In the previous chapter, we talked about incident response. When responding to an incident, we mentioned that you need to focus on bringing the system back to a healthy state as quickly as possible. This need often prevents you from finding out the root cause of the incident. The writing of a postmortem document is the right time to figure out what happened. How did the process die? What part of the system caused instability? How long after the incident began did we notice this? Why did other systems fail?
We carry out a postmortem separately from the initial incident so that we can be thorough and meticulous. We must make sure that we have all of the data and that we fix the issue entirely. Often, during an incident, adrenaline is flowing and quick gut decisions are made. This is because there is very little time to think and weigh decisions. If we do the analysis and research afterwards, we can talk to more people, the stress of the outage is not upon us, and we...