Definition
Automated root cause analysis (automated RCA) is the use of software to identify the underlying cause of a production incident by correlating symptoms with system state, configuration changes and dependencies, and producing an explanation with supporting evidence. It replaces or shortens the manual investigation an engineer would otherwise do.
Explanation
Manual RCA is slow because the evidence is scattered. The symptom is in a metric, the cause is in a change made somewhere else minutes earlier, and the link between them is a dependency nobody wrote down. Automated RCA reads three things together: the current and desired state of the system, the change history (what was deployed, edited or scaled, and when), and the topology (what depends on what). It ranks candidate causes and attaches evidence to each, such as the diff that preceded the failure or the log line that names the failing dependency. Good automated RCA states its confidence and shows the evidence chain, so an engineer can check it in seconds. Alert correlation is a different thing: it groups related alerts but does not explain them.
How DataAgent approaches it
DataAgent explains the root cause of each incident in plain language within seconds of detection, with the metrics, node conditions and related incidents behind it, and lets the engineer ask follow-up questions per incident. It looks at what changed, not only what broke. Diagnosis runs over the topology of the application and its infrastructure, their configuration and drift history, and the output is an evidence chain the engineer can check before any fix runs.
Example
p99 latency on the API doubles at 14:32. Automated RCA finds a config edit at 14:29 that lowered the connection-pool size on the downstream auth service, shows that the API depends on auth, and shows auth’s queue depth climbing from 14:30. Ranked cause: the pool change. Evidence: the diff, the dependency, the queue metric. Proposed fix: revert the key.
Related terms
- Change correlation
- Topology
- Evidence chain
- Alert correlation
- Incident remediation
- Configuration drift
FAQ
- How is automated RCA different from anomaly detection?
- Anomaly detection tells you that a metric is unusual. RCA tells you why. Detection is an input to RCA, not a substitute.
- Does automated RCA need logs, metrics and traces?
- It needs symptoms, which can come from any of them. The cause, though, is usually in state and change data: deployments, config edits, scaling events, cloud resource changes. Telemetry without change history leaves the hardest part to the engineer.
- Can automated RCA be wrong?
- Yes. That is why the output should include evidence and a confidence level, and why a fix derived from it should be dry-run and verified rather than applied blindly.