Glossary · Monitoring

RCA (Root Cause Analysis)

Root cause analysis is a structured method for tracing a failure back to the underlying conditions that allowed it, rather than stopping at the symptom.

Updated October 6, 2026

Root cause analysis (RCA) is the process of investigating why a failure occurred by asking what led to it, and what led to that, until you reach causes you can change. It is commonly part of a postmortem.

Why it matters

Fixing only the visible symptom, for example restarting a crashed process, restores service but leaves the cause in place. RCA aims to find process, design or tooling gaps so the incident does not return. In complex systems there is rarely one cause, so many teams prefer the phrase "contributing factors".

Example

The "five whys" technique:

  1. The site returned 503. Why? The app servers ran out of database connections.
  2. Why? A new query held connections for several seconds.
  3. Why? It lacked an index on a large table.
  4. Why was it released? Query performance was not tested with production-sized data.
  5. Why? There is no staging dataset of realistic size.

Actions: add the index, create a realistic staging dataset, alert on pool saturation.

Common mistakes

  • Settling on "human error". Ask why the system allowed the error.
  • Naming one cause when several factors combined.
  • Skipping evidence and relying on assumptions. Check logs, deploy history and metrics.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · MonitoringMTTR (Mean Time to Recovery)MTTR is the average time it takes to restore service after an incident, measured from failure start to recovery; the letter R is used for several meanings.Guide · MonitoringA Blameless Incident Postmortem Template With a Worked ExampleWrite a blameless incident postmortem that drives real fixes: timeline, root cause vs contributing factors, 5 whys limits, a copy-paste template and an example.10 min readGuide · MonitoringSLA Uptime Calculation: Exclusions, Credits and How to Write OneHow hosting providers calculate SLA uptime, what exclusions and service credits mean in practice, and how agencies should word an SLA they can actually meet.7 min readGlossary · MonitoringBlameless CultureBlameless culture treats incidents as system failures to learn from rather than individual faults to punish, so people report problems openly.Glossary · MonitoringCascading FailureA cascading failure is a chain reaction where one component's failure overloads others, spreading until a small fault becomes a major outage.Guide · MonitoringAlert Fatigue and On-Call Basics for Small TeamsSet severity levels, escalation paths, alert thresholds and runbooks so a small team gets paged for real problems only and still sleeps through the night.8 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.