root-cause-analysis

Root-cause analysis systematically traces failures by collecting evidence, forming testable hypotheses, and eliminating suspects until the underlying cause emerges. Start by documenting the symptom, gather logs and historical data, propose falsifiable hypotheses, then test and rule out causes methodically.

A symptom is the observed failure or error; the root cause is the underlying condition that triggered it. Root-cause analysis distinguishes between them by testing hypotheses against evidence, ruling out surface-level causes to find what actually broke the system.

Document the failure chain with evidence, generate hypotheses about what went wrong, design experiments to test each one, and eliminate non-causes. Once you isolate the root cause, you can implement targeted fixes that address the origin rather than just the symptom.

Root-cause analysis applies across software, hardware, and operational incidents. The same workflow—evidence gathering, hypothesis formation, and elimination—works for system outages, infrastructure failures, and process breakdowns in any domain.

Gather logs, timestamps, system metrics, configuration changes, and any events preceding the failure. Historical context and evidence from the incident timeline help you form stronger hypotheses and test them against what actually occurred.

Testable, falsifiable hypotheses focus your investigation by defining what evidence would prove or disprove each suspect cause. This prevents endless guessing and ensures you systematically eliminate possibilities until only the root cause remains.