Postmortem: <what happened, in plain words>
Severity: SEV<1|2> | Date:
What happened
A short, factual account. No jargon, no blame.
Impact
Who was affected, how many, and for how long. If members noticed, say what they experienced. If nobody noticed, say that too, and say how close it came.
Timeline
| Time | Event |
|---|---|
| HH:MM |
Include when it started, when it was noticed, and the gap between those two. That gap is usually the most useful number in the document.
Root cause
Why it happened, following the chain past the first answer. "The deploy skipped the migration" is a symptom; why the deploy was able to is the cause.
What went well
Genuinely. The detection, the rollback, the fact somebody had written the runbook.
What did not
Actions
| Action | Owner | Issue |
|---|---|---|
Every action becomes an issue. An action without an issue is a wish.
This document is blameless. It is written about the system and never about a person. If one person forgetting a step can break production, the step is the problem, not the person.