# Reconstruct a Restart Storm With Annie Graph

Part 3 of the Annie Graph series

Use Annie Graph to move from a production hotspot to an evidence-backed incident timeline, triage result, and operational handoff without an LLM.

Author: Stephane Jourdan

Published: 2026-07-21

Source: https://anyshift.io/blog/annie-graph-incident-triage

`checkout-worker` restarts again. Then again. It rises to the top of the 24-hour event ranking, but no monitor is firing and the graph does not identify a root cause. That combination is still useful incident evidence.

Annie Graph can move from the hotspot to an interactive inspection, a bounded timeline, an evidence-backed triage result, and a handoff for the next responder. Each command reports what the graph observed and keeps absent or unresolved evidence visible.

## Move from the hotspot to the resource

Start with current activity rather than guessing a target:

```console
$ annie graph top --by resource --since 24h
Top resource hotspots (last 24h)
RANK  NAME                                EVENTS
1     checkout-worker (commerce)          412
2     checkout-api (commerce)             137
3     ledger-consumer (payments)           84
```

Open the explorer, press `/`, resolve `checkout-worker` in the `commerce` namespace, then inspect its brief or timeline:

```bash
$ annie graph explore
```

`graph top` identifies where activity is concentrated. The explorer lets the responder decide whether that activity deserves attention after verifying the resource type and namespace.

## See the restart sequence

Once the target is stable, request a bounded timeline:

```console
$ annie graph timeline checkout-worker --since 7d
Operational timeline for checkout-worker (last 7d)
Evidence: complete (4 sources)

TIME                  TYPE                          SUMMARY
2026-07-18T06:42:00Z  pod_crash_looping             Container entered a crash loop
2026-07-18T06:43:00Z  pod_restart_count_increased   Restart count increased
2026-07-18T06:45:00Z  pod_restart_count_increased   Restart count increased
... 24 more restart events ...

Evidence summaries
- incident: Correlated incident contains restart and crash-loop events.
- cascade: One bounded propagation step was found.
- deployImpact: No deployment fallout found for the selected target.
```

`timeline` combines the event feed with incident, cascade, and deployment-impact evidence. It is assembled at read time from independent queries, so event order and correlation are evidence rather than proof of causation.

## Keep observed, absent, and unknown separate

Now build the triage view:

```console
$ annie graph triage checkout-worker --since 7d --namespace commerce
Incident triage for checkout-worker (last 7d)
Evidence: complete (7 sources)
- [symptom/observed] Recent failure events (29)
- [symptom/none] Active Alert/Warn monitors
- [impact/none] Transitive blast radius: 0 workloads and 0 services
- [impact/unknown] Downstream service footprint could not be established
```

![Incident evidence view for checkout-worker separating observed restart and crash-loop signals from absent active alerts and an unknown downstream service footprint.](/images/blog/annie-graph-incident-evidence.svg)

The result supports four precise statements:

- **Observed:** the restart storm and crash-loop signal exist.
- **Absent:** no active monitor or correlated deployment fallout was found.
- **Unknown:** the selected target did not resolve to a downstream service footprint.
- **Unclaimed:** Annie Graph did not identify a confirmed root cause.

A zero graph-resolved blast radius records only that this query did not establish transitive impact from the selected resource; user impact remains unresolved. When a namespace-scoped common-cause query returns shared nodes, workloads, datastores, or external dependencies, Annie labels them `suspect/evidence`, never “root cause.”

## Build the handoff

The next responder needs a smaller view than the complete evidence payload:

```console
$ annie graph brief checkout-worker --since 7d
Operational brief for checkout-worker
Evidence: complete (14 sources)

Now: 0 active alerts; 29 recent events in 7d.
Impact: 0 affected pods; 0 downstream services.
Posture: 4 explicit gaps or risks.

Evidence summaries
- connections: Current graph connections were resolved.
- gitopsOwner: No GitOps application found for the selected workload.
- deployImpact: No deployment fallout found in the selected window.
- serviceTree: No downstream service tree found for this target.
```

With `--output json`, the same brief can feed an incident channel, ticket, or handoff script without scraping terminal prose.

Ownership remains deliberately narrow. `annie graph owners <hashed-id>` follows an observed Argo CD application-to-workload path. An empty result means that path was not present; human or team ownership may still exist elsewhere.

## Preserve partial evidence

Composite workflows print evidence completeness and source count before the result. They can still return useful sections when an optional source fails:

```json
{
  "completeness": "partial",
  "sources": ["failures", "alerts", "blastRadius", "serviceTree"],
  "warnings": [
    {
      "section": "commonCause",
      "code": "GRAPH_UNAVAILABLE",
      "message": "The graph source was unavailable"
    }
  ]
}
```

Required-source failures still return a non-zero CLI error. Optional failures stay beside the evidence that succeeded, so the handoff does not quietly become more confident than the graph.

Use `top` and `explore` to select the target, `timeline` to order the signals, `triage` to separate fact from inference, and `brief` to hand off the current picture.

Next in the series: [move from hotspot to guardrail with Annie Graph](/blog/annie-graph-ci-guardrails). See the [Annie CLI documentation](https://docs.anyshift.io/pages/product/integration/cli) for setup and command details.