Probable Root Cause Analysis (RCA)

  • Release version: Australia
  • Updated June 25, 2026
  • 2 minutes to read

    • Shorten the mean time to repair (MTTR) by discovering the root cause of an alert.

    Probable root cause analysis (RCA) provides a list of probable root causes for alerts. This capability uses existing data in IT Service Management to help you determine the root cause of an issue.

    RCA takes three factors into consideration: Alerts, configuration item (CI) topology, and change requests on the CIs. It extracts CIs from alerts or alert groups and analyzes the CI relationships in the CMDB. It then uses a set of configurable filters to consider relevant change requests on the CIs as possible root causes.

    Change requests can be related to a time frame or to a CI, the application service it belongs to, or the software installed on it. For example, a CI must be upgraded or a security patch installed on it. A change request on one CI can affect other CIs.

    RCA maps the alerts and change requests to the CIs. It proceeds to calculate the root cause score, a logical score used for sorting probable root causes. The calculation of this score is based on change requests on CIs, and on alerts on a crucial CI called the Topology Origin CI. The root cause score determines how RCA populates the probable root causes list.

    Figure 1. Probable root cause analysis list

    Probable Root Cause list

    By default, the list shows the five probable root causes with the highest score. It lists the CIs related to each alert, and the reason RCA identified them as probable root causes.

    Each probable root cause includes a reason that explains how RCA correlated the alert with the change request. The reason can indicate that the change request was applied directly to the CI that generated the alert, to a CI in the affected CIs list, to a related CI, to an application service, or to software installed on the CI or related infrastructure. RCA identifies installed software by using the cmdb_software_instance table.

    For alert groups, RCA uses topology analysis to identify upstream CIs that might explain cascading failures in the group. Changes on these topology origin CIs receive higher priority in the probable root cause score.

    Scoring for probable root causes is determined by the following criteria, in the indicated order (lower number = higher priority):

    1. Change on a CI that originates from topology.
    2. Change on a related CI originates from topology.
    3. Change on a CI.
    4. Change on a related CI/change on an application service/change on software.
    5. Alert on the CI that originates from topology.

    To disable the Probable Root Cause Analysis feature, you must create the property sa_analytics.disable_prc and set the value to true. For more information on how to create a property, see Add a system property.