File size: 2,174 Bytes
3cf0daf | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 | # Postmortem: [Incident Title]
- **Date**: YYYY-MM-DD
- **Severity**: SEV1 / SEV2 / SEV3
- **Duration**: Xh Ym
- **Author**: @name
- **Status**: Draft / Final
## Summary
One-paragraph summary of what happened. Read this first; if you only have 30 seconds, this is all you need.
## Impact
- **Users affected**: N users / M% of traffic
- **Duration of user-visible impact**: Xh Ym
- **Revenue impact**: $X (estimated)
- **Data loss**: yes / no / partial
## Timeline (all times UTC)
- **HH:MM** — first alert (Telegram / Sentry / user report)
- **HH:MM** — investigation began
- **HH:MM** — root cause identified
- **HH:MM** — mitigation applied (e.g. container restart, rollback)
- **HH:MM** — service recovered
- **HH:MM** — monitoring confirmed no recurrence
## Root Cause
Technical explanation. No blame. Describe the technical chain that led to the incident.
## Contributing Factors
- **Factor 1**: e.g. "alert threshold was set too high"
- **Factor 2**: e.g. "no runbook existed for this failure mode"
- **Factor 3**: e.g. "tests did not cover this code path"
## What Went Well
- Alert fired within 60s of failure
- Rollback completed in 5min
- No data loss
## What Went Poorly
- Alert was noisy (3 false positives before real one)
- Runbook was outdated
- Took 30min to identify root cause
## Triggering Condition
What was the chain of events that led to the incident? Be specific.
## Detection
How did we find out? Alert / user report / proactive check / etc.
## Resolution
What did we do to fix it?
## Action Items
- [ ] **Action 1**: [description] — owner: @name — due: YYYY-MM-DD
- [ ] **Action 2**: [description] — owner: @name — due: YYYY-MM-DD
- [ ] **Action 3**: [description] — owner: @name — due: YYYY-MM-DD
Action items must be:
- **Specific**: not "improve observability" — "add Prometheus alert for X at Y threshold"
- **Owned**: one named person, no "team"
- **Dated**: hard deadline, not "soon"
## Lessons Learned
What would we do differently? Be honest.
## References
- Slack thread: <link>
- Runbook: `docs/runbooks/X.md`
- Related ADRs: `docs/adr/NNNN-*.md`
- Code change: <commit hash or PR link>
|