commits to identify the actual root cause inflates Mean Time to Resolution (MTTR) and costs businesses thousands of dollars per minute.
To solve this, we built FalkorMind — a single-page SRE observability console that combines FalkorDB knowledge graphs with a multi-agent AI pipeline to automatically trace incidents and visualize root causes in real time.
The Problem: Unstructured Logs vs. Infrastructure Topology
Most traditional AI RCA tools feed raw log streams directly into an LLM. This approach suffers from two major flaws:
Context Blindness: LLMs struggle to understand complex service dependency trees from text logs alone.
Hallucination: Without deterministic topology ground truth, AI models frequently guess the wrong failing component.
Root Cause Analysis is fundamentally a graph traversal problem. An incident starts at a specific node (e.g., a faulty commit) and propagates through directed dependencies (AFFECTS, DEPENDS_ON) until a terminal service fails.
Why FalkorDB?
We chose FalkorDB as the backbone of FalkorMind for three key technical reasons:
Cypher Query Expressiveness: FalkorDB supports native Cypher queries, making it effortless to express and traverse multi-hop dependency patterns across CodeCommit, Microservice, Database, and APIRoute nodes.
Low Latency Graph Queries: High-speed graph queries allow us to serve real-time subgraph data directly to our interactive Cytoscape.js canvas.
Agentic Graph RAG: Instead of passing thousands of irrelevant log lines to LLMs, our agents query FalkorDB to extract only the exact subgraph evidence needed for deterministic reasoning.
How FalkorMind Works: Architecture & Multi-Agent Pipeline
FalkorMind pairs a FastAPI backend with a React + Tailwind CSS frontend powered by Cytoscape.js.
- Multi-Agent Reasoning Pipeline Our orchestration workflow breaks RCA into three specialized sequential agents:
🧠 Memory Agent: Scans historical incident session memory to detect recurring anomaly patterns.
🔍 Investigator Agent: Executes Cypher queries against FalkorDB to trace downstream execution paths from the failing entry point.
📝 Explainer Agent: Synthesizes graph traces into human-readable root cause explanations and step-by-step remediation actions.
- High-Impact Observability Dashboard Interactive Cytoscape Canvas: Real-time visual canvas displaying active nodes, hop arrows, and dependency directions.
Glowing Root Cause Highlighting: Critical origin nodes pulse with a dynamic red glow halo for immediate visual focus.
Resilient Dual-Mode Architecture: Connects to live FalkorDB instances via MCP, with an automatic deterministic mock fallback if offline.
Clickable Visited Node Chips: SREs can click node chips in the diagnosis summary to smoothly pan and zoom the graph canvas directly onto that component.
Key Learnings & Takeaways
Graphs + LLMs = Deterministic AI: Combining LLMs with structured knowledge graphs eliminates hallucinations and produces audit-ready evidence traces.
Resilience Matters in SRE Tools: Observability dashboards must never crash. Building a dual-mode system (Live Graph + Mock Fallback) ensured high reliability for our workbench.
FalkorDB is Ideal for Knowledge Graphs: Cypher query simplicity coupled with FalkorDB's speed allowed us to build an end-to-end RCA graph prototype in days rather than weeks.
Conclusion
FalkorMind demonstrates how graph database technology can transform incident response from manual firefighting into automated, visual intelligence.
Check out our repository and try FalkorMind today:
👉 GitHub Repository: github.com/shivamkumar9811/falkordb-rca-workbench
Built for the FalkorDB Hackathon.
Top comments (1)
Good project