Evidence is lost during recovery
The state and records needed for root cause investigation are not preserved while restoring service.
Identify Incident Causes
with a Consistent Process.
We trace incident causality across monitoring data, logs, traces, and configuration change histories. Going beyond recovery, we identify technical root causes and contributing operational processes to help prevent recurrence.
CollectConsolidate data
ReduceRemove duplicates and downstream effects
TraceTrace causal relationships
PreventApply findings to recurrence prevention
COMMON CHALLENGES
Service is restored, but the cause remains unknown.
Investigations stall when data, responsibilities, time, and procedures are disconnected. An incident that is resolved without identifying its cause will recur when the same conditions arise.
Important events are buried in alerts
The events that deserve attention first are hidden among large volumes of notifications.
Investigations stop at team boundaries
Network, server, database, and application teams assess issues separately, leaving the overall picture unclear.
Investigations depend on experienced staff
Without standardized procedures, investigations rely on the experience and availability of specific individuals.
OUR APPROACH
The same 4 steps for every investigation.
We use consistent data, procedures, and tools to reproduce the analytical process followed by experienced investigators.
Collect: Consolidate data from networks, servers, databases, applications, and the cloud.
Narrow down: Organize duplicate and secondary alerts to retain the events that need investigation.
Trace causality: Correlate event sequences, dependencies, and change histories to trace the path of propagation backward.
Prevent recurrence: Use the findings to implement lasting corrective actions, improve problem management, document knowledge, and verify resolution.
MANAGEENGINE TOOLS
Define each product's role and connect it to RCA.
OpManager
Monitor the availability and performance of networks, servers, and storage to identify where issues arise and what they affect.
Applications Manager
Investigate response delays and errors at the transaction level across applications, middleware, and databases.
NetFlow Analyzer
Use flow data to identify bandwidth-consuming hosts, applications, communication peers, and time periods.
Log360
Consolidate logs from servers, firewalls, databases, cloud services, and other sources to investigate events before and after an incident.
Site24x7
Monitor Web, API, and cloud services from the outside for availability and capture symptoms from the user perspective.
ServiceDesk Plus
Convert alerts into incidents and link them with problems, changes, the CMDB, and knowledge.
Environment design and deployment
Review monitoring targets, dependencies, logs, and change histories to design data collection.
Accuracy tuning
Review thresholds, correlation rules, false positives, and exclusions based on operational results.
Problem management and knowledge
Identify recurring incidents and manage root causes, corrective actions, decision procedures, and long-term fixes.
IMPLEMENTATION
Evaluate in your environment, start small, and improve accuracy.
Validate the investigation process on selected systems, then expand based on results and data availability.
Requirements review
Review the monitoring configuration, recurring incidents, and current investigation and reporting processes.
Environment assessment
Evaluate data collection, configuration information, and change and response histories.
Design and pilot
Build an analysis workflow for a limited scope and validate the effectiveness of causal analysis.
Rollout and ongoing improvement
Expand the scope and improve rules, knowledge, and problem management processes.
WHY ADVANGE
Connect monitoring, infrastructure, and ITSM in one problem management process.
Across the infrastructure
Trace causal relationships across networks, servers, cloud, databases, and applications.
Analyze technical and management root causes
Review technical factors as well as causes in change management and operating processes.
Maintain accuracy after deployment
Continuously update thresholds, correlation rules, configuration information, and knowledge.
ITOMMonitoring and visibility
APMApplication performance analysis
ITSMProblem and change management
24 / 365Integration with monitoring operations
FAQ
Answers to common questions about system incident root cause analysis and recurrence prevention support.
We analyze monitoring data, logs, traces, configuration change histories, and other sources together.
Yes. We investigate networks, servers, databases, applications, and the cloud together.
Yes. We can begin with a limited-scope pilot and roll out in stages.
Yes. We also examine causes in operating processes, such as change management and investigation procedures.
Yes. We support lasting corrective actions, problem management, knowledge documentation, and verification of results.
Tell Us About a
Recurring Incident
What data do you need, and how precisely can the cause be identified? We will define an RCA implementation approach suited to your current monitoring and operations environment.