Why build a timeline before naming a cause?
Method: A timeline establishes what happened and in what order before a causal story is chosen. Sequence can rule out explanations that require an event to occur earlier than the evidence allows.
Reconstruct the observable sequence
- Normalize timestamps to one time zone.
- Use direct records before recollection.
- Describe events without causal labels.
- Investigate gaps and contradictory ordering.
Use timing to test causal stories
A deployment record at 09:10, the first error at 09:24, and a configuration rollback at 09:41 establish sequence. They do not by themselves prove the deployment caused the error, but they identify the interval that needs evidence.
Chronology alone does not prove causation
Preserve source and time-zone context
Record where each timestamp came from and whether device clocks were synchronized. Two events shown one minute apart may be reversed when clocks differ, so uncertainty belongs in the timeline rather than being hidden. Keep observed time, reported time, and entry time separate when they differ. This preserves the difference between when an event occurred and when a person or system recorded it.
The largest gap is a useful investigation target, not necessarily the causal interval. Look for missing telemetry, handoffs, or state changes that competing explanations predict differently. Check whether the first visible error was the beginning of failure or only the first detected symptom. Add negative evidence, such as a health check that remained normal, because it can narrow the onset window without inventing an unseen event.
Boundary of the result
Missing records are gaps, not permission to invent the event that would complete a preferred story.
Continue with the method
Use the incident timeline article and the root cause category map and the truth table generator for two statements to move from a quick result to a complete reasoning process.