Root cause analysis
How QUARK traces incidents back to their origin.
When an incident spans multiple hosts and symptoms, the hard question is always the same: what actually started this? QUARK's root cause analysis (RCA) answers it by walking the evidence backwards.
How RCA works
- Build the incident scope. Starting from the triggering symptom, QUARK collects every anomaly and event in the surrounding window that involves related infrastructure.
- Order by causality, not time. Using the dependency graph (network topology, host groups, shared storage, upstream services), QUARK determines which symptoms could have caused which others.
- Find the origin. The earliest anomaly that can explain the downstream symptoms is proposed as the root cause, with a confidence level.
- Explain the chain. The result is presented as a causal chain you can audit link by link.
Example
Finding: Application response times degraded on 6 web servers at 14:03.
Causal chain:
- 13:58 — Disk latency rises on storage node
san-02(firmware task started)- 14:01 — Datastore latency alarms on the VM cluster backed by
san-02- 14:03 — Response-time degradation on the 6 web VMs hosted on that cluster
Root cause (high confidence): scheduled firmware maintenance on
san-02was not excluded from production hours.
Confidence levels
| Level | Meaning |
|---|---|
| High | The full causal chain is supported by direct evidence |
| Medium | The chain is plausible but has an inferred link |
| Low | Multiple competing explanations — QUARK lists all candidates |
QUARK never presents a guess as a certainty. When confidence is low, it says so and shows every candidate cause with its supporting evidence.
Learning from your incidents
When you resolve a finding, you can record the confirmed cause. QUARK uses these confirmations to improve future RCA in your environment — recurring patterns get recognized faster and with higher confidence.