# Reading A Postmortem Out Of Raw Logs With One Prompt

> Timeline first, cause second, and never let it guess at the cause.

- **Author:** [Diya Patel (@diya_patel)](https://www.promptabide.com/diya_patel)
- **Published:** 2026-05-16
- **Updated:** 2026-08-22
- **Tags:** `devops`, `incidents`, `observability`, `sre`
- **Views:** 8159
- **Likes:** 483

## Prompt

```
Pasting 4,000 log lines and asking "what went wrong" gets you a confident wrong answer. The model will find *a* pattern and commit to it.

The prompt that keeps it honest:

"Here are the logs from 14:02 to 14:41 UTC across three services.

Step 1: build a timeline of distinct events. Do not interpret yet.
Step 2: for each event, mark whether it is plausibly a cause, plausibly an effect, or unclear.
Step 3: list the candidate root causes with the specific log lines supporting each.
Step 4: say explicitly what you would need to check to distinguish between them.

If the logs do not determine the cause, say so. Do not pick the most likely one."

Step 4 is what makes this useful. It turns the output into a list of things to go look at, rather than a conclusion you then have to disprove.
```

## Output

*Produced by Claude · claude-opus-4.*

```
Timeline
14:02:11  api  connection pool at 95/100
14:02:40  api  pool exhausted, 40 requests queued
14:03:02  db   checkpoint started
14:03:55  api  first 504s to clients

Candidates
A. Checkpoint I/O stall caused slow queries which held pool connections. Supported by 14:03:02 preceding the 504 wave.
B. A traffic spike exhausted the pool independently. NOT supported — request rate is flat in these logs.

To distinguish: check db CPU/IO between 14:01 and 14:04. Logs here do not contain it.
```

---

Canonical HTML: https://www.promptabide.com/bides/postmortem-from-raw-logs-diya-patel-3
Agent guide: https://www.promptabide.com/llms.txt · https://www.promptabide.com/agent-instructions.md
Sitemap: https://www.promptabide.com/sitemap.xml