Web Operations

What Is a Postmortem?

A postmortem needs to cover these essentials at a minimum:

1. A description of the incident

2. A description of the root cause

3. How the incident was stabilized and/or fixed

4. A timeline of actions taken to resolve the incident

5. How the incident affected customers

6. Remediations or corrective actions

The first five items make sure everyone involved has a common understanding of the facts. Many incidents reoccur because people do not understand what really happened and how the problem was fixed. Different teams and different layers of management arrive at the postmortem with different understandings of what happened. During a postmortem, everyone with significant involvement in the incident should be present at the same time to document a common description of the facts of the incident. Without an accurate account of the facts, it will be impossible to determine and prioritize the corrective actions that are the biggest benefit of a postmortem.

Determining the root cause should go without saying, but I can't tell you the number of times I have been in a postmortem where participants spent tons of time debating each possible remediation item or the number of customers affected, only to find that they had wasted their time because they didn't have the root cause right.

The same goes for the stabilizing steps. Often during the chaos of a major incident, multiple people attempt multiple fixes. Determine the true root cause and the step that brought it to stable before moving on. Note ...