--- title: "Postmortem 5-Whys Root Cause Extractor Prompt | Vezz me" description: "Download the Postmortem 5-Whys Root Cause Extractor JSON preset for Vezz me. Highlight incident narratives or outage timelines to extract blameless 5-Whys chains." canonical_url: "https://vezz.me/prompts/postmortem-5-whys-root-cause-extractor/" type: "pseo-prompts" category: "prompts" topic: "SRE & Incident Review Preset" intent: "Best for SREs, DevOps engineers, and engineering managers conducting blameless postmortems and writing root-cause analysis (RCA) documents." --- # Postmortem 5-Whys Root Cause Extractor Prompt | Vezz me Download the Postmortem 5-Whys Root Cause Extractor JSON preset for Vezz me. Highlight incident narratives or outage timelines to extract blameless 5-Whys chains. > **Best fit:** Best for SREs, DevOps engineers, and engineering managers conducting blameless postmortems and writing root-cause analysis (RCA) documents. ## Live Webpage Walkthrough - **Source:** Public Infrastructure Outage Report — DNS Auth Server Flapping (`status.example-dns.com/incident-2026-10`) - **Recommended Context Mode:** Detailed **Highlighted Passage:** > At 16:30 UTC, an engineer pushed a zone file update with a syntax error that passed the local CLI linter. The authoritative nameservers crashed upon reloading the malformed file. When the health check noticed the processes down, it restarted all 200 nodes simultaneously, triggering a thundering herd on the central configuration storage and preventing any server from starting for 45 minutes. **User Question (Shortcut):** "Extract a blameless 5-Whys root cause chain and failure amplifier from this postmortem." **Vezz me On-Screen Answer:** 1. **Blameless 5-Whys Chain**: - *Why did DNS resolve fail?* All 200 authoritative nameservers crashed simultaneously. - *Why did they crash?* They loaded a zone file containing a syntax error. - *Why did they load a malformed file?* The CLI linter did not match the nameserver daemon's strict runtime grammar. - *Why did all 200 reload at once?* The deployment system lacked staged canary rollouts. - *Why was recovery delayed 45 minutes?* Automated crash loops caused an unthrottled thundering herd on central storage without backoff. 2. **Metastable Amplifier**: Simultaneous crash-loop restart storm overwhelmed the config backend. 3. **3 Action Items**: Add canary deployments (1 node -> 10% -> 100%); decouple runtime validation; add exponential backoff on daemon restarts. **Suggested Follow-Ups:** - "How would a circuit breaker prevent this thundering herd on central storage?" - "Draft a 2-paragraph blameless executive summary for leadership." ## Custom Prompt Preset for Vezz me - **Preset Name:** Postmortem 5-Whys Root Cause Extractor - **Recommended Context Level:** Detailed - **JSON Preset Download:** https://vezz.me/prompts/presets/postmortem-5-whys-root-cause-extractor.json ```text Act as a Principal Site Reliability Engineer analyzing the selected incident timeline or outage report: 1) Blameless 5-Whys Chain: construct a strict causal chain drilling from the surface symptom down through latent organizational/systemic vulnerabilities (never blame a human error or 'bad deploy'), 2) Metastable Feedback Loop: identify what amplified the outage (e.g., retry storms, health-check cascades, connection starvation), 3) Detection & Mitigation Gaps: state what telemetry was missing during the incident, and 4) Action Items (Prevent, Detect, Mitigate): suggest 3 concrete engineering fixes. ``` **Why it works:** Enforces the blameless postmortem principle: refuses to stop at 'developer pushed a bad config' and forces the causal chain down to missing blast-radius bounds and circuit breakers. ## Step-by-step workflow 1. **Download and import the JSON preset above**: Save `postmortem-5-whys-root-cause-extractor.json` and import it into Vezz me via Saved Prompts -> Import. 2. **Highlight the technical incident sequence or timeline**: Select the engineering description in Notion, Confluence, Slack incident canvas, or public status page. 3. **Copy the 5-Whys and Action Items into your RCA document**: Paste the generated Markdown directly into your company's postmortem template. ## Move beyond human error in incident reviews Stopping an incident investigation at 'an engineer made a mistake' ensures the exact same outage will happen again six months later. - Focuses on why the system allowed a single mistake to cause an unbounded blast radius - Separates the surface trigger from latent systemic defects and failure amplifiers - Generates actionable tasks categorized into **Prevent** (stop recurrence), **Detect** (alert faster), and **Mitigate** (shed load) ## Frequently asked questions ### Is this preset safe to use on internal company incident reviews? Yes! Vezz me uses activeTab only—it never scrapes your internal wiki in the background and only processes the specific timeline passage you highlight. ### Can I customize the postmortem template output? Yes! After importing into Vezz me, you can edit the prompt text to match your company's exact Jira or Confluence postmortem headers. ### Where can I read our related incident workflow guide? See our complete guide: Summarize Incident Postmortems & Status Pages. ## Related guides - [Summarize Incident Postmortems & Status Pages](https://vezz.me/use-cases/summarize-incident-postmortems-and-status-pages/): How to extract lessons from public and internal outage reports. - [RFC & System Design Critic Preset](https://vezz.me/prompts/rfc-and-system-design-critic/): Identify single points of failure before code is written. - [Internal Company Wikis & Intranets Permission Audit](https://vezz.me/permissions/internal-company-wikis-and-intranets/): Why activeTab protects internal incident postmortems. - [Vezz me for Software Developers](https://vezz.me/for/software-developers/): Browser workflows for backend and reliability engineers.