Root cause analysis built around evidence, sequence and correlation

Symptoms are not automatically causes

An overloaded application, a database timeout and authentication failures can all appear during the same incident. Determining root cause requires more than counting which error occurred most often. Engineers need timing, dependency and recurrence evidence.

What a useful RCA assistant should do

• Identify the earliest abnormal activity inside the relevant incident window.
• Show which later symptoms are temporally or operationally connected.
• Separate observations from interpretations.
• Surface uncertainty when the available evidence supports more than one explanation.
• Preserve enough evidence for another engineer to review the reasoning.

Merlin’s direction is to make this reasoning easier to assemble from telemetry while leaving the final engineering judgement with the operations team.

RCA continues after recovery

Restoring service and understanding root cause are related but different tasks. Once service is stable, the same correlated evidence can help document the incident, identify missing observability and test whether the proposed cause fits the complete timeline.