What gaps in your incident notes mean, and what to do about them
Every incident record has silent periods. The difference between a trustworthy postmortem and a shaky one is what you do with those gaps.
Why gaps happen
Nobody keeps perfect notes during an incident. The person on call is also reading dashboards, talking to colleagues, running commands, and maybe waking up. Gaps in a timeline are not a sign of carelessness; they are a normal property of incident response. Common causes include:
- Handoffs. The person who was on call at 3am hands over to a day shift at 8am. The handover itself is rarely timestamped.
- Long investigations. Forty minutes of reading logs and testing hypotheses produces no entries, because nothing is "happening" that seems worth writing down.
- Communications elsewhere. A decision was made in a phone call or a side channel, not in the channel where notes were being kept.
- Waiting. "Waited for the restart to complete" is real work that produces no log line unless someone writes it.
Why gaps matter
A gap is a question the record cannot answer. It might hide the moment the wrong assumption was made, or the wait that doubled the incident duration, or nothing at all. If you fill the gap with a guess, the reader cannot tell which parts of the timeline are fact and which are invention — which makes the entire document unreliable.
This is why Logtrace marks gaps explicitly. Any window of five minutes or more with no entries is rendered as an amber block showing the exact time range and duration: "Gap: 45 minutes — no entries between 10:45 and 11:30." You decide what the gap means; the tool makes sure you cannot accidentally overlook it.
How to investigate a gap
When a gap matters — it usually does, if it covers a period where something changed — work it like a lead:
- Ask the people involved. The on-call who lived through it can usually reconstruct the missing stretch in thirty seconds.
- Check system history. Dashboard history, deploy timestamps, and alert logs often cover the same window from the machine's side.
- Check the handover. Shift changes are the most common source of gaps, and the handover notes are the most likely place to find what the timeline lost.
If you reconstruct the missing period, add the entries to your notes with the correct timestamps and re-run the timeline. If you genuinely cannot find out, do not invent: write "unknown — no record of this period", and add a follow-up action if the silence itself was a problem.
When a gap is fine to leave
Not every silent period deserves investigation. A gap in the middle of a stable overnight stretch, with no changes on either side, is often just a quiet system. Investigating every five-minute window turns a useful exercise into busywork. Use the gap's size and position as your guide: gaps that touch a change, an alert, or a handoff earn a closer look; gaps between two quiet entries are usually harmless.
Gaps as process feedback
Once you have written a few postmortems, your gaps start to look similar. Repeated silence in the same kind of window is a signal about your process — maybe the incident channel needs a pinned "current status" message, maybe handovers should be timestamped, maybe the on-call needs a lightweight place to jot notes. The gaps are not failures to hide; they are the cheapest diagnostics your incident process will ever give you.
Start with the raw material: paste your notes into Logtrace, see the gaps laid out honestly, and decide which ones to chase.