This section describes how Lifecycle Management can assist in the investigation and remediation of the causes of alerts on items.
The underlying causes that result in an alert being raised can be divided into two categories:

• Actual change (true positive): These correspond to changes to the deployment of applications to
  • hosts
  • a host's hardware
  • a host's operating system
  • or failures or changes in the network infrastructure.
• No actual change (false positive): These changes are caused by imperfections in Foundation's scanning of hosts or modeling of applications. Most scanning or modeling problems do in fact arise from actual changes, but not ones that affect the operation of applications or infrastructure.

The purpose of root cause analysis is to assist in determining whether a reported change corresponds to an actual change by automating the process of eliminating scanning and modeling problems. It does this by setting out a number of possible root causes that a Tideway Foundation user typically wants to rule out when identifying the source of a change. For each possible cause, suggestions are provided for further actions that can be taken.

This tool is particularly valuable as part of a process for ensuring the accuracy of change data exported from Foundation to third party systems.

Accessing Root Cause Analysis

To show root cause analysis for an item in a currently open view:

1. Click the title of the item to expand it.
2. Click on the Root Cause Analysis tab.

Displaying Root Causes

The following screenshot illustrates the display of root cause analysis:

Possible root causes are divided into three categories:

• Item – Checks the correspondence between an item's lifecycle and its authorization status. Also reports whether an item contains any destroyed or missing components to help diagnose items unexpectedly marked "Destroyed". See Item Root Cause Category for more information.
• Host – Root causes related to the discovery of a Host. Checks that the host can be contacted, that the endpoint which is being scanned has not changed identity, and that Foundation has appropriate credentials to access it. See Host Root Cause Category for more information.
• SoftwareInstance – Root causes related to the confirmation of a SoftwareInstance on a Host. Checks for common problems with obtaining process listings, with the discovery process and the execution of patterns. See SoftwareInstance Root Cause Category for more information.

Root cause analysis is performed only on Hosts and SoftwareInstance components. Although BusinessApplicationInstances can experience some of the modeling problems that SoftwareInstances do, their association with SoftwareInstances is typically static. Since some view types allow multiple Host and SoftwareInstance to appear in a single item, one analysis section is shown for each such component.

Host and SoftwareInstance root cause categories are only shown when two conditions hold:

• The item's authorization status is Expected; i.e. it is part of the approved infrastructure configuration, and
• The item's lifecycle is not Current; i.e. Foundation could not confirm the presence of that item when most recently scanned.

Root cause categories contain possible root causes. These have one of the following status values:

Icon	Status	Description
	Success	Lifecycle Management has tested and ruled out this possible root cause.
	Failure	Lifecycle Management has tested this possible root cause but determined that the associated task failed. It may not have been the only problem, but the task is required for the item to be successfully discovered.
	Warning	This represents a possible root cause but Lifecycle Management cannot determine whether it was the cause of a failure or not. Warnings require further user investigation.

• Possible root causes of any type may have a number of suggestions displayed beneath them. Suggestions do not have a type, but like the possible root causes may contain links which allow you to drill-down to investigate that issue further.
• Each root cause category also has an overall status, indicated by the colored bar on the left hand side of the category heading.