一句话：提出 AlarmClaw，用有界上下文抓取与类别/严重度感知事件图约束 LLM 告警关联决策。
生产系统告警管理需在线判断到达告警是噪声、新事件还是关联已有事件。现有方法依赖 SOP、历史原型等可复用运维工件，或对事件统一套用图拓扑传播模式，但生产环境中这些工件常缺失或服务特定，且有效传播路径随事件类别与严重度变化。AlarmClaw 用有界上下文抓取从可审计运维源检索紧凑证据，并用类别与严重度感知事件图约束 LLM 决策 agent，还通过演化机制从已验证结果刷新上下文与图证据。在 51,000 条告警、9,661 个事件的生产语料时序留出回放上，关联 Precision 86.0%、Recall 78.5%，F1 较最强适配基线提升 7.4 点；六个月在线运行中演化更新再提升 F1 2.3 点，自动关联超 4,800 条告警，单告警操作从约 90 秒降至 10 秒内。
Large-scale production systems rely on monitoring rules and anomaly detectors to trigger alarms that notify site reliability engineers (SREs) of potential failures. Before diagnosis and mitigation can begin, alarm management must construct incident state online by deciding whether each arriving alarm is noise, indicates a potential new incident, or should be associated with an existing incident to enrich its evolving state. Existing alarm-management methods remain difficult to deploy because some rely on reusable operational artifacts such as SOPs or historical prototypes to judge alarm relationships, while graph-based methods often apply the same topology-derived propagation patterns across incidents. In production, such artifacts are often missing or service-specific, and valid propagation paths vary with incident type and severity. We present AlarmClaw, a context-enriched alarm-management system built around these two constraints. AlarmClaw uses bounded context clawing to retrieve compact evidence from auditable operational sources and a category- and severity-aware incident graph to constrain a large language model (LLM) decision agent. An evolution mechanism refreshes reusable context and graph evidence from validated outcomes. On a temporally held-out replay from a production corpus of 51,000 alarms and 9,661 incidents, AlarmClaw achieves 86.0% association Precision and 78.5% Recall, improving F1 by 7.4 points over the strongest adapted baseline. During six months of online operation, evolution updates improve F1 by 2.3 points over a matched fixed-knowledge counterfactual. From January to June 2026, AlarmClaw automatically associated more than 4,800 alarms, conservatively saving at least 4,800 engineer-minutes and reducing the per-alarm association operation from approximately 90 s manually to under 10 s.
@inproceedings{paperbot12336,
title = {AlarmClaw: Context-Enriched Alarm Management with Category-/Severity-Aware Incident Graphs},
author = {Siyu Yu and Meizhen Li and Jiacheng Yang and Yifan Wu and Ning Wang and Zhaoxing Chen and Ming Liu and Xinchi Ren and Xincheng Ren and Chan Li and Tong Jia and Xiang Zhang and Ying Li},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834524}
}