Reconstruct an Incident Timeline from Audit Logs
Query the audit log for all actions in the incident window and produce a timeline so the postmortem has facts not memory.
Task
Instrument SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; so on-call engineers can diagnose an incident without guessing at log lines.
When to use this
An outage lasts 47 minutes because the team cannot correlate SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; across services without structured traces.
Prerequisites
- An application with structured logging available
- A metrics or tracing backend configured
Steps
1. Configure SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; in the project configuration file with the recommended defaults.
SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts;
Expected output: The configuration is accepted and SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; runs without errors on the first invocation.
2. Run the check locally to verify SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; blocks merge on failure.
- name: Run add incident timeline reconstruct
run: pnpm test
Expected output: Pull requests with failing SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Make the system observable
Start by measuring the problem. Query the audit log for all actions in the incident window and produce a timeline so the postmortem has facts not memory. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; against the current codebase and inspect the output before wiring it into CI.
SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts;Correlate across services
Once the gate is in place, make failures actionable. A failing SELECT timestamp, actor, action FROM audit WHERE ts BETWEEN $start AND $end ORDER BY ts; should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.