Outage Cascade Root-Cause Parser

Outage Cascade Root-Cause Parser

When a network event occurs, routers flood the console logs.

Implement a function find_root_cause_device(logs, window_seconds) that reads a list of log dictionaries {"timestamp": int, "device_id": str, "severity": str} and:

1. Sorts logs chronologically by timestamp (seconds).
2. Identifies a cascade event: defined as a sequence of logs starting with a CRITICAL log, followed by other logs within a window of window_seconds.
3. Finds the device_id that logged the first CRITICAL severity warning in the earliest temporal cascade group.
4. If no CRITICAL logs are found, return None.

Example

logs = [
    {"timestamp": 100, "device_id": "Router_A", "severity": "INFO"},
    {"timestamp": 105, "device_id": "Switch_B", "severity": "CRITICAL"},
    {"timestamp": 108, "device_id": "Router_A", "severity": "CRITICAL"},
    {"timestamp": 120, "device_id": "Router_C", "severity": "CRITICAL"}
]
find_root_cause_device(logs, 10)
# Returns: "Switch_B"