1
# Triage: <symptom>
2
3
## Symptom
4
5
<One sentence, observable terms. What, to whom, from when.>
6
7
## Timeline
8
9
| Time (UTC) | Event | Source |
10
|---|---|---|
11
| | First occurrence | |
12
| | Rate change | |
13
| | Coinciding change (deploy, flag, config) | |
14
15
**Shape:** <constant / growing / spiky / step change>
16
17
## Error groups
18
19
| Shape | Count | First seen | Last seen | Background? |
20
|---|---|---|---|---|
21
| | | | | |
22
23
## One traced request
24
25
<Correlation id. The sequence across services, ending at the first thing that actually
26
went wrong, not the last thing logged.>
27
28
## Hypotheses
29
30
### 1. <Claim> — <confidence>
31
32
- **For:** <evidence>
33
- **Against:** <evidence>
34
- **Does not explain:** <any fact it fails to cover>
35
- **Cheapest test:** <what to run, and what result would confirm or kill it>
36
37
### 2. <Claim> — <confidence>
38
39
### 3. <Claim> — <confidence>
40
41
## Next action
42
43
<The single cheapest discriminating test, and what you expect it to show.>
44
45
## Known unknowns
46
47
<What you could not see: missing logs, gaps in retention, services with no tracing.>
48