Modern cloud services increasingly adopt microservice architectures to enable independent development, deployment, and elastic scaling (Dragoni et al., 2017; Newman, 2021). In mission-critical domains such as power grid dispatching, cloud-native transformations have been actively explored to improve system scalability and operational efficiency (Liang et al., 2016; Wen et al., 2016). A single user request typically traverses multiple services and middleware components, forming a dynamic call graph (Gan et al., 2019). When a service experiences resource shortages, queue buildup, lock contention, garbage collection pauses, or downstream degradation, latency and errors can propagate along dependencies, manifesting as tail-latency spikes and SLO violations (Wu et al., 2020; Yu et al., 2021). This is especially relevant to latency-sensitive real-time interactive services such as cloud-hosted mobile online games (Meiländer et al., 2014). Traditional alerting based on single-metric thresholds often lags behind these cascading behaviors (Notaro et al., 2021).

Distributed tracing provides request-centric observability by recording traces and spans that capture the execution path and timing across services (Sigelman et al., 2010). Tracing has been widely used for diagnosis and root-cause analysis (Wu et al., 2020; Yu et al., 2021), but it can also support proactive operations (Grohmann et al., 2021). In proactive SLO management, the goal is to forecast risk before user impact becomes visible, ideally while a request is still in-flight (trace prefix). Such forecasts are most valuable when they arrive early enough to enable mitigation and are accompanied by actionable signals, such as likely bottleneck services or predicted benefits of interventions. Beyond compute-side mitigation, network-side control (e.g., SDN-enabled QoS enforcement/traffic steering) provides additional actionable knobs that can complement early-warning predictors (Gorlatch et al., 2014).

Service level objectives (SLOs) are central in site reliability engineering (SRE) as explicit targets for availability and latency (Beyer et al., 2016). The operational motivation for proactive prediction is closely related to tail behavior - when requests fan out across many microservices, the slowest component often dominates the end-to-end latency distribution (“tail at scale”) (Dean and Barroso, 2013). Although microservices improve modularity and independent deployment, they also multiply dependencies and complicate performance debugging and capacity planning (Dragoni et al., 2017).

The remainder of this mini-review is organized as follows. Section 2 introduces tracing primitives, prefix definitions, and multimodal observability. Section 3 formalizes prediction tasks and evaluation protocols. Section 4 surveys modeling approaches from feature-based baselines to graph neural networks and causal extensions. Section 5 surveys public benchmarks and datasets. Section 6 discusses open challenges toward deployable proactive SLO management.

A trace represents a single end-to-end request, while a span represents a timed operation within a service or component. Spans are linked by parent-child or caller-callee relations (Sigelman et al., 2010). Traces can be projected into call graphs whose nodes and edges carry attributes such as service identity, latency, retries, and error codes.

Proactive settings introduce an online constraint: at inference time, only a partial trace prefix is observable. This distinguishes proactive SLO management from post-hoc diagnosis, where complete traces are available. Prefixes may be defined by elapsed wall-clock time, the number of observed spans, or the depth of topological expansion from the root span. Concurrent branches often complicate the notion of “progress,” since multiple spans may execute in parallel without a natural ordering. Modeling, therefore, requires explicit decisions on prefix ordering, time encoding, and how to represent partially observed subtrees.

Traces alone may miss important context. Metrics often reflect resource and saturation signals (CPU throttling, garbage collection, network congestion), and logs contain semantic clues (exceptions, error messages). Recent work increasingly treats proactive SLO management as a multimodal problem, aligning trace, metric, and log signals at request or service granularity (Zhao et al., 2023). In practice, data quality issues are common: head-based or tail-based sampling can drop intermediate spans, context propagation bugs can break trace continuity, and duplicated caller/callee instrumentation can bias edge statistics. Robust preprocessing and reporting of data cleaning choices are crucial for reproducibility (Huye et al., 2024).

Most modern tracing deployments rely on standardized instrumentation and context propagation. OpenTelemetry provides cross-language APIs/SDKs and a vendor-neutral specification that has become a de facto industry standard (OpenTelemetry, 2025). In production AIOps pipelines, traces are often fused with logs and metrics; classic log-analysis studies highlight both the value and the pitfalls of relying on noisy operational data (He et al., 2016; Du et al., 2017).

Proactive SLO management can be viewed as a family of prediction and decision-support tasks. Common formulations include: (i) SLO violation prediction (binary classification), (ii) tail latency/quantile prediction (regression), (iii) prefix early warning (when to alert), and (iv) actionable intermediate outputs such as bottleneck ranking and what-if estimation. Table 1 summarizes these tasks along with recommended evaluation metrics and representative systems.

