Dear Future Me

You’re here because something is broken.

Again.

Before you touch anything, stop.

Seriously.

Take your hands off the keyboard for thirty seconds.

You don’t know what’s wrong yet.

You know what’s happening. Those aren’t the same thing.

Customers can’t log in.

The phones are ringing.

Management wants updates every five minutes.

Someone has already suggested rebooting everything.

Resist the temptation.

Every production outage creates pressure to do something. Unfortunately, “doing something” and “making things better” are only loosely related.

The first mistake is usually made in the first five minutes.

Someone restarts a service before looking at the logs.

Someone clears temporary files because they “can’t hurt.”

Someone changes a firewall rule because it worked last time.

Someone deletes the evidence you’ll wish you still had an hour from now.

Don’t be that person.

Start with facts.

What changed?

When did it change?

Who noticed first?

Can you reproduce the problem?

What do the logs actually say?

If the answer to any of those questions is “I don’t know,” then your next action probably shouldn’t involve typing systemctl restart or clicking “Reboot.”

Computers are wonderfully consistent.

If something changed, there’s usually a reason.

Your job isn’t to guess what that reason is.

Your job is to collect enough evidence that the answer becomes obvious.

Remember that correlation isn’t causation.

Yes, Windows Updates finished last night.

Yes, someone deployed a new application.

Yes, the SAN firmware was upgraded on Tuesday.

None of those facts automatically explain today’s outage.

Coincidences happen.

Investigate them.

Don’t marry them.

Speaking of marriage…

Don’t fall in love with your first theory.

Every engineer has done it.

You see one suspicious log entry and decide you’ve solved the mystery.

From that point forward, every piece of evidence is subconsciously forced to fit your conclusion.

Congratulations.

You’ve just become a detective who arrested the first person they saw walking away from the scene.

The logs don’t care about your theory.

Neither should you.

If the evidence points somewhere unexpected, follow it.

Even if it means admitting you were wrong.

Especially if it means admitting you were wrong.

And finally…

When this is over—and it will be over—write it down.

Not because management wants documentation.

Not because auditors like paperwork.

Write it because six months from now you’ll barely remember this outage existed.

Future You will appreciate knowing why that bizarre firewall exception exists.

Future You will appreciate knowing why that service must be started before the other one.

Future You will appreciate knowing why that one server absolutely, positively should not be rebooted during business hours.

Future You is remarkably intelligent.

Future You is also terrible at remembering details.

Do them a favor.

Leave good notes.