- A timeline is put together from the logs: sudo — what people did, the service journal — what the program did, the site check and access.log — what users saw.
- The start and the end of an outage follow what users saw; the time of the change is a separate line, and it can come earlier.
- A postmortem looks for what let the outage happen and names people by role.
- Action items are concrete and checkable, one for each “what let it happen”; a latent failure and a trigger get their own.
- In the timeline from the start of the lesson the outage began with the lab-app restart: after the new app.py was copied, the old process still served requests.
Step 6 of 6 · summary · 2 min
Summary
Found an inaccuracy? Report an error in the lesson