Probable Root Cause uses an algorithm and user feedback to build a data model to predict which alerts in an incident are the most likely to be causal. Users manually label the alerts in incidents as root causes or symptoms to provide feedback to train the model. Over time, the model can identify the alerts most probable to be the incident root cause. Refer to Provide root cause feedback for more details on labeling alerts.
After users have provided some root cause feedback, new alerts have root cause scores assigned to them. These scores are viewable in the root cause score column on the Alerts tab in the Situation Room. These scores indicate the probability that each alert is the root cause of the incident. Alerts are assigned scores of Low, Medium, or High. Root cause recommendations become more accurate as the data model accumulates more user feedback.
These are the values which determine the root cause probability label:
When the calculated root cause probability is: | The root cause score is: |
|---|---|
≥ 0.7 | High |
> 0.3 and < 0.7 | Medium |
≤ 0.3 | Low |
You can view the score of each alert by hovering over the root cause score on the Recommendations and Alerts tabs in the Situation Room.
 |
The Probable Root Cause model uses the alert description field as a basis for comparing alerts.
You can use the root cause scores on the Recommendations tab in Situation Room to help you determine the probable root cause of an incident
On the Incidents page, select an incident, then click Situation Room.
The Situation Room opens with the Recommendations tab open.
In the list of recommendations, find the Probable Root Cause section.
The first five alerts in the incident with a root cause score of "High" appear in this section.
Note that if users have not yet provided applicable root cause feedback, then this section will not display.
Click the alert that you think is the most likely root cause.
The Situation Room Alerts tab opens, displaying the details for the selected alert.
View the alert details for information to help you track down and resolve the issue.
You can also check the incident for associated resolving steps to help you troubleshoot the incident.
Be sure to add any additional steps or information to the incident comments or resolving steps before you mark it Resolved. See also Review Situation Room recommendations.