Write incident notes the next person can use

A concise handoff format for troubleshooting across shifts.

Lead with impact

Describe who is affected, which service is degraded, when the issue began, and what still works. Use timestamps with an explicit timezone. Separate observed facts from hypotheses so the next administrator does not inherit an assumption as evidence.

Keep a useful timeline

Record the time, action, result, and relevant evidence for each meaningful step. Link to the approved log store or ticket rather than copying credentials, personal data, or large log dumps into the notes.

Make ownership clear

State the current owner, escalation contact, next action, and next update time. Note changes already made and their rollback steps. If a test was inconclusive, say why and what would make its result meaningful.

Close with verification

Document how recovery was confirmed from the user’s perspective and which follow-up work remains. A blameless review should explain contributing conditions and assign concrete improvements with owners, rather than stopping at “restart fixed it.”