AI Agent Root Cause Analysis
Answering "why did response time spike yesterday afternoon" means finding the anomalous window in the metrics, checking JENNIFER's own verdict, narrowing the scope to applications and transactions, and finally finding the slow SQL or external call in a profile. Query commands can do it, but every step means reading the previous result and writing the next query by hand.
The JENNIFER performance root cause analysis template of the AI agent apps hands that work to an agent. Ask one question, and the agent runs the console query commands one after another to narrow down the cause, then reports the root cause with its evidence.
Before you start
- Console setup - you need JENNIFER APM app 1.1.2610.0 or later and a
JENNIFER Consoleconnect profile. Finish console setup in the Install Guide, and check first thatjennifer-instancesreturns results on the query screen - An AI agent app - the Agentic SOC or AI Assistant app must be installed with an LLM connect profile registered. Both apps include this template
Note
If JENNIFER performance root cause analysis is missing from the template catalog, update the AI agent app to the latest version.
Installing the template
- Click Templates on the AI Agents menu > Agents tab
- Find the JENNIFER performance root cause analysis card. Its Required apps list shows JENNIFER APM 1.1.2610.0 or later, with a warning if it is missing or too old
- Click Install to copy the template into your agents. It installs with instructions in your session language (Korean, English or Japanese)
The installed agent is yours to edit. A later template update never changes it.
Tip
With several
JENNIFER Console profiles, pin the profile for each jennifer- command on the installed agent's Query Commands tab, and you no longer need to name the console in every question.
What the agent does
Inputs
| Input | Required | What it is |
|---|---|---|
| Question | Yes | What looked wrong and when, in plain language |
| Domain ID | No | The domain to analyze. The agent picks it from the domain list when not given |
| Analysis start | No | Start of the analysis window, yyyyMMddHHmmss |
| Analysis end | No | End of the analysis window, yyyyMMddHHmmss |
In chat there is no need to fill the inputs separately; put them in the question.
Procedure
The agent follows the root cause flow of Query Commands. Each step's result sets the period, instances and applications of the next.
| Step | Command | What the agent does |
|---|---|---|
| 1. Targets | jennifer-instances | Confirms the domain and instances, including instances whose ID changed on restart |
| 2. Detect | jennifer-metrics | Compares the analysis window against a baseline before it (usually a day) and finds by z-score which metric left its baseline, when, and on which instance |
| 3. Verdict | jennifer-problems | Checks that the problems JENNIFER judged in the same window agree with what was detected |
| 4. Scope | jennifer-app-summary, jennifer-errors | Compares applications between the anomalous and baseline windows to narrow down the culprit, and reads error counts by type if errors went up |
| 5. Evidence | jennifer-xview | Lists the slow or failed transactions of the anomalous window and sees whether their time went to SQL, external calls or CPU |
| 6. Cause | jennifer-profile | Opens the profiles of one to three representative transactions and finds the slowest SQL, external call or method |
| 7. Conclude | - | States the root cause hypothesis with evidence, a confidence level and what is left to check |
When a result contradicts what it expected, the agent changes its hypothesis and goes back a step. If there is no anomaly, it says so.
Rules it keeps
- It only reads. It changes nothing - console settings, events, patterns or anything else. The only tools the template allows are the seven console query commands and
join - It quotes numbers, times and txids only from actual command results, and marks any inference not confirmed by a result as a hypothesis
- It keeps
jennifer-xviewwindows to a few minutes around the problem and cuts busy windows down by response time or errors. When a result is cut short it says so and looks again with a narrower window - It never exceeds a command's longest period (one day for
jennifer-xview,jennifer-problemsandjennifer-app-summary, 31 days forjennifer-metricsandjennifer-errors) - With several profiles, it picks one
- If it cannot pin down the bottleneck, it says how far it narrowed it and what blocked it
Outputs
| Output | What it holds |
|---|---|
| Anomaly | Which metric strayed, when, on which instance, and by how much |
| Root cause | The culprit application and the concrete bottleneck (SQL statement, external call target, method) |
| Evidence | Metric values, times, applications, and the txids of the transactions that show it |
| Confidence | high, medium or low |
| Next steps | What else to look at to settle the conclusion (optional) |
| Summary | A short wrap-up of the above |
The agent is set to finish within 40 turns and 900 seconds (15 minutes) per run.
Running it
- Click New chat on the Chat menu
- Select the installed JENNIFER performance root cause analysis agent at the top
- Send your question
You can also use Test Run in the agent list to run it with each input filled in.
Example questions
- Find out why response time spiked yesterday between 14:00 and 15:00
- Why did errors go up in domain 1000 over the last hour?
- /api/orders was slow around 10 this morning; analyze the cause
- Check whether any instance behaved unusually in the last 30 minutes
- Analyze what happened in domain 1000 of the jennifer-prod profile from 20261027030000 to 20261027040000
The more specific the time and domain, the more precisely the agent sets the baseline and analysis windows.
Reading the result
When the run finishes, the answer lays out the outputs above. The agent may also draw time series as charts in the answer.
- Read the evidence first. The numbers and txids come from actual command results, so whether the evidence supports the conclusion is what decides how far to trust it
- When confidence is low or medium, read the next steps and carry on checking yourself
- Click the run card to see, turn by turn, which query ran and what came back. You can copy a query to the query screen to run it again or with a different period
- The txids in the evidence can be checked on the console screens too. Search that time under Analysis > X-View and open the transaction to see on screen the profile the agent read
Things to keep in mind
- It is read-only. The agent reports the cause; it takes no action. Changing settings or restarting is for a person to decide and do
- Period limits - each command reads a limited period at a time, so the agent suits analyzing a specific incident window better than trends over weeks. For long trends, use the Statistics screens
- Name the profile when there are several.
domain_iddiffers per console, so put the profile name in the question or pin it on the agent's Query Commands tab - Run permissions - the agent runs with its owner's rights, so it uses only the
JENNIFER Consoleprofiles the agent's owner may use - The conclusion is a hypothesis. The agent judges only from what JENNIFER collected. A cause in places JENNIFER cannot see - code that is not profiled, the inside of a database server, network devices - can only be narrowed down to its scope
- A run that exceeds its time limit or runs out of turns fails. Narrow the analysis window or the domain and ask again