Incident Investigation & Root Cause Analysis Using Observability Signals
Correlate observability signals to pinpoint incident root causes
by myriadprotocolTechnology & SoftwareEngineeringSite Reliability Engineer (standalone)ObservabilityWhat You Can Do
You provide raw logs, metrics, and traces from your incident, and Claude systematically correlates them to identify root causes rapidly. Instead of drowning in noise, you get a focused investigation workflow that prioritizes the most likely failure points and guides you to actionable insights.
Features
Example Output
Incident: API Response Time Spike
You paste logs showing connection timeouts, metrics showing 95th percentile latency spike from 50ms to 2s, and traces showing requests blocked in database pool.
Claude identifies:
ROOT CAUSE: Database connection pool exhaustion
- Pool size: 20 connections | Concurrent queries: 35
- Culprit query: SELECT * FROM events (full table scan, missing index)
- Timing: Spike begins when nightly batch job starts at 14:32 UTC
Evidence:
- Metrics: DB CPU ↑ 400%, I/O wait ↑ 90%
- Logs: "connection pool timeout" errors starting 14:32:15
- Traces: P99 latency in query_events ↑ 250ms
- Correlation: Batch job + API traffic overlap every night
Incident: Memory Leak in Microservice
You paste heap usage metrics showing linear growth, Java GC logs, and container restart logs.
Claude identifies:
ROOT CAUSE: Unreleased HTTP connection handles
- Heap grows ~50MB/hour after v2.3.1 deploy (2026-07-15)
- GC logs show Eden generation survivors retained
- Container hits 1.8GB limit, OOMkiller restarts service every 6 hours
- Code change: v2.3.1 introduced HTTP pooling without proper cleanup
Fix: Add connection pool draining in shutdown hook
Temporary: Lower container memory threshold for graceful restart
What's Included
- SKILL.md: Claude instructions for incident investigation and signal correlation
- Investigation Workflow Template: Systematic step-by-step checklist for production incidents
- Query Checklists: Pre-built investigation queries for common incident patterns (latency spikes, error cascades, resource exhaustion)
- Signal Correlation Framework: Guidelines for mapping logs → metrics → traces → root cause
- Root Cause Analysis Worksheet: Structured template for documenting findings and evidence chains
- Runbook Generator: Template for creating documented incident runbooks from findings
Who It's For
- Site Reliability Engineers (SREs) — Rapid incident diagnosis during critical production outages
- DevOps Engineers — Infrastructure troubleshooting and observability-driven debugging
- On-Call Responders — Fast triage and root cause identification to reduce MTTR
- Platform / Backend Engineers — Service reliability troubleshooting and post-mortem analysis
- Engineering Managers — Systematic root cause documentation for incident reviews
Best For
- Production incident response — Diagnose and stabilize active outages in real time
- Post-mortem root cause analysis — Document findings and evidence chains for incident reviews
- Distributed system failures — Correlate errors across microservices and dependencies
- Performance degradation — Identify latency spikes, resource exhaustion, and cascading failures
- Data pipeline debugging — Trace failures through logs, scheduled jobs, and database queries
You might also like
You can systematically diagnose database performance bottlenecks by sharing your schema, slow query logs, and execution plans with Claude. It identifies root causes—missing indexes, inefficient joins, lock contention—and provides prioritized recommendations with ready-to-implement SQL. Skip the manual log analysis and get tuning strategies tailored to your workload.
Use Claude to systematically analyze your database queries, execution plans, and schema to identify performance bottlenecks. The skill generates actionable optimization recommendations with SQL rewrites, index strategies, and configuration tuning. You'll receive detailed before-and-after performance analysis to validate improvements and prioritize work by impact.
This skill evaluates your research protocols against institutional review board requirements, identifies compliance gaps, and generates the documentation needed for IRB submission. You receive a detailed assessment report, risk analysis, and ready-to-use documentation templates tailored to your specific research design.
You can systematically evaluate cloud platforms, document architectural decisions with tradeoffs, and validate designs against security and compliance requirements. This skill accelerates architecture reviews, ensures consistency across teams, and reduces the cycles needed to reach approval on complex infrastructure decisions.
You'll design and implement mobile features with architectural rigor, cross-platform considerations, and edge-case handling built-in. This skill generates complete system designs, platform-specific implementation strategies, performance optimization approaches, and testing frameworks. The output is production-ready guidance spanning iOS and Android with security, offline resilience, and deployment strategies included.
Design and optimize injectable formulations by analyzing your active pharmaceutical ingredient (API), selecting compatible excipients, and predicting stability outcomes. You'll receive systematic workflows that guide you through API characterization, formulation architecture, and risk mitigation—enabling faster development cycles and regulatory-ready documentation.
You'll develop systematic approaches to injectable formulation design, from API selection through sterilization strategy. Claude helps you troubleshoot failed batches by analyzing root causes, recommends regulatory pathways (505(b)(2), ANDA, NDA), and provides science-backed solutions for stability, compatibility, and manufacturability challenges.
Analyze Solidity and other smart contract code for security vulnerabilities, gas inefficiencies, and best practice violations. Get detailed reports with risk scoring, remediation suggestions, and optimization recommendations. Whether you're auditing before deployment or reviewing third-party contracts, this skill identifies critical issues faster than manual review.