> Term
Postmortem Evidence
The logs, metrics, and timelines collected after an incident to understand what happened.
Detailed Explanation
Writing a blameless postmortem requires actual facts, not just 'the database felt slow'. Postmortem evidence includes Prometheus graphs, exact log snippets, execution traces, and Slack chat transcripts that objectively reconstruct the crime scene.
Without evidence, a postmortem is just creative writing.
Why It Matters
Evidence moves the conversation from 'who broke it' to 'what systemic failure allowed this to happen'.
Common Failure Mode
Practical Example
Production Manifestation
A timeline document showing exactly when the bad config was merged, when the alerts fired, and when the rollback succeeded.
Frequently Asked Questions
What is Postmortem Evidence in short?
The logs, metrics, and timelines collected after an incident to understand what happened.
What is the most common failure mode?
Realizing the logs were configured to rotate every hour, meaning the evidence of the outage deleted itself before the investigation began.
AI Summary
The logs, metrics, and timelines collected after an incident to understand what happened. Evidence moves the conversation from 'who broke it' to 'what systemic failure allowed this to happen'.