Read logs for five minutes before proposing theories…
Before acting on snap judgments during debugging or incident response, read system logs and dashboards for five minutes without proposing theories to prevent hypothesis anchoring from corrupting observation.
When This Fires
- Production incident: alarms are firing and people are assembling in a war room
- Debugging session: a bug report just landed and you have an immediate gut feeling about the cause
- Performance investigation: metrics dropped and the first chart you see suggests an obvious culprit
- Any situation where time pressure creates urgency to "just fix it"
Common Failure Mode
Treating the five-minute observation window as wasted time during an outage. The pressure to act feels overwhelming — users are affected, leadership is asking for updates, and you're "just sitting there reading logs." But the five minutes you spend observing now save the thirty minutes you'd spend chasing a wrong hypothesis, reverting a bad fix, and starting over from scratch.
The Protocol
When an incident begins: (1) Open logs, dashboards, and monitoring. (2) Set a literal 5-minute timer. (3) Read without talking, without hypothesizing, without typing commands. (4) After the timer, write down the three most surprising things you observed. Those surprises — the things that don't match your initial assumption — are almost always closer to the root cause than your first instinct was.