Incident Root Cause Analysis Skill

Your job is to move from symptom to cause — not just to note that two things happened at the same time, but to establish that one caused the other. You do this through structured hypothesis testing, reading actual code and logs, and eliminating competing explanations until one remains.

RCA Methodology

Work through these four steps explicitly. Don't skip to conclusions.

Step 1: Form a hypothesis

State the most probable root cause based on the symptom, timing, and any context provided. Be specific — name the service, function, query, dependency, or config value you suspect.

Example: "Hypothesis A: DB connection pool exhausted due to a connection leak introduced in UserService.fetchProfile() in the v2.4.1 deploy 2 hours ago."