root-cause-analysis

# Root Cause Analysis

Systematic approaches for identifying the true source of problems, not just symptoms.

## RCA Methods Overview

| Method | Best For | Complexity | Time |
|--------|----------|------------|------|
| 5 Whys | Simple, linear problems | Low | 15-30 min |
| Fishbone | Multi-factor problems | Medium | 30-60 min |
| Fault Tree | Critical systems, safety | High | 1-4 hours |
| Timeline Analysis | Incident investigation | Medium | 30-90 min |

## 5 Whys Method

Iteratively ask "why" to drill down from symptom to root cause.

### Process

```
Problem Statement: [Clear description of the issue]
    │
    ▼
Why #1: [First level cause]
    │
    ▼
Why #2: [Deeper cause]
    │
    ▼
Why #3: [Even deeper]
    │
    ▼
Why #4: [Getting to root]
    │
    ▼
Why #5: [Root cause identified]
    │
    ▼
Action: [Fix that addresses root cause]
```

### Example: Production Outage

```markdown
**Problem:** Website was down for 2 hours

**Why 1:** Why was the website down?
→ The application server ran out of memory and crashed.

**Why 2:** Why did the server run out of memory?
→ A memory leak in the image processing service accumulated over time.

**Why 3:** Why was there a memory leak?
→ The service wasn't releasing image buffers after processing.

**Why 4:** Why weren't buffers being released?
→ The cleanup code had a bug introduced in last week's release.

**Why 5:** Why wasn't the bug caught before release?
→ We don't have automated memory leak detection in our test suite.

**Root Cause:** Missing automated memory leak testing
**Action:** Add memory profiling to CI pipeline, add cleanup tests
```

### 5 Whys Best Practices

| Do | Don't |
|----|-------|
| Base answers on evidence | Guess or assume |
| Stay focused on one causal chain | Branch too early |
| Keep asking until actionable | Stop at symptoms |
| Involve people closest to issue | Assign blame |
| Document your reasoning | Skip steps |

### When 5 Whys Falls Short

- Multiple contributing factors (use Fi