---
title: Probable Root Cause Analysis \(RCA\)
description: Shorten the mean time to repair \(MTTR\) by discovering the root cause of an alert.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/event-management/probable-rca.html
release: australia
product: Event Management
classification: event-management
topic_type: concept
last_updated: "2026-06-25"
reading_time_minutes: 2
breadcrumb: [Manage and monitor alerts, Configure, Event Management, ITOM AIOps, IT Operations Management]
---

# Probable Root Cause Analysis \(RCA\)

Shorten the mean time to repair \(MTTR\) by discovering the root cause of an alert.

Probable root cause analysis \(RCA\) provides a list of probable root causes for alerts. This capability uses existing data in IT Service Management to help you determine the root cause of an issue.

RCA takes three factors into consideration: Alerts, configuration item \(CI\) topology, and change requests on the CIs. It extracts CIs from alerts or alert groups and analyzes the CI relationships in the CMDB. It then uses a set of configurable filters to consider relevant change requests on the CIs as possible root causes.

Change requests can be related to a time frame or to a CI, the application service it belongs to, or the software installed on it. For example, a CI must be upgraded or a security patch installed on it. A change request on one CI can affect other CIs.

RCA maps the alerts and change requests to the CIs. It proceeds to calculate the root cause score, a logical score used for sorting probable root causes. The calculation of this score is based on change requests on CIs, and on alerts on a crucial CI called the Topology Origin CI. The root cause score determines how RCA populates the probable root causes list.

\[Omitted image "probable-rca3.png"\] Alt text: Probable Root Cause list

By default, the list shows the five probable root causes with the highest score. It lists the CIs related to each alert, and the reason RCA identified them as probable root causes.

Each probable root cause includes an explanation on how RCA correlated the alert with the change request. The reason can indicate that the change request was applied directly to the CI that generated the alert. It can also indicate changes to a CI in the affected CIs list, to a related CI, to an application service, or to software installed on the CI. RCA identifies installed software by using the `cmdb_software_instance` table.

For alert groups, RCA uses topology analysis to identify upstream CIs that might explain cascading failures in the group. Changes on these topology origin CIs receive higher priority in the probable root cause score.

Scoring for probable root causes is determined by the following criteria, in the indicated order \(lower number = higher priority\):

1.  Change on a CI that originates from topology.
2.  Change on a related CI originates from topology.
3.  Change on a CI.
4.  Change on a related CI/change on an application service/change on software.
5.  Alert on the CI that originates from topology.

To disable the Probable Root Cause Analysis feature, you must create the property **sa\_analytics.disable\_prc** and set the value to `true`. For more information on how to create a property, see [Add a system property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/t_AddAPropertyUsingSysPropsList.md).

-   **[Customize RCA settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/set-rca-change-query-filters.md)**  
Modify default settings that determine RCA behavior.

**Parent Topic:**[Manage and monitor alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/c_EMAlert.md)