Protocol
Mine postmortems for repeated failure patterns
One postmortem explains an event. A set of postmortems can reveal a system.
When it fits
- Individual incidents are being closed but similar failure modes keep returning under different names.
When to avoid it
- Do not copy another organization's incident frequencies as your baseline or force every event into a convenient category.
Why it matters
Periodically classify incidents by trigger, contributing conditions and affected system patterns using a small local taxonomy. Look for concentrations that justify a shared fix: deployment checks, interface design, capacity controls, observability or ownership. Keep the raw incidents visible so the categories do not become a substitute for reading the evidence.
Steps
- Choose a small set of locally meaningful trigger and contributing-factor categories.
- Classify a bounded period of postmortems consistently.
- Identify repeated patterns with enough examples to inspect.
- Create one systemic improvement hypothesis and test whether future incident data changes.
An example
Several unrelated outages may trace back to unsafe configuration rollout rather than three separate 'human errors.'
Check your result
The analysis produces a cross-incident improvement target supported by identifiable incident records.
Keep this limit in mind
- Do not copy another organization's incident frequencies as your baseline or force every event into a convenient category.
Evidence and sources
Google SRE uses consistent trigger and root-cause categories across postmortems to perform trend analysis and target systemic improvements.
Categories must fit the local system; Google's historical frequencies should not be copied as expected proportions elsewhere.
Results of Postmortem Analysis · Results of Postmortem Analysis