Back to the article

Incident response — the first minutes, runbook and timeline

cheat sheet · Ubuntu 24.04 · systemd 255 · sudo 1.9 https://lab.dimsanych.ru/en/wiki/incident-response/

Cheat sheet

1. the symptom as the user sees it
curl -s -o /dev/null -w '%{http_code}\n' http://localhost/
2. timeline: one line per action, UTC time
mkdir -p ~/incident; cd ~/incident
echo "$(date -u +%T) alert 'site 502', confirmed" >> timeline.txt
3. what changed last
sudo journalctl -t sudo --since -1h | grep COMMAND who ran what
sudo find /etc /opt /srv -newermt '-1 hour' -type f fresh files
ls -lt /etc/nginx/sites-enabled/ | head
4. a copy before the rollback — evidence for the review
sudo cp -a /etc/default/lab-app ~/incident/
5. check with the same request, write the time down