SLO violation and latency prediction: SLO violation labels are often unavailable in public traces. Therefore, many studies define proxy violation labels using latency-threshold rules (e.g., based on p95/p99) computed from historical data. This proxy-vs-real-SLO gap should be made explicit because real SLOs may depend on API endpoint, customer tier, time window, and composite indicators. For binary classification, PR-AUC is preferred over ROC-AUC due to class imbalance. Calibration error (Guo et al., 2017) should also be reported since early warning systems require well-calibrated probabilities. For quantile/latency regression, pinball loss directly measures quantile accuracy, while relative error metrics capture prediction quality across different latency scales.

Prefix early warning: A key operational requirement for early warning is to control false alarms while maximizing detection earliness. One practical evaluation protocol adapted from early time-series classification literature (Xing et al., 2012; Schäfer and Leser, 2020; Bilski and Jastrzębska, 2023) is to select an alert threshold on a validation set such that Precision≥P₀ (e.g., 0.90 or 0.95), then report metrics on a held-out test set. These include: (a) Earliest Alarm Ratio (EAR), the average minimal prefix fraction at which a true-violation request triggers an alert; (b) Coverage, the fraction of violating requests that are successfully alerted; and (c) False Alarm Rate (FAR), the fraction of non-violating requests that trigger an alert. This protocol is consistent with cost-sensitive thresholding and captures the “earliness-accuracy” trade-off central to proactive prediction. While SLO violation prediction and bottleneck ranking have received substantial attention, work on prefix-based early warning with explicit earliness evaluation remains relatively limited in the microservices literature.

Bottleneck localization and root-cause analysis: Beyond forecasting SLO violation risk, trace data are widely used to localize bottlenecks and root causes. Systems such as MicroRCA (Wu et al., 2020) and MicroRank (Yu et al., 2021) analyze propagation patterns across microservices to rank likely culprits, while critical-path analysis frameworks like CRISP (Zhang et al., 2022) summarize large volumes of traces into actionable performance explanations. These diagnosis-oriented tasks are complementary to early warning, since a practical proactive controller often needs both “will we violate” and “where should we intervene” signals.

What-if estimation: What-if estimation extends bottleneck ranking by quantifying the expected improvement from specific interventions. Given a predicted SLO violation, what-if models answer questions such as: “If we scale Service A from 2 to 4 replicas, by how much will end-to-end latency decrease?” or “If we reroute 20% of traffic away from Region B, what is the probability of meeting SLO?” Sage (Gan et al., 2021) solves this through counterfactual generation: the system generates hypothetical scenarios where a candidate service's resource utilization is set to “healthy” values, then predicts the resulting end-to-end latency using a learned generative model. If the counterfactual latency meets SLO, the intervention is deemed effective. Evaluation of what-if estimation typically uses metrics such as intervention error (the difference between predicted and actual post-intervention latency) or decision accuracy (whether the recommended intervention actually resolves the SLO violation when applied). Because ground-truth intervention outcomes are expensive to obtain, which requires either production experiments or high-fidelity simulation, evaluation datasets for what-if estimation remain scarce, and most published results rely on controlled testbeds or synthetic fault injection.

Feature-based baselines: Gradient-boosted trees such as XGBoost, LightGBM, and CatBoost remain strong in practice because they are easy to train, efficient at inference, and amenable to probability calibration (Chen and Guestrin, 2016; Ke et al., 2017; Prokhorenkova et al., 2018). However, handcrafted aggregates may miss fine-grained dependency structure and temporal evolution.

Sequence models: Sequence models treat spans as event tokens and are naturally aligned with prefix prediction. Recurrent units such as LSTM and GRU provide efficient prefix encoders (Hochreiter and Schmidhuber, 1997; Cho et al., 2014), while Transformer-style attention offers flexible modeling of long-range dependencies and irregular events (Vaswani et al., 2017). Temporal convolutional networks provide a convolutional alternative for generic sequence modeling (Bai et al., 2018), while long-horizon Transformer variants target long sequence time-series forecasting (Zhou et al., 2021a). However, all sequence approaches must address long traces, concurrent branches that violate strict sequential assumptions, and appropriate position/time encoding.

Graph neural networks: Graph neural networks explicitly model service dependencies and can support explanation via node/edge importance. Building on general GNN primitives such as graph convolutions, neighborhood aggregation, and graph attention (Kipf and Welling, 2017; Hamilton et al., 2017; Veliĉković et al., 2017), they are well-suited for bottleneck ranking and resource decision support, including proactive auto-scaling (Park et al., 2021, 2024; Meng et al., 2023). Challenges include over-smoothing on deep call chains, missing edges due to sampling, and topology drift caused by deployments and elastic scaling.

