Postmortem writing

Principles

• Blameless — focus on systems and process, not individuals.
• Accurate — timeline in UTC with evidence (logs, deploys, tickets).
• Actionable — every finding maps to owner + due date or ticket.

Required sections

1. Summary — what happened, duration, user/business impact
2. Timeline — detection, escalation, mitigation, recovery
3. Root cause — technical chain; distinguish trigger vs underlying gap
4. Contributing factors — process, monitoring, dependency, change management
5. What went well
6. Action items — prevent recurrence, improve detection, reduce blast radius

Timeline table