เขียนรายงานหลังเหตุการณ์และการทบทวนแบบไม่กล่าวโทษอย่างมีประสิทธิภาพ

Restoring service ends the outage, but not the incident. The real value comes afterward, in the postmortem, where the team turns a painful event into durable learning.

A postmortem is a written record of an incident: what happened, why, how it was handled, and what will change. It is a learning document, not a punishment record.

The core rule is blamelessness. People act reasonably given what they knew at the time. Blaming individuals hides the truth; assume good intent and focus on the system that allowed the failure.

Reconstruct events with timestamps: when it started, when it was detected, what actions were taken, and when service recovered. A clear timeline anchors the whole analysis.

Two metrics summarize response quality:

• MTTD — mean time to detect
• MTTR — mean time to recover

Tracking them over time shows whether your response is improving.

Dig past the surface symptom. The Five Whys technique repeatedly asks why until you reach a systemic cause, not just the trigger.

Complex outages rarely have one cause. Capture the full set of contributing factors, technical, process, and human, so fixes address the whole picture.

Every postmortem must produce concrete action items with owners and due dates. Vague intentions like 'be more careful' are not actions; 'add config validation to CI by Friday' is.

Publish postmortems widely so the whole organization learns. Track action items to completion; an unclosed follow-up means the same incident can recur.

When postmortems are blameless and acted upon, people report problems honestly and the system steadily hardens. Fear-driven cultures hide failures until they grow catastrophic.

Not every incident warrants a full postmortem. Tie the depth of review to a severity level: high-impact outages get a detailed written analysis; minor blips get a lightweight note. This keeps the process sustainable.

Test your understanding of postmortems.

You learned to run effective postmortems: keep them blameless, build a clear timeline, track MTTD/MTTR, find root causes with the Five Whys, capture contributing factors, assign owned action items, and share widely to build a learning culture.