PRODUCTION RESILIENCE PRACTICE

15 Production Incident Investigation Worksheets

Debug real distributed systems failures under simulated pressure. Step through symptoms, execute diagnostic commands, isolate root causes, and apply permanent architectural remediations.

INC-01SEV-1

High p99 Tail Latency with Normal Median Latency

Symptom & Telemetry

Median latency p50 is steady at 12 ms, but p99 spikes to 2,400 ms. Intermittent HTTP 504 timeouts at ingress gateways.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandperf top -p <pid> --sort comm,dso && bpftrace -e 'tracepoint:syscalls:sys_enter_futex { @[comm] = count(); }'
Root Cause

Periodic stop-the-world garbage collection pauses combined with lock contention on shared in-memory connection pools.

Permanent Remediation

Migrate to non-blocking ring buffers (Disruptor pattern), tune GC allocation rates, and implement client request hedging.

INC-02SEV-1

Database Connection Pool Exhaustion under Modest Load

Symptom & Telemetry

Application servers hang with "Connection pool exhausted (timeout after 5,000ms)". CPU utilization on database is low (< 25%).

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic CommandSELECT pid, state, query, age(clock_timestamp(), query_start) FROM pg_stat_activity WHERE state != 'idle' ORDER BY 4 DESC;
Root Cause

Application code holding database transactions open while making synchronous external HTTP calls to third-party payment APIs.

Permanent Remediation

Enforce transactional outbox pattern; move external RPCs strictly outside the database transaction boundary.

INC-03SEV-1

Cascading Failure across Microservice Service Mesh

Symptom & Telemetry

A transient database glitch in Service D triggers complete outage across Service A, B, and C within 90 seconds.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandistioctl dashboard envoy <pod> && tcpdump -i eth0 -nn 'tcp[tcpflags] & (tcp-rst) != 0'
Root Cause

Clients executing uncoordinated aggressive exponential retries with zero jitter, creating a self-inflicted DDoS retry storm.

Permanent Remediation

Implement circuit breakers (hystrix/envoy), full jitter backoff schedules, and adaptive load shedding at ingress.

INC-04SEV-2

Kafka Partition Consumer Lag Runaway

Symptom & Telemetry

Consumer lag on partition 4 grows by 100,000 messages/minute. Downstream real-time dashboard is 45 minutes delayed.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandkafka-consumer-groups.sh --bootstrap-server localhost:9092 --describe --group analytics-worker
Root Cause

Data skew on message key: a celebrity account generated 80% of total write events mapped to a single partition.

Permanent Remediation

Salt high-cardinality keys with random sub-partition suffixes (e.g. key_0..key_9) or use round-robin dispatch.

INC-05SEV-2

Cassandra Replica Inconsistency & Read Repair Thrashing

Symptom & Telemetry

Read latency degrades 5x under QUORUM consistency. Node disk I/O saturates at 100% with high tombstone warnings.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandnodetool tablestats -H <keyspace> && nodetool tpstats | grep -E "ReadRepair|Mutation"
Root Cause

Frequent cell overwrites and deletions created millions of tombstones; read repair triggers heavy full-table scanning.

Permanent Remediation

Tune `tombstone_failure_threshold`, decrease gc_grace_seconds for short-lived records, and run scheduled incremental repairs.

INC-06SEV-1

Raft Split-Brain Quorum Loss during Network Partition

Symptom & Telemetry

Writes to coordination cluster fail with "Leader election timeout". Client leases expire across Kubernetes control plane.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandetcdctl endpoint status --write-out=table && etcdctl endpoint health
Root Cause

Asymmetric network partition isolated the leader in a minority 2-node cluster segment while 3 nodes lacked heartbeat quorum.

Permanent Remediation

Configure odd-numbered cluster nodes (5 or 7), verify physical rack/zone affinity, and adjust leader election jitter.

INC-07SEV-2

Consistent Hash Ring Hot Partitioning from Skewed Keys

Symptom & Telemetry

Node 4 memory hits 98% while Nodes 1, 2, and 3 sit idle at 15%. Redis OOM alerts fire repeatedly on Node 4.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandredis-cli --bigkeys && redis-cli --hotkeys
Root Cause

Low virtual node factor (V=1) caused uneven token distribution on 32-bit hash ring; hot product key pinned to Node 4.

Permanent Remediation

Increase virtual node factor to V ≥ 150; implement client-side local caching for top 0.1% hot keys.

