Tracing Root Causes
Quick Start
- Identify Symptom - Document the observable problem
- Gather Evidence - Collect logs, metrics, traces around incident
- Apply 5 Whys - Ask "Why?" iteratively until fundamental cause found
- Map Categories - Use Fishbone to explore all cause categories
- Document Findings - Create RCA report with action items
Features
| Feature |
Description |
Guide |
| Cause Hierarchy |
Symptom -> Proximate -> Root -> Systemic |
Fix at deepest level possible |
| 5 Whys |
Iterative "Why?" questioning |
Typically 5 iterations to root cause |
| Fishbone Diagram |
Category-based cause exploration |
Code, Data, Config, Infra, External, Process |
| Evidence Gathering |
Logs, metrics, traces, reproduction |
Timestamp, source, reliability rating |
| RCA Report |
Structured documentation |
Timeline, cause chain, action items |
| Systemic Factors |
Why wasn't this caught earlier? |
Testing, monitoring, process gaps |
Common Patterns
# 5 Whys Example
Problem: Website down for 2 hours
Why #1: Why down? -> Server out of memory
Why #2: Why out of memory? -> Connections unbounded
Why #3: Why unbounded? -> Not released after use
Why #4: Why not released? -> Early return skipped finally
Why #5: Why not caught? -> No test for cleanup path
Root Causes:
1. Technical: Missing cleanup execution
2. Systemic: Missing test coverage
3. Process: Code review missed pattern
# Fishbone Categories (Software)
CODE: Logic errors, race conditions, memory leaks
DATA: Invalid input, corrupt data, schema mismatch
CONFIG: Wrong settings, env mismatch, feature flags
INFRA: Resource exhaustion, network, scaling
EXTERNAL: Third-party APIs, dependencies, attacks
PROCESS: Missing tests, review gaps, monitoring blind spots
# Cause Hierarchy
SYMPTOM: "App crashed"
|
PROXIMATE CAUSE: "Out of memory"
|
CONTRIBUTING FACTOR: "No memory limits"
|
ROOT CAUSE: "Memory leak in event handlers"
|
SYSTEMIC FACTOR: "No memory monitoring"
PRINCIPLE: Fix symptoms = problem returns
Fix root cause = this problem prevented
Fix systemic = class of problems prevented
Best Practices
| Do |
Avoid |
| Gather evidence before forming hypotheses |
Jumping to conclusions |
| Use structured methods consistently |
Ad-hoc investigation |
| Involve multiple perspectives |
Single viewpoint |
| Look for systemic factors |
Just fixing immediate cause |
| Create actionable recommendations |
Vague "be more careful" |
| Verify fixes prevent recurrence |
Assuming fix works |
| Share learnings across team |
Siloing knowledge |
| Investigate near-misses too |
Only investigating failures |
Related Skills
debugging-systematically - Four-phase debugging processsolving-problems - 5-phase problem-solving frameworkthinking-sequentially - Numbered thought chainsverifying-before-completion - Ensure fix completeness
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: tracing-root-causes3description: AI agent performs systematic root cause analysis using 5 Whys, Fishbone diagrams, and evidence-based investigation. Use when debugging, conducting post-mortems, or investigating incidents. Use when this capability is needed.4---56# Tracing Root Causes78## Quick Start9101. **Identify Symptom** - Document the observable problem112. **Gather Evidence** - Collect logs, metrics, traces around incident123. **Apply 5 Whys** - Ask "Why?" iteratively until fundamental cause found134. **Map Categories** - Use Fishbone to explore all cause categories145. **Document Findings** - Create RCA report with action items1516## Features1718| Feature | Description | Guide |19|---------|-------------|-------|20| Cause Hierarchy | Symptom -> Proximate -> Root -> Systemic | Fix at deepest level possible |21| 5 Whys | Iterative "Why?" questioning | Typically 5 iterations to root cause |22| Fishbone Diagram | Category-based cause exploration | Code, Data, Config, Infra, External, Process |23| Evidence Gathering | Logs, metrics, traces, reproduction | Timestamp, source, reliability rating |24| RCA Report | Structured documentation | Timeline, cause chain, action items |25| Systemic Factors | Why wasn't this caught earlier? | Testing, monitoring, process gaps |2627## Common Patterns2829```30# 5 Whys Example31Problem: Website down for 2 hours3233Why #1: Why down? -> Server out of memory34Why #2: Why out of memory? -> Connections unbounded35Why #3: Why unbounded? -> Not released after use36Why #4: Why not released? -> Early return skipped finally37Why #5: Why not caught? -> No test for cleanup path3839Root Causes:401. Technical: Missing cleanup execution412. Systemic: Missing test coverage423. Process: Code review missed pattern4344# Fishbone Categories (Software)45CODE: Logic errors, race conditions, memory leaks46DATA: Invalid input, corrupt data, schema mismatch47CONFIG: Wrong settings, env mismatch, feature flags48INFRA: Resource exhaustion, network, scaling49EXTERNAL: Third-party APIs, dependencies, attacks50PROCESS: Missing tests, review gaps, monitoring blind spots51```5253```54# Cause Hierarchy55SYMPTOM: "App crashed"56 |57PROXIMATE CAUSE: "Out of memory"58 |59CONTRIBUTING FACTOR: "No memory limits"60 |61ROOT CAUSE: "Memory leak in event handlers"62 |63SYSTEMIC FACTOR: "No memory monitoring"6465PRINCIPLE: Fix symptoms = problem returns66 Fix root cause = this problem prevented67 Fix systemic = class of problems prevented68```6970## Best Practices7172| Do | Avoid |73|----|-------|74| Gather evidence before forming hypotheses | Jumping to conclusions |75| Use structured methods consistently | Ad-hoc investigation |76| Involve multiple perspectives | Single viewpoint |77| Look for systemic factors | Just fixing immediate cause |78| Create actionable recommendations | Vague "be more careful" |79| Verify fixes prevent recurrence | Assuming fix works |80| Share learnings across team | Siloing knowledge |81| Investigate near-misses too | Only investigating failures |8283## Related Skills8485- `debugging-systematically` - Four-phase debugging process86- `solving-problems` - 5-phase problem-solving framework87- `thinking-sequentially` - Numbered thought chains88- `verifying-before-completion` - Ensure fix completeness8990---91> Converted and distributed by [TomeVault](https://tomevault.io/claim/doanchienthangdev) — claim your Tome and manage your conversions.92<!-- tomevault:4.0:skill_md:2026-04-13 -->
tomevault-io