Start from the customer's exact failing request and work backward: find it in logs and traces, identify the failing service and code path, then check what changed there recently. Evidence first, hypotheses second.
A repeatable approach
- Pin down the time window and identifiers
- Find the failing requests in logs and traces
- Identify the code path and read it
- Check recent commits, deploys, and config changes in that area
- Compare the customer's config and data against a working account
- Confirm the cause explains every symptom, not just one
When to stop
Stop when you reach a cause you can change and that would prevent the next occurrence. A cause that only explains this one ticket is usually a symptom.
Decimal produces a cited root cause for technical tickets. See root cause analysis and agentic investigation.