INC-08SEV-2

JVM Garbage Collection Stop-the-World Latency Breaches

Symptom & Telemetry

Kafka brokers intermittently disconnect with heartbeat timeout errors. Linux dmesg shows zero hardware faults.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandjstat -gcutil <pid> 1000 10 && jcmd <pid> GC.run
Root Cause

Large Eden space allocations of short-lived byte arrays promoting directly to Old Generation, triggering 8-second G1 pauses.

Permanent Remediation

Allocate buffers off-heap (DirectByteBuffers) or enable Shenandoah / ZGC low-latency concurrent garbage collectors.

INC-09SEV-1

Distributed Deadlock in Multi-Shard Two-Phase Commit

Symptom & Telemetry

Transaction throughput drops to zero. All shard worker threads are blocked on database row locks waiting for 2PC coordinator.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic CommandSELECT * FROM pg_locks WHERE NOT granted; && tail -n 100 /var/log/pg_log/deadlock.log
Root Cause

Concurrent transactions acquiring locks on Shard A and Shard B in reverse order without global lock hierarchy.

Permanent Remediation

Order shard lock acquisitions strictly by global entity ID ascending; replace cross-shard 2PC with asynchronous Sagas.

INC-10SEV-1

Redis Cache Stampede on Hot Key Expiration

Symptom & Telemetry

At 12:00:00 UTC, the cache key expires. 50,000 concurrent web requests simultaneously miss cache and bombard database.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandredis-cli monitor | grep "GET home_catalog" && sar -n DEV 1 5
Root Cause

Fixed TTL cache expiration without probabilistic early refreshing or single-flight locking.

Permanent Remediation

Implement XFetch probabilistic early expiration (`-beta * log(rand())`) and in-memory single-flight coalescing.

INC-11SEV-1

Linux epoll File Descriptor Exhaustion at Gateway

Symptom & Telemetry

Reverse proxy drops new client TCP connections with "socket: too many open files" (EMFILE).

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandlsof -p <nginx_pid> | wc -l && cat /proc/sys/fs/file-nr
Root Cause

Upstream microservices failed to send HTTP keepalive responses, leaving 65,000 idle sockets in TIME_WAIT state.

Permanent Remediation

Configure upstream keepalive connection pools, tune `tcp_tw_reuse`, and raise system `nofile` limits in limits.conf.

INC-12SEV-1

GPU Out-Of-Memory (OOM) during Dynamic LLM Inference

Symptom & Telemetry

LLM inference pods crash with "CUDA error: out of memory". GPU VRAM spikes to 100% during concurrent long-prompt generation.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandnvidia-smi --query-gpu=memory.total,memory.used,utilization.gpu --format=csv -l 1
Root Cause

Static pre-allocated contiguous key-value (KV) cache buffers fragmented VRAM, leaving 70% of memory unusable.

Permanent Remediation

Deploy PagedAttention (vLLM) to page KV caches into non-contiguous physical blocks with dynamic copy-on-write.

INC-13SEV-1

NCCL Collective Communication Deadlock in Model Training

Symptom & Telemetry

Multi-node GPU training job halts indefinitely. GPU utilization drops to 0% across 64 nodes. Zero crash logs.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic CommandNCCL_DEBUG=INFO NCCL_DEBUG_SUBSYS=COLL torchrun ... && dmesg | grep -i infiniband
Root Cause

Asymmetric batch size across workers caused Rank 12 to miss a Ring-AllReduce barrier while other ranks waited indefinitely.

Permanent Remediation

Set strict NCCL_ASYNC_ERROR_HANDLING=1 and ensure uniform token masking across all distributed training ranks.

INC-14SEV-2

Vector Database Search Quality Degradation from Index Staleness

Symptom & Telemetry

RAG retrieval accuracy drops 40%. Recently uploaded corporate documents are missing from vector search results.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandcurl -X GET "http://localhost:19530/v1/vector/collections/docs" | jq .stats
Root Cause

Vector index (HNSW) build batch job throttled under write pressure, leaving millions of vectors unindexed in raw memory.

Permanent Remediation

Decouple ingestion WAL from query segment compaction; deploy hybrid BM25 lexical + dense ANN search.

INC-15SEV-2

Cross-Region WAN Lag Violating Read-After-Write Consistency

Symptom & Telemetry

User edits profile in London, refreshes page, and sees old data routed to Frankfurt datacenter.

Reveal Diagnostic Command, Root Cause & Remediation
Diagnostic Commandping -c 10 frankfurt.internal && traceroute london.internal
Root Cause

Asynchronous cross-datacenter replication delay exceeded client HTTP redirect latency; session stickiness was missing.

Permanent Remediation

Pin recently mutated user reads to primary region via session cookie token for 5 seconds following writes.