Postmortem: <short description>
Date: <incident date> | Severity: <sev> | Duration: <impact start to end> Author: <name> | Status: draft | reviewed | actions tracked
Summary
<Three or four sentences. What broke, who it affected, how long, how it was resolved. Someone should be able to read only this and understand the incident.>
Impact
- Users affected: <number or percentage, and of what>
- Duration of impact: <start to end, UTC>
- What they experienced: <the actual user-visible symptom>
- Business impact: <orders, revenue, SLA, whatever applies>
- Not measured: <what you could not quantify, and why>
Timeline
All times UTC.
| Time | Event | Evidence |
|---|---|---|
| Fault introduced | <commit, deploy, config change> | |
| Impact began | <first affected request> | |
| Detected | <alert, or customer report> | |
| Mitigation attempted | <what, and the result> | |
| Impact ended | ||
| Confirmed resolved |
Time to detect: <duration> | Time to mitigate: <duration>
What happened
<The narrative, in plain language. What the system was doing, what went wrong, why it had the effect it had. Written so a new engineer could follow it.>
Contributing factors
Technical
Detection
Response
Systemic
What went well
<Genuinely. What worked, so it is preserved and not refactored away.>
Actions
| Action | Owner | Due | Done means |
|---|---|---|---|