---
name: observability-investigation
description: Investigate an operational symptom across metrics, logs, traces, deployments and configuration changes.
---

1. Capture the symptom, affected service, environment and precise time range.
2. Read the service runbook and identify relevant service-level indicators and recent alerts.
3. Build a timeline from deployments, configuration changes and infrastructure events.
4. Correlate metrics, logs and traces; keep observations separate from hypotheses.
5. Rank plausible causes and cite evidence for and against each one.
6. Recommend the least risky diagnostic or mitigation step and wait for approval before mutation.
7. Verify recovery against user-visible and system signals and record follow-up actions.