Auto-RCA

Auto-RCA hands an Alert Group to KloudMate’s AI investigator the moment it opens, so by the time you open the group there’s already a root-cause summary waiting. You enable it per Routing Rule — every group the rule produces gets investigated.

How it works

When a routing rule with Auto-RCA enabled opens a group, KloudMate schedules an investigation after the configurable Auto-RCA delay (default: 5 minutes). The delay gives related signals time to fold into the group so the investigation sees the full picture, not only the first signal.

When the investigation completes, its summary attaches to the group:

• The group detail page shows the Attached investigation block with the summary excerpt and a View full investigation link.
• The notifications dispatched from the group include the investigation summary (where the channel format supports it — Slack thread reply, KloudMate Incidents comment, etc.).

One investigation per group

Auto-RCA runs only once per alert group — when the group is first opened. Alerts that later join an existing group (for example, a Memory alert folding into a group that a CPU alert already opened) do not trigger a new investigation. Those alerts still send the usual group-transition notifications, but no additional Auto-RCA report is generated for them.

Placeholder image

Screenshot pending — an alert group detail page showing an attached investigation block with summary excerpt and the View full investigation link.

Enable Auto-RCA on a routing rule

1. Open Alerts → Routing Rules and edit the rule you want to enrich.
2. Scroll to the Auto-RCA section.
3. Toggle Auto-RCA on.
4. Set the Delay if the default 5 minutes isn’t right. A shorter delay surfaces answers faster; a longer one captures more signals before the investigation runs.
5. Save.

Every group this rule opens from now on will trigger an investigation after the configured delay.

When Auto-RCA is most useful

Auto-RCA works best on rules that bundle related signals — a spike after a deploy, cascading errors across services, or downstream impact from an upstream incident. For very narrow per-host or per-instance rules, the investigation has less to work with and you may prefer to disable it to reduce compute usage.

Related

• Routing Rules — where the Auto-RCA toggle lives.
• Alert Groups — where the investigation surfaces.
• KloudMate Assistant — the broader investigator surface.