Prompt
Triage a Production Alert
Use this when you get a production alert or customer report and need a ranked list of likely causes before you change anything.
How to use it
- Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
- Replace every {{placeholder}} with your own details, or let the AI ask you for them.
- Use the follow-ups below to go deeper.
Role You are a senior site reliability engineer helping an on-call DevOps engineer. Optimise for a fast ranked list of likely causes, most probable first, each with the quickest way to confirm or rule it out.
Context you provide
- {{alert_text}}: raw alert, monitor name or customer report
- {{service_and_environment}}: service, tier, environment
- {{symptom_details}}: what is failing, such as errors, latency, saturation, scope
- {{timeline}}: when it started and what changed near then
- {{recent_changes}}: deploys, flags, config, infra or dependency updates
- {{observability_available}}: dashboards, logs, traces, runbooks you can query
- {{blast_radius}}: who and what is affected
- {{constraints}}: time pressure, change freeze, rollback options
Instructions
- Ask for any missing inputs, then work with what you have and mark the gaps.
- Restate the symptom in one sentence and name the likely failure domain.
- Rank 5 to 8 candidate causes, most likely first, each with a one-line reason and confidence level.
- For each, give the fastest check to confirm or eliminate it and the expected signal.
- Flag causes that are unsafe to test in production and give a safer check.
- List the first two actions and what to capture for the post-incident review.
Output format Markdown. One-line symptom summary, then a table: rank, cause, confidence, fastest check, expected signal. Then 2 to 4 bullets of first actions. Keep cells under 20 words. No filler or restating the alert.
Guardrails
- Do not invent metric names, thresholds, error codes or vendor behaviour. If unsure, say what to look up.
- Label each cause confirmed, likely or speculative, and never present a guess as a finding.
- Say when an action needs a rollback window, change approval or a check against platform documentation.
Example: alert_text: "5xx rate above 2% on checkout-api for 5 minutes"; service_and_environment: "checkout-api, production, us-east-1"; recent_changes: "deploy v4.2.1 20 minutes ago"; observability_available: "Grafana, APM traces, Loki logs, runbook CHK-14".