By the endDetermine the event sequence and involved assets, identify the underlying root cause, apply mitigation, then retest.
Find the decision point: Diagnose problems and root causes
Incident analysis determines what happened during an incident, and how and why it happened. Identifying the root cause matters because a root cause can often be traced to a program-level weakness.
Worked example
Work the case in two passes: Diagnose problems and root causes
Restarting a service restores access, but the same failure returns each week.
1
First pass
For each weekly failure, determine the sequence of events and which assets and resources were involved in each event.
2
Second pass
Look past the factors directly involved in each failure to the underlying or systemic cause. A root cause can often be traced to a program-level weakness, such as missing patches or inconsistent configuration settings on similar systems.
Result: The team writes a mitigation recommendation for the root cause, tests it on a comparable system before changing production, and retests after it is implemented.
Try it
Name the first check: Diagnose problems and root causes
Restarting a service restores access, but the same failure returns each week. What do you establish about the failures before you propose a fix?
Hint: Work out what happened in each failure before you ask how and why it happened.
Before changing anything, determine the sequence of events in each weekly failure and which assets were involved in each event, and record what you find. That record is where the search for the underlying root cause starts.
02 / Questions
Answer 4 questions
Choose an answer. The explanation appears after you submit.
Check 1 of 4scenario · medium
A PACS service fails each week, and a restart restores access each time. Which next step best diagnoses the problem?
Diagnosis starts by correlating log data from multiple sources and establishing the sequence of events and the assets involved in each, then analyzing for the underlying or systemic root cause. A scheduled restart hides the failure without finding its cause, a hardware swap assumes a cause before analysis, and logs from one server miss other assets involved in the events.
Check 2 of 4recall · hard
During root-cause analysis of a recurring outage, what should the problem definition record first?
Incident analysis first establishes what happened: the sequence of events and the assets and resources involved in each. Choosing the fix first skips the analysis, the sequence covers every event and not only the last, and root causes are often systemic or program-level weaknesses rather than one person.
Check 3 of 4scenario · easy
Restarting a PACS service restores access, but the same failure returns each week. Which data should the team collect for the root-cause analysis?
Root-cause analysis needs related data from multiple sources for each failure, collected and retained so that its integrity and provenance are preserved. Restart times alone say nothing about the cause, the guidance calls for recording facts and actions as the response happens, and clearing older logs discards evidence that retention policies keep.
Check 4 of 4recall · medium
During root-cause analysis, how should the team treat the factors directly involved in an incident?
The guidance asks the team to identify what was directly or indirectly involved and then analyze for the underlying or systemic root causes. A direct factor is not yet the root cause, root causes are often program-level process weaknesses, and reusing the last fix skips the analysis.
03 / Recall
Answer without looking back
Without looking back, say what a root-cause analysis of a recurring failure establishes, and when the problem counts as closed.
It establishes the sequence of events, the assets involved in each event, and the underlying or systemic root cause behind the direct factors. Write a mitigation for that cause and test it on comparable systems before it reaches production. The problem counts as closed only when the mitigation is implemented and verified, for example by retesting the system.