Diagnosing methodically.
WHAT TO ESTABLISH FIRST
What exactly is broken, in observable terms.
WHY
Reports describe symptoms imprecisely, and solving the wrong problem is common.
WHAT TO ASK
What were you doing? What did you expect? What happened instead? When did it last work?
WHY THE LAST QUESTION MATTERS MOST
It bounds the window in which something changed.
WHAT TO CHECK NEXT
What changed: deployments, updates, configuration, certificates, disk, traffic.
WHAT TO VERIFY BEFORE INVESTIGATING DEEPLY
That the problem is reproducible That it is not local to one person
HOW
Test from elsewhere.
WHAT ORDER TO WORK THROUGH
Is the machine up? Is the service running? Is it listening? Does it accept connections? Does it respond correctly?
WHY THAT ORDER
Each depends on the one before, and it prevents guessing.
WHAT TO READ
The logs, at the time of the failure, starting with the first error.
WHAT TO CHANGE
One thing at a time.
WHY
Several changes at once make the cause unidentifiable.
WHAT TO DO WHEN STUCK
State what you know and what you have ruled out.
WHAT TO RECORD
The cause, once found.
