What does a postmortem consist of?

A postmortem is an analysis of an incident after it has been resolved, aimed at understanding the causes and improving processes. Typically, a postmortem consists of the following parts:

• Incident description: what happened, when, and how it was discovered.
• Impact: which services or users were affected.
• Cause: the root cause of the problem.
• Chronology of events: the sequence of actions before, during, and after the incident.
• What worked well: positive aspects of the incident response.
• What can be improved: identified weaknesses and mistakes.
• Action plan: specific steps to prevent recurrence.

Such an analysis helps the team learn from mistakes and increase system reliability.