1
# Postmortem: <short description>
2
3
**Date:** <incident date> | **Severity:** <sev> | **Duration:** <impact start to end>
4
**Author:** <name> | **Status:** draft | reviewed | actions tracked
5
6
## Summary
7
8
<Three or four sentences. What broke, who it affected, how long, how it was resolved.
9
Someone should be able to read only this and understand the incident.>
10
11
## Impact
12
13
- **Users affected:** <number or percentage, and of what>
14
- **Duration of impact:** <start to end, UTC>
15
- **What they experienced:** <the actual user-visible symptom>
16
- **Business impact:** <orders, revenue, SLA, whatever applies>
17
- **Not measured:** <what you could not quantify, and why>
18
19
## Timeline
20
21
All times UTC.
22
23
| Time | Event | Evidence |
24
|---|---|---|
25
| | Fault introduced | <commit, deploy, config change> |
26
| | Impact began | <first affected request> |
27
| | Detected | <alert, or customer report> |
28
| | Mitigation attempted | <what, and the result> |
29
| | Impact ended | |
30
| | Confirmed resolved | |
31
32
**Time to detect:** <duration> | **Time to mitigate:** <duration>
33
34
## What happened
35
36
<The narrative, in plain language. What the system was doing, what went wrong, why it
37
had the effect it had. Written so a new engineer could follow it.>
38
39
## Contributing factors
40
41
### Technical
42
### Detection
43
### Response
44
### Systemic
45
46
## What went well
47
48
<Genuinely. What worked, so it is preserved and not refactored away.>
49
50
## Actions
51
52
| Action | Owner | Due | Done means |
53
|---|---|---|---|
54
| | | | |
55
56
## Open questions
57
58
<What is still not understood. Do not paper over this.>
59