2026 ASIAN Conference on Communication and Networks (ASIANComNet 2026)

Automated incident investigation requires not only anomaly detection but structured root cause analysis (RCA), calibrated confidence, and an auditable trail. We present GoalLog, a goal-directed agent that organizes the investigation as a deterministic four-state machine (detect, collect, diagnose, remedy) and fuses LLM, statistical and BM25 retrieval evidence into root-cause beliefs using Dempster–Shafer theory with an explicit ignorance mass. On 200 HDFS incidents it detects at a 1.4% false positive rate at 97% recall, against 75–86% for our reimplementations of ungated single-turn LLM approaches, and is far better calibrated (ECE 0.183 vs. 0.49–0.52). Our main result, however, is negative and we report it in full: on both corpora top-1 RCA accuracy is carried by retrieval alone. TF- IDF + logistic regression reaches 99.0% on HDFS because that taxonomy is induced from event codes the classifier reads directly, so HDFS cannot evaluate this class of system; and on BGL, whose alert categories operators wrote independently of our features, a nearest-neighbour label transfer over the same BM25 index, with no LLM call, reaches 90.0% against the pipeline’s 89.5%. What the fusion adds at equal accuracy is confidence: the ignorance mass cuts BGL calibration error from 0.098 to 0.030 and supports abstention at an absolute threshold, which no accuracy-matched baseline provides.

log analysis,incident investigation,root cause analysis,LLM agent,Dempster–Shafer theory,anomaly detection