Product · Operations
06:20. The field crews have no work orders on their handhelds.
One incident, minute by minute. Diagnose states the cause, the observations behind it and the alternatives it eliminated, then attaches the runbook. The engineer on call decides what happens to the estate.
The incident, in full
Eleven minutes, and two of them belong to a person
Illustrative, shaped like incidents on estates MaxIron operates.
-
06:20
Sentinel reports mobile sync failing on production. Sign-in and work order creation are still passing.
Written The failing step, the environment, and the last successful run at 01:35.
-
06:21
Diagnose runs five discriminators in a fixed order and narrows to one outbound integration flow on one site.
Written Each question and its answer, against the incident.
-
06:22
Cause stated: the consumer connection has been refused since an approved credential rotation at 01:38.
Written The cause, the observations supporting it, and the four alternatives eliminated.
-
06:26
The engineer on call restores now rather than waiting for the endpoint owner at 08:00. Early crews are on site at 07:00.
Written The decision and the reason, in the engineer's own words.
-
06:31
The runbook runs and the queue drains in order.
Written The action taken, who took it, and when the journey cleared.
Diagnose named the cause and produced the evidence. The two beats that changed the estate are the two with a person on them, and Autoheal acts only where the condition was agreed in advance.
Method
Five discriminators, asked in the same order every time
Triage speed comes from questions that split the possibilities quickly, in a fixed order, with the answers written down rather than held in somebody's head.
| Ref | The question | What the answer settled |
|---|---|---|
| D1 | Is it everyone, or one site? | One site, one flow. Desktop users on the same environment were saving work orders. A full outage was out inside the first seconds. |
| D2 | Is the platform inside its limits? | Hosts, containers and database sessions sat inside their thresholds for the whole window. Resource pressure was out. |
| D3 | Is anything queued and not moving? | The outbound queue for that flow had grown since 01:40 with nothing leaving it. That became the thread to pull. |
| D4 | Is it new since a change? | A credential rotation on the receiving endpoint completed at 01:38 in an approved window, two minutes before the queue began to grow. |
| D5 | Is the dependency answering? | The endpoint was reachable and healthy, refusing the connection rather than failing to answer. A network theory became a credential answer. |
In daily use on Maximo estates MaxIron operates, second link after Sentinel, ahead of Autoheal, alongside Cloud Manager and Change Control in MaxIron managed hosting.
The same night, two ways
One outbound flow, one approved change at 01:38
The repair costs the same in both columns. The search does not.
Without a stated cause
Three people woken to eliminate three theories
- 1
06:20 An alert with no scope
A red icon on mobile sync. Whether it is one site or the estate is the first thing somebody has to establish.
- 2
06:35 Evidence in five places
Application logs, database sessions, integration queues, cron history and a change record, each behind its own access request.
- 3
07:10 A call convened
Network, database and mobile ruled out in sequence, one specialist at a time.
- 4
07:55 The same action
The connection is restored and the queue drained, an hour and a half after the first alert.
With Diagnose
One action, at 06:31
- 1
06:20 An alert with scope
The failing step, the environment and the last successful run travel with the alert.
- 2
06:22 A cause with evidence
A refused consumer connection since 01:38, with four alternatives eliminated on the record.
- 3
06:26 One decision
Restore now, or wait for the endpoint owner. That trade belongs to the engineer on call.
- 4
06:31 The action
The runbook runs, the queue drains in order, and the incident record already holds the reasoning.
The next morning the record carries the cause, the evidence, what was eliminated, who acted and when it cleared.
The arithmetic
Where an incident spends its time
1h 35m
Search, on the night above
2 min
Search, with the discriminators run
Restoring a connection and draining a queue takes an engineer as long as it takes. Diagnose works on elimination.
Illustrative. Your own split is in your last ten incident records.
Boundaries
Three boundaries on an automated diagnosis
Worth knowing before procurement rather than after.
Findings reach the incident record and stop there
Diagnose writes findings to the incident record and stops. Estate changes are made by a person, or by an Autoheal playbook whose condition and ceiling you agreed in advance.
A new failure mode is still new
Outside the curated patterns, Diagnose reports what it narrowed and eliminated rather than naming a cause it cannot evidence. The engineer does the thinking.
It reasons only about signals that exist
Where telemetry was never collected, or retention is shorter than the gap between cause and symptom, the cause may not be reconstructable. Scoping states which retention windows change first.
MaxIron Diagnose, frequently asked questions
- What does Diagnose do that Sentinel does not?
- Sentinel states that a journey is failing. Diagnose states what is causing it, what that rules out, and which runbook applies.
- Does Diagnose change anything in our estate?
- No. It writes findings to the incident record and stops. Acting on a pre-agreed condition is Autoheal; everything else is a person with a runbook.
- Does it ever say that it does not know?
- On an unfamiliar failure it reports what it narrowed and what it eliminated, with the evidence, rather than naming a cause it cannot support. A confident wrong answer at 04:00 costs more than a partial one.
- What if the cause turns out to be a change we made?
- It says so, factually, by correlating the failure with the change record. Change Control holds the approval, the evidence and the rollback.
- Do we need Sentinel to use Diagnose?
- No, but the alert arrives with its scope already stated when Sentinel feeds it. Diagnose also reads existing monitoring signals where those carry the failing step.
Bring us your last incident.
We walk it the way this page does: symptom, what should have been eliminated first, where the cause sat, and which minutes Diagnose would have removed.
Bring this to the first call
- The timeline of your last serious Maximo incident, however rough
- The tools somebody had to open, and who held access to each
- Who was paged, when, and who turned out not to be needed
- Which of your last five incidents were repeats