When to use
The script is needed when the error rate increases in Web Stats or repeated 4xx/5xx appear, and the team needs to quickly gather an evidentiary picture for incident resolution.
Prerequisites
- The online and Web Stats server transmits up-to-date data.
- The user role allows working with web metrics and incidents.
- For feature active plan where forensic PDF report is available.
Steps
- Open the desired server and go to Web Stats.
- Make sure the RPS/error rate dynamics are updated in real time.
- Start formation Forensic PDF report in 7 days.
- Wait for the collection to complete: the UI shows the progress of the preparation.
- Download the PDF and attach it to the incident or submit it to the SOC/SRE.
How to read the result
- Highlight the IP with the highest percentage of error events.
- Check for waveform repeatability in the time window.
- Map findings to perimeter changes, alerts, and audit events.
What to check after the action
- After protective changes, the error rate returns to the working baseline level.
- The decision and the actual result are recorded in the timeline of the incident.
- The team has a single PDF artifact to transfer between shifts.