The common causes, ranked.
WHAT CAUSES MOST INCIDENTS
A full disk A configuration change An expired certificate A failed or missing backup discovered too late An application fault, not the server Resource exhaustion from traffic or a runaway process A compromise through outdated software
WHY A FULL DISK LEADS
It is gradual, entirely predictable, and almost never monitored.
WHAT IT BREAKS
Databases refusing writes Services failing to start Logins failing Sites returning errors
WHY CONFIGURATION CHANGES COME SECOND
They are the only thing that reliably changes on a working server.
WHAT THAT IMPLIES FOR DIAGNOSIS
Ask what changed, before anything else.
WHY CERTIFICATES MATTER DISPROPORTIONATELY
They fail at a fixed moment, completely, and the failure is visible to every visitor.
WHAT PREVENTS MOST OF THIS
Monitoring disk space with early warning Recording changes Automating certificate renewal, and monitoring it Testing restores Keeping software updated
WHAT NONE OF THAT REQUIRES
Deep expertise.
WHAT IT REQUIRES INSTEAD
Doing unexciting things consistently.
WHAT THE PATTERN IS
Almost every serious incident was preventable and predictable.
WHAT TO TAKE FROM THAT
Prevention is cheaper than skill at recovery.
