Start an incident timeline with the systemd journal

Start with the first user-visible failure. Write down its approximate time and the name of the service you expect to handle the request.

journalctl -u example.service --since "30 minutes ago" --utc -o short-iso

Compare the first error with any restart or reload in the same time window. If the process changed, check the messages on both sides of the change. Confirm the sequence against one request whose outcome you know.

If you share an excerpt, keep the timestamp and error type. Remove credentials and request data.