Hybrid sequence-graph models: Hybrid models aim to combine temporal evolution and topology. A prominent design pattern is the dual-encoder architecture: one encoder (typically GNN-based) captures call-graph structure, while another (LSTM, GRU, or Transformer) models temporal dynamics. The two representations are then fused via gating, attention, or concatenation. TraceGra exemplifies this approach by using a GNN to extract topological features from a unified trace-and-metric graph representation and an LSTM to capture temporal patterns, combining them through an encoder–decoder framework for anomaly detection (Chen et al., 2022). TopoMAD modifies LSTM cells with additional GNN gates to jointly model spatial dependencies among microservices and temporal evolution of metrics (He et al., 2023). More recently, USRFNet introduced a dual-stream architecture that explicitly separates traffic-side features (modeled by GNN) from resource-side features (modeled by gated MLP), then fuses them via cross-diffusion attention and low-rank fusion to predict window-level p95 latency (Qian et al., 2025). These hybrid designs address the limitations of single-representation models, where pure sequence models ignore graph structure, while pure GNN models may homogenize heterogeneous feature types through uniform message passing.

Structural latency predictors and multimodal extensions: Recent latency predictors introduce structural inductive bias over PERT-like decompositions to improve both accuracy and interpretability (Tam et al., 2023, 2025). Multimodal extensions further align trace graphs with metrics and logs (Zhao et al., 2023), improving robustness when any single modality is incomplete.

Causal and counterfactual approaches: Causal methods are increasingly explored for actionable prediction. Rather than only estimating SLO violation risk, the goal is to estimate the effect of hypothetical interventions, such as scaling a specific service or rerouting traffic on end-to-end latency outcomes. Sage introduces a causal Bayesian network combined with a graphical variational auto-encoder to generate counterfactual latency scenarios (Gan et al., 2021). Given an observed SLO violation, Sage hypothetically “fixes” the utilization of candidate services to normal values and predicts whether SLO would be met (restored), thereby identifying root causes through counterfactual reasoning rather than correlation. Lohse et al. (2025) proposed a causal discovery framework that reconstructs the latency DAG of microservice architectures using domain knowledge and causal discovery algorithms, enabling identification of actionable intervention targets that causally influence high latency. However, causal estimation faces significant challenges: shared resources (CPU, network bandwidth, memory) introduce confounding, opportunities for randomized experiments are limited in production, and observational data alone cannot distinguish correlation from causation without strong structural assumptions. Current practical systems often combine structured causal models with small-scale online validation (A/B tests, canary deployments) to verify predicted intervention effects before broad rollout.

Reproducible evaluation requires both controllable benchmarks and representative traces. DeathStarBench provides open-source microservice applications with configurable workloads and fault injection via external tools, enabling controlled studies of tail latency and cascading slowdowns (Gan et al., 2019). Other benchmarks, such as Train-Ticket (Zhou et al., 2021b) and SockShop (Weaveworks, 2023), are also used in the literature, though DeathStarBench remains the most widely adopted for SLO-focused studies. Large-scale public traces, such as Alibaba microservice call graphs, enable learning from realistic production dynamics (Luo et al., 2021, 2022), but often require significant preprocessing, including deduplication, missing-span handling, and topology repair. Huye (Huye et al., 2024) systematically documents topological inconsistencies in the Alibaba traces and introduces Casper, a method that recovers significantly more valid traces by leveraging dataset redundancies. Because SLO violations are rare events, most datasets exhibit extreme class imbalance, and reported results can be sensitive to sampling strategies, time splits, and proxy label definitions. Reporting dataset statistics like trace volume, span depth distribution, violation rate, and sampling rate, and releasing the preprocessing code are critical to meaningful comparisons.

Beyond class imbalance, two data-quality issues recur across public traces. First, sampling-induced missing spans: production tracing systems typically employ head-based or tail-based sampling to reduce overhead, which can drop intermediate spans and break parent-child relationships. Models trained on complete traces may not generalize to sampled data; evaluation protocols should therefore report sampling rates and assess robustness to incomplete call graphs. Second, topology drift: microservice deployments evolve through canary releases, auto-scaling, and service mesh reconfigurations, so traces collected months apart may reflect different call-graph structures. Models assuming static topology risk silent degradation; benchmarks ideally should include temporal metadata to enable drift-aware evaluation.

Outside microservice-specific benchmarks, large-scale cluster traces are often used to evaluate workload prediction and resource management components underpinning SLO control. Google has released Borg cluster-usage traces and corresponding analyses (Reiss et al., 2012; Tirmazi et al., 2020). Microsoft has released Azure workload traces and telemetry through the AzurePublicDataset and Resource Central projects (Cortez et al., 2017). These datasets complement microservice benchmarks by providing realistic resource-demand dynamics, although they generally lack request-level call graphs. A summary is shown in Table 2.

Several gaps remain between research prototypes and deployable proactive SLO management. We organize the discussion around three themes: (A) evaluation gaps and label semantics, (B–C) operational integration and scalability/efficiency, and (D) the path from correlation to action. Then, (E) concludes with an outlook.