Probable Root Cause Analysis (RCA)

  • Release version: Yokohama
  • Updated June 25, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Probable Root Cause Analysis (RCA)

    Probable Root Cause Analysis (RCA) in ServiceNow is designed to help you quickly identify the root causes of alerts, thereby shortening the mean time to repair (MTTR). It leverages existing IT Service Management data—specifically alerts, configuration item (CI) topology, and change requests—to generate a list of probable root causes for issues.

    Show full answer Show less

    Key Features

    • Data Integration: RCA extracts CIs from alerts or alert groups and analyzes their relationships using the CMDB topology.
    • Change Request Correlation: It considers relevant change requests associated with CIs, application services, or installed software within specific time frames to identify potential root causes.
    • Root Cause Scoring: RCA calculates a root cause score based on change requests and alerts related to the “Topology Origin CI” to prioritize probable root causes.
    • Probable Root Causes List: The system displays the top five probable root causes ranked by the score, with explanations detailing how each cause correlates to alerts and change requests.
    • Topology Analysis: For alert groups, RCA identifies upstream CIs that may cause cascading failures and prioritizes changes on these CIs.
    • Software Identification: Uses the cmdbsoftwareinstance table to recognize installed software linked to CIs for comprehensive analysis.
    • Configurability: You can customize RCA behavior, including disabling the feature by setting the system property saanalytics.disableprc to true.

    How It Works

    RCA maps alerts and change requests to CIs and their relationships, then applies a scoring algorithm based on these criteria in priority order:

    1. Change on a CI that originates from topology.
    2. Change on a related CI that originates from topology.
    3. Change on a CI.
    4. Change on a related CI, an application service, or installed software.
    5. Alert on the CI that originates from topology.

    The root cause score determines the order of probable root causes shown to the user.

    Practical Benefits for ServiceNow Customers

    • Accelerates incident resolution by pinpointing likely root causes using comprehensive ITSM data.
    • Provides transparent reasoning behind identified root causes, aiding in faster decision-making and remediation.
    • Enables prioritization of investigations based on topology and change impact, reducing wasted effort.
    • Allows customization and control over RCA settings to fit your organization's needs.
    • Supports complex environments by incorporating CI topology and software relationships in the analysis.

    Shorten the mean time to repair (MTTR) by discovering the root cause of an alert.

    Probable root cause analysis (RCA) provides a list of probable root causes for alerts. This capability uses existing data in IT Service Management to help you determine the root cause of an issue.

    RCA takes three factors into consideration: Alerts, configuration item (CI) topology, and change requests on the CIs. It extracts CIs from alerts or alert groups and analyzes the CI relationships in the CMDB. It then uses a set of configurable filters to consider relevant change requests on the CIs as possible root causes.

    Change requests can be related to a time frame or to a CI, the application service it belongs to, or the software installed on it. For example, a CI must be upgraded or a security patch installed on it. A change request on one CI can affect other CIs.

    RCA maps the alerts and change requests to the CIs. It proceeds to calculate the root cause score, a logical score used for sorting probable root causes. The calculation of this score is based on change requests on CIs, and on alerts on a crucial CI called the Topology Origin CI. The root cause score determines how RCA populates the probable root causes list.

    Figure 1. Probable root cause analysis list

    Probable Root Cause list

    By default, the list shows the five probable root causes with the highest score. It lists the CIs related to each alert, and the reason RCA identified them as probable root causes.

    Each probable root cause includes a reason that explains how RCA correlated the alert with the change request. The reason can indicate that the change request was applied directly to the CI that generated the alert, to a CI in the affected CIs list, to a related CI, to an application service, or to software installed on the CI or related infrastructure. RCA identifies installed software by using the cmdb_software_instance table.

    For alert groups, RCA uses topology analysis to identify upstream CIs that might explain cascading failures in the group. Changes on these topology origin CIs receive higher priority in the probable root cause score.

    Scoring for probable root causes is determined by the following criteria, in the indicated order (lower number = higher priority):

    1. Change on a CI that originates from topology.
    2. Change on a related CI originates from topology.
    3. Change on a CI.
    4. Change on a related CI/change on an application service/change on software.
    5. Alert on the CI that originates from topology.

    To disable the Probable Root Cause Analysis feature, you must create the property sa_analytics.disable_prc and set the value to true. For more information on how to create a property, see Add a system property.