Have We Seen This Before? Symptom-Match Prompt
Match the current symptom signature against your own past incidents and their fixes — fast — so a recurrence is resolved from prior knowledge instead of diagnosed from scratch, collapsing time-to-diagnose.
- Target user
- On-call SREs facing a familiar-feeling incident
- Difficulty
- Intermediate
- Tools
- Claude, ChatGPT, Cursor
The prompt
You are a senior SRE with a long memory for incidents. When something breaks, your first instinct is "have we seen this shape before?" — because a recurrence solved from history is far faster than one diagnosed cold. Help me match this incident to our past ones. Paste your inputs: - The current symptom signature: [METRIC PATTERN / ERRORS / LATENCY SHAPE / AFFECTED SCOPE] - The service and conditions: [SERVICE / ENV / RECENT CHANGES / TRAFFIC] - Our past-incident corpus: [PASTE POSTMORTEMS / INCIDENT SUMMARIES / TICKET TITLES + RESOLUTIONS] Do the matching: 1. **Characterize the current signature** — distill this incident into a comparable signature: symptom shape, affected component, trigger conditions, and timing pattern. This is what you'll match against. 2. **Find candidate matches** — from the past incidents I provided only, surface the 2-4 most similar, each with a similarity score and the specific features that match (and which don't). Do not match against anything outside the corpus I gave you. 3. **Show the prior fix** — for each candidate, summarize what was actually done to resolve it and whether it was a true fix or a temporary mitigation. Pull the relevant command/action if the past record contains one. 4. **Assess transferability** — for the top match, judge whether the old fix applies here given the differences (different version? different trigger?). Be explicit about what's the same and what's changed, because "looks similar" is not "is the same". 5. **Recommend a verify-first next step** — propose the single read-only check that would confirm this really is a recurrence before anyone applies the old fix. Output format: "CURRENT SIGNATURE", then a "MATCHES" table — past incident | similarity | matching features | differences | prior fix | true-fix-or-mitigation. Then "MOST LIKELY MATCH" with a transferability assessment and one read-only confirmation check. Rank by similarity with explicit scores; only use the incidents I pasted, never invent past incidents, and present the prior fix as a candidate to verify — the human confirms it's a recurrence and decides to apply it.
Why this prompt works
This prompt compresses the diagnose phase for the large class of incidents that are recurrences. When a symptom has been seen and solved before, diagnosing it from scratch is wasted MTTR — the answer already exists in a postmortem or a ticket. The bottleneck is retrieval and matching, which is exactly where an LLM over a pasted incident corpus is strong.
The method first distills the live incident into a comparable signature, then ranks past incidents by similarity with explicit matching and non-matching features. That feature-level comparison is what separates a useful match from a dangerous one: “looks similar” and “is the same root cause” are different claims, and the transferability step forces the model to reason about what has changed (a new version, a different trigger) before suggesting the old fix applies.
The guardrails close the two ways this goes wrong. Restricting matches strictly to the pasted corpus prevents the model from confidently citing incidents that never happened, and requiring a read-only confirmation check before reusing a prior fix stops a false analogy from anchoring the team. The human confirms the recurrence and owns the decision to apply the old fix — so reuse stays fast without becoming reckless.
Related prompts
-
Diagnosis Accelerator: Verify-First Hypotheses Prompt
Turn the opening burst of telemetry into a short, ranked list of diagnoses — each paired with a single command to confirm or kill it — so the team tests the likeliest cause first and shortens time-to-diagnose.
-
MTTR Retro Analyzer: Recurring Time-Sinks Prompt
Analyze a batch of past incidents to find the time-sinks that recur across them — the phase, the step, the manual toil — and rank what to automate first, so you cut MTTR systemically rather than one incident at a time.