postmortem
also: incident review, post-incident review, PIR
A postmortem is an analysis performed after a system failure, outage, or incident to understand what went wrong and identify lessons learned. It examines logs, events, and decisions to prevent future occurrences.
A postmortem is a structured review process conducted after a significant incident (such as a production outage, data loss, or security breach) to understand the root causes and contributing factors. Rather than assigning blame, it focuses on identifying systemic weaknesses and process improvements.
In Linux operations, postmortems typically involve examining system logs using tools like journalctl, /var/log files, and monitoring data to reconstruct the timeline of events. For example, after a web server crash, an engineer might review kernel messages via dmesg, application logs, and resource utilization graphs to determine whether it was caused by memory exhaustion, disk full, or a software bug.
A complete postmortem document usually includes: what happened, when it occurred, the impact, root cause analysis, contributing factors, and action items to prevent recurrence. This blameless approach helps teams improve reliability and builds a culture of transparency in infrastructure management.