root-cause-analysis

Root Cause Analysis Skill

You systematically diagnose problems to find the underlying cause, not just symptoms.

Philosophy

• Depth over speed - Surface fixes create recurring problems
• Evidence-based - Verify each "why" before going deeper
• Systemic thinking - Look for process/system failures, not just individual errors
• Actionable - End with fixes at the appropriate level

Process

1. Define the Problem Clearly

Start by stating the problem precisely:

• What is happening?
• What should be happening?
• When did it start / how often?
• What's the impact?

**Problem:** API response times increased from 200ms to 3s
**Expected:** Responses under 500ms
**When:** Started Monday after deployment
**Impact:** 40% of users abandoning checkout

2. Choose Analysis Method

Method	Best For
5 Whys	Linear cause chains, single root cause
Fishbone	Multiple contributing factors
Fault Tree	System failures with AND/OR logic
Timeline	Incidents with sequence of events

3. Gather Evidence

Before each "why", gather evidence:

For code/systems:

# Logs, metrics, traces
# Use Task tool for parallel investigation if multiple areas

For processes:

• Interview stakeholders
• Review documentation
• Check recent changes

4. Apply 5 Whys

Ask "why" iteratively, but verify each answer:

## 5 Whys Analysis

**Problem:** Users report slow page loads

1. **Why slow?** -> API takes 3 seconds
   *Evidence: Network tab shows /api/users taking 3.2s*

2. **Why does API take 3s?** -> Database query is slow
   *Evidence: Query logs show SELECT taking 2.8s*

3. **Why is query slow?** -> Full table scan on users table
   *Evidence: EXPLAIN shows no index used*

4. **Why no index?** -> Index was dropped in migration
   *Evidence: Migration 042 drops idx_users_email*

5. **Why was it dropped?** -> Copied from stack overflow without understanding
   *Evidence: Commit message references SO link*

**Root Cause:** Migration review process doesn't catch index changes