Hone

Lessons · IT support · root cause and symptom

The symptom is what they saw; the root cause is why it keeps coming back

A symptom is what is reported: the printer is offline every Monday. The root cause is the thing that, if changed, stops it recurring: the printer takes a new address from DHCP over the weekend and the print server still has the old one. Restore the symptom first; hunt the cause on the problem record; fix the cause through a change.

Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.

What it is for

Every Monday for a month the same printer is 'offline', and every Monday somebody restarts it, and every Monday it comes back at 09:15. Four tickets, four restarts, a month of a team without a printer for the first hour. One question, 'why Monday', and one look at the address, and the fix is a reservation that takes two minutes and makes Monday go away.

How to think about it

When you have seen the same symptom three times, stop treating it as three faults. Ask what is different about when it happens. Find the thing that changes right before the symptom. Test that: make the change happen on purpose and watch the symptom follow. Fix the cause, not the symptom, and then wait for the next time it should have happened and watch it not.

Worked example

Symptom: printer offline every Monday 08:00; restart fixes it until next Monday
What is reported. Restarting is treating the symptom, and it works, for a week.
Why Monday: the printer's DHCP lease is 7 days and it renews over the weekend; on Monday it has a new address
The thing that changes just before the symptom.
The print server still points at last week's address
The cause. The printer is fine; the server is talking to an empty address.
Fix: a DHCP reservation so the printer's address never changes. Next Monday: online at 08:00
The cause fixed through a small change, and the verification is the Monday that did not happen.

Your turn

The printer is offline every Monday; the changing address is the root cause. Write what the Monday offline is.

Offline every Monday = the ; the changing address = the root cause

The trap

Closing the fourth restart ticket as 'resolved'. It was resolved; the user was working. The problem was never opened, so nobody was ever assigned to ask why, and Monday came round again.

Practise root cause and symptom on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.