> For the complete documentation index, see [llms.txt](https://www.mlcompendium.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mlcompendium.com/decision-intelligence/root-cause-effects-rce-rca.md). # Root Cause Effects (RCE/RCA) After an incident, the question is which fault caused it, and most of the answers here model the system as a graph. The page starts with a survey, then graph models of industrial processes and equipment faults, then causality graphs for networks and distributed systems, and ends with a root-cause engine for time series, with deprecated addresses kept at the end. The same notes are in [Graph Theory](/predictive-ml/graph-theory.md) and [Knowledge Graphs](/natural-language-processing-nlp/knowledge-graphs.md). The map of the field is the [Survey on Models and Techniques for Root-Cause Analysis](https://arxiv.org/pdf/1701.08546.pdf), arXiv paper 1701.08546. A first graph idea from network operations is [Towards an Approximate Graph Entropy Measure for Identifying Incidents in Network Event Data](http://sro.sussex.ac.uk/id/eprint/59796/1/annet-paper.pdf). Industrial processes get the same graph treatment. [Process connectivity and fault diagnosis, hazard assessment](https://doi.org/10.2478/v10006-012-0003-z) is Signed directed graph based modeling and its validation..., which fuses process data with process connectivity for fault diagnosis and process hazard assessment; the Signed Directed Graph (SDG) captures process topology and the causal relationships between process variables and has been widely used in root cause analysis. For equipment rather than processes, [Fault root cause tracing of complicated equipment in fault graph](https://journals.sagepub.com/doi/abs/10.1177/0954408912445957) is the fault-graph version. [Signed directed graph modeling of industrial processes and their validation..](https://www.researchgate.net/profile/Fan_Yang25/publication/224208169_Signed_Directed_Graph_modeling_of_industrial_processes_and_their_validation_by_data-based_methods/links/0c96052e13273bb94b000000.pdf) is the same signed-directed-graph line validated by data-based methods. Beyond one plant, the graph can carry the questions themselves. [Answering Who/When, What, How, Why through Constructing Data Graph, Information Graph, Knowledge Graph and Wisdom Graph](https://pdfs.semanticscholar.org/9a37/bdc1e947fd703ba8593acd028515285493dd.pdf) is from Hainan University's College of Information Science and Technology. In networks, [Identifying Suspicious Activities through DNS Failure Graph Analysis](https://www.cs.columbia.edu/~lierranli/publications/ICNP10.pdf) comes from the University of Minnesota and Bell Laboratories, Alcatel-Lucent. Distributed systems are where causality graphs do the most work. [CauseInfer: Automatic and Distributed Performance Diagnosis with Hierarchical Causality Graph in Large Distributed Systems](https://netman.aiops.org/~peidan/ANM2017/13.RootCauseAnalysis/ReadingLists/2014INFOCOM_CauseInfer.pdf) starts from cloud-based applications with many components and complex interactions, vulnerable to performance or availability problems from resource hogs, configuration changes, and software bugs. [GRANO: Interactive Graph-based Root Cause Analysis for Cloud-Native Distributed Data Platform](http://www.vldb.org/pvldb/vol12/p1942-wang.pdf) is the interactive, cloud-native take. For big network data, ScienceDirect has [An enhanced Graph Analytics Platform (GAP) providing insight in Big Network Data](https://www.sciencedirect.com/science/article/pii/S2352664516300189), and, for software dependability, [Causal Mechanism Graph ─ A new notation for capturing cause-effect knowledge in software dependability](https://www.sciencedirect.com/science/article/abs/pii/S0951832016304136). [Mining Causality Graph For Automatic Web-based Service Diagnosis](https://netman.aiops.org/~peidan/ANM2018Fall/11.CausalInference/LectureCoverage/2016IPCCC_Mining%20Causality%20Graph%20For%20Automatic%20Web-based%20Service%20Diagnosis.pdf) is from Tsinghua University and Baidu Inc. The same graph traversal also traces threats, bugs, and power failures. [Who Controls the Internet? Analyzing Global Threats using Property Graph Traversals](https://publications.cispa.saarland/1091/1/gthreats_www2017.pdf) applies property graph traversals to global threats. [A Novel Technique for Call Graph Reduction for Bug Localization](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.258.8729\&rep=rep1\&type=pdf) reduces the call graph to localize bugs. [Integrated System Model Reliability Evaluation and Prediction for Electrical Power Systems: Graph Trace Analysis Based Solutions](https://vtechworks.lib.vt.edu/bitstream/handle/10919/28944/Cheng_Danling_D_2009.pdf?sequence=1\&isAllowed=y) is Danling Cheng's dissertation, a new approach to evaluating the reliability of electrical systems by applying Graph Trace Analysis to integrated system models. The last two turn diagnosis into queries. [: A Graph Processing System for Diagnosing Distributed Systems](https://static.usenix.org/events/atc11/tech/final_files/GuoZhou.pdf) is G2, which works on execution graphs that model runtime events and their correlations; each diagnosis is a series of queries in a high-level declarative language with relational and graph-based operators. [ExplainIt!– A declarative root-cause analysis engine for time series data](https://arxiv.org/pdf/1903.08132.pdf) is a declarative, unsupervised engine that uses time series monitoring data from large complex systems such as data centres and lets operators succinctly specify a large number of causal hypotheses to search for causes of interesting events. ## Deprecated links {% hint style="warning" %} These links and images no longer work. The original wording is kept here. A same-resource copy, when one was checked, is used above. {% endhint %} * Process connectivity and fault diagnosis, hazard assessment. This address no longer opens: * Identifying Suspicious Activities through DNS Failure Graph Analysis. This address no longer opens: --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://www.mlcompendium.com/decision-intelligence/root-cause-effects-rce-rca.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.