Investigation Techniques
Problem Categorization
Technical Problems
| Category |
Sub-Category |
Common Symptoms |
| System Failures |
App crashes, memory leaks, deadlocks, data corruption |
Service unavailability, resource exhaustion, integrity errors |
| System Failures |
Hardware, network, database, security |
Connectivity loss, capacity limits, access failures |
| Performance |
Response time: slow queries, latency, algorithmic inefficiency |
High p95/p99, user-reported slowness |
| Performance |
Throughput: thread pool exhaustion, connection limits, queue backlog |
Reduced capacity, growing queues |
| Integration |
Internal: component comms, data format, version conflicts |
Interface errors, serialization failures |
| Integration |
External: third-party availability, API changes, auth failures |
Timeouts, contract violations |
Operational Problems
| Category |
Common Symptoms |
| Deployment: script failures, config drift, migration errors |
Failed releases, environment inconsistencies |
| Monitoring: alerting gaps, backup failures, incident response |
Missed incidents, slow recovery |
| Human factors: communication gaps, knowledge silos, skill gaps |
Repeated mistakes, slow onboarding |
Evidence Collection
Technical Evidence Sources
Logs: application (timestamp correlation) | system/infrastructure | database | network traces
Metrics: performance/resource utilization | error rates/response time trends | user behavior/transaction patterns | infrastructure health/capacity
Configuration: system/deployment settings | code changes/VCS history (git log, blame) | env vars/dependencies | security/access controls
Evidence Validation
- Cross-reference: verify from multiple independent sources
- Timestamp validation: confirm event sequence accuracy
- Completeness check: identify data gaps/corruption
- Correlation vs causation: distinguish co-occurrence from causation
Analysis Techniques
Quantitative
- Trend: time series of metrics, error pattern frequency
- Distribution: response time percentiles, error rate across components
- Pattern recognition: log anomalies, behavior patterns, error clustering
Qualitative
- Timeline reconstruction: detailed incident timeline, correlate changes with symptoms
- Process analysis: workflow disruptions, communication flow, decision chains
- Environmental: recent changes, system load, external factors, related incidents
Solution Design Patterns
Immediate Mitigations (restore service)
Quick fixes | workarounds to minimize impact | emergency procedures | monitoring enhancements
Permanent Fixes (prevent recurrence)
Architecture modifications | code quality/defensive programming | config management/environment consistency | testing/validation improvements
Early Detection (catch faster)
Leading indicators | anomaly detection/predictive alerting | automated quality gates | threshold tuning from learnings
Solution Prioritization Matrix
| Priority |
Criteria |
Action |
| P0 |
Active incident, users impacted |
Immediate mitigation, hours |
| P1 |
Root cause fix for recurring issue |
Permanent fix, current sprint |
| P2 |
Prevention for potential issues |
Next sprint |
| P3 |
Systemic improvement |
Backlog with evidence |
Source: nWave-ai/nWave → nWave/skills/nw-investigation-techniques/SKILL.md
Also appears in: nWave-ai/nWave/plugins/nw/skills/nw-investigation-techniques/SKILL.md
1---2name: nw-investigation-techniques3description: Evidence collection methods, problem categorization, analysis techniques, and solution design patterns4---567# Investigation Techniques89## Problem Categorization1011### Technical Problems1213| Category | Sub-Category | Common Symptoms |14|----------|-------------|-----------------|15| System Failures | App crashes, memory leaks, deadlocks, data corruption | Service unavailability, resource exhaustion, integrity errors |16| System Failures | Hardware, network, database, security | Connectivity loss, capacity limits, access failures |17| Performance | Response time: slow queries, latency, algorithmic inefficiency | High p95/p99, user-reported slowness |18| Performance | Throughput: thread pool exhaustion, connection limits, queue backlog | Reduced capacity, growing queues |19| Integration | Internal: component comms, data format, version conflicts | Interface errors, serialization failures |20| Integration | External: third-party availability, API changes, auth failures | Timeouts, contract violations |2122### Operational Problems2324| Category | Common Symptoms |25|----------|-----------------|26| Deployment: script failures, config drift, migration errors | Failed releases, environment inconsistencies |27| Monitoring: alerting gaps, backup failures, incident response | Missed incidents, slow recovery |28| Human factors: communication gaps, knowledge silos, skill gaps | Repeated mistakes, slow onboarding |2930## Evidence Collection3132### Technical Evidence Sources3334**Logs**: application (timestamp correlation) | system/infrastructure | database | network traces3536**Metrics**: performance/resource utilization | error rates/response time trends | user behavior/transaction patterns | infrastructure health/capacity3738**Configuration**: system/deployment settings | code changes/VCS history (git log, blame) | env vars/dependencies | security/access controls3940### Evidence Validation411. **Cross-reference**: verify from multiple independent sources422. **Timestamp validation**: confirm event sequence accuracy433. **Completeness check**: identify data gaps/corruption444. **Correlation vs causation**: distinguish co-occurrence from causation4546## Analysis Techniques4748### Quantitative49- **Trend**: time series of metrics, error pattern frequency50- **Distribution**: response time percentiles, error rate across components51- **Pattern recognition**: log anomalies, behavior patterns, error clustering5253### Qualitative54- **Timeline reconstruction**: detailed incident timeline, correlate changes with symptoms55- **Process analysis**: workflow disruptions, communication flow, decision chains56- **Environmental**: recent changes, system load, external factors, related incidents5758## Solution Design Patterns5960### Immediate Mitigations (restore service)61Quick fixes | workarounds to minimize impact | emergency procedures | monitoring enhancements6263### Permanent Fixes (prevent recurrence)64Architecture modifications | code quality/defensive programming | config management/environment consistency | testing/validation improvements6566### Early Detection (catch faster)67Leading indicators | anomaly detection/predictive alerting | automated quality gates | threshold tuning from learnings6869### Solution Prioritization Matrix7071| Priority | Criteria | Action |72|----------|----------|--------|73| P0 | Active incident, users impacted | Immediate mitigation, hours |74| P1 | Root cause fix for recurring issue | Permanent fix, current sprint |75| P2 | Prevention for potential issues | Next sprint |76| P3 | Systemic improvement | Backlog with evidence |7778---7980**Source:** [`nWave-ai/nWave`](https://github.com/nWave-ai/nWave) → `nWave/skills/nw-investigation-techniques/SKILL.md`8182**Also appears in:** `nWave-ai/nWave/plugins/nw/skills/nw-investigation-techniques/SKILL.md`
thedixitjain