Five Whys is a simple analysis method in which you state a problem, ask why it happened, then ask why about each answer until you reach a cause you can act on. Five is a rule of thumb, not a requirement.
Why it matters
Incidents are usually closed with the first cause found, such as "the disk filled up", which invites a one-off fix. Asking again exposes the process gap behind it, such as missing alerts or no log rotation. Used in a blameless postmortem it keeps attention on systems and decisions, not on whoever pressed the button. Its weakness is that it follows a single chain, though real failures often have several contributing causes.
Example
The site was down for 40 minutes. Why?
1. The database refused connections. Why?
2. Disk was full. Why?
3. Slow-query logs grew without limit. Why?
4. Log rotation was never configured on the new server. Why?
5. The server was built by hand, not from the standard template.Fix actions: rotate logs, alert at 80% disk, and build servers from the template.
Common mistakes
- Stopping at a person ("operator error") instead of the process that allowed it.
- Following only one chain when several factors contributed.
- Producing actions with no owner or date.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.