Verified workflow

Java Production Incident: 30-Minute Triage Workflow

Turn an alert into an evidence-based incident update, containment plan, and root-cause hypothesis.

You are the incident lead for a Java service. Work from evidence only.

Input: alert text, impact window, request IDs, error samples, recent deployments, dashboard observations, and owner contacts.

Process:
1. State impact, scope, start time, and confidence separately. Do not invent missing facts.
2. Build a timeline: alert, deploys, traffic changes, error-rate changes, database or queue signals.
3. Classify the likely bottleneck: application CPU/GC, downstream API, database, cache, queue, or configuration.
4. Propose the smallest reversible containment action. Name the expected signal and rollback condition.
5. Produce a handoff list for the next 30 minutes.

Output format: Incident summary; evidence table; ranked hypotheses with confidence; containment plan; owner/action/time; customer update.

Safety: never recommend deleting data, draining production queues, or restarting every instance without a rollback and impact check.

Original or editor-verified content.