Practice investigating production-style incidents from evidence.
Start from an incident report, inspect logs, metrics, traces, and config, then choose the safest first action. Each incident is a curated scenario — you read the evidence, build a timeline, and commit to a diagnosis. No live systems, no dashboards to babysit.
Open incidents
Checkout p95 latency jumps right after a deploy. Error rate stays low, but confirmations crawl. Find what the deploy changed and the safest first move.
Login starts throwing bursts of 500s. The auth service errors on token validation, but the database looks perfectly healthy. Find the real dependency at fault.
Users see items as available after stock was already reserved. There's no 5xx spike — it's a correctness problem. Find why reads are stale and the safest first move.
How a diagnosis is scored
Each incident is graded objectively out of 100: name the primary symptom (20), the likely cause category (20) and the likely cause (20), choose the safest first action (20), mark the key evidence (10), and reference a real signal in your note (10). After you submit, the expected diagnosis, the key evidence, and a Buglyst reference diagnosis are revealed so you can compare your read.