Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Start by identifying the affected business outcome, the workload and its owner, and whether the problem is an active security or availability incident. Then gather evidence before making changes: correlate metrics, logs, traces, and recent changes; prioritize the issue by customer and business impact; and use an approved, validated response procedure.
1. Establish what is affected and who owns it
Before opening dashboards or changing configuration, turn the report into a scoped problem statement. Record:
As an Amazon Associate I earn from qualifying purchases.
- The workload, service, AWS account, and region believed to be involved, plus the accountable owner.
- What users or business process are experiencing, when it began, and whether the symptoms are ongoing or intermittent.
- The users, transactions, or business functions affected and the practical consequences.
- Recent deployments, infrastructure changes, policy changes, or other events that might correlate with the start of the symptoms.
- Who is authorized to approve changes and which team must be brought in if the issue crosses ownership boundaries.
First determine whether there is an active security incident, potential data exposure, or material service outage. Escalate through the company’s incident process promptly if so. For less urgent issues, avoid modifying unfamiliar resources until their owner and the scope of your authority are clear. AWS operational guidance recommends defining expected outcomes, using measures aligned with business needs, and prioritizing events by business and customer impact. AWS operational guidance
2. Build an evidence picture before choosing a fix
Use the symptoms and time window to decide what evidence to collect. Compare current behavior with the workload’s established baseline, and correlate signals across the relevant period. A single alarm or log line may be a clue, but it rarely establishes a root cause on its own.
#1 Best Overall
- Metrics: Check the indicators tied to the affected outcome, such as service health, latency, errors, capacity, or business transactions, where those are available.
- Logs: Look for events from the relevant AWS services and from the workload’s operating system and application.
- Traces: Follow request paths across components when distributed tracing is in use.
- Change history: Correlate the onset with deployments, configuration changes, and AWS API activity.
AWS names Amazon CloudWatch, AWS X-Ray, AWS CloudTrail, and VPC Flow Logs as possible sources of workload insight for root-cause analysis. Which sources are useful depends on the workload and on what was configured before the problem occurred. AWS operational guidance
3. Check account, security, and network signals
Choose investigation sources based on the question, rather than treating any one service’s findings as a complete account assessment. In AWS security logging guidance, the foundational sources include CloudTrail, VPC Flow Logs, and Route 53 Resolver query logs; they complement rather than replace application and service logs. AWS guidance on service and application logging
| Question | Evidence to consider | What it can help establish |
|---|---|---|
| What AWS API activity occurred? | CloudTrail management events and, where configured and relevant, data events | Who or what made recorded API calls and when. Event History provides 90 days of management-event history by default, according to AWS guidance accessed in 2026. A trail and storage destination are needed for longer retention and data-event visibility; AWS says CloudTrail Lake can retain logs for up to seven years. Confirm current service limits and configuration for the account. AWS logging guidance |
| Did resource configuration change or violate an intended rule? | AWS Config configuration history, rules, and related findings | Recorded resource configuration and evaluation results, when recording and rules are configured. These are evidence for investigation, not proof that every resource is safe or compliant. AWS control-services guide |
| Are there suspicious-activity or security findings? | Amazon GuardDuty and Security Hub CSPM findings, where enabled | GuardDuty can detect suspicious activity; Security Hub CSPM can aggregate and prioritize findings. A lack of findings does not prove that an account is secure. AWS control-services guide |
| Is network traffic or name resolution relevant? | VPC Flow Logs and Route 53 Resolver query logs, where configured | Network-flow and DNS-query evidence that may help investigate connectivity, unexpected traffic, or name-resolution behavior. AWS logging guidance |
| Is a particular service or workload component failing? | Relevant load balancer, WAF, EKS, EC2 operating-system or application, and RDS logs, as applicable | Component-specific detail that account-level or network-level sources may not show. Availability depends on the service, logging configuration, and retention already in place. AWS logging guidance |
4. Select a response that fits the evidence and the risk
When the cause is understood and a validated procedure exists, use that runbook. When it is not understood, use an investigation playbook to guide evidence gathering and escalation rather than improvising a high-impact change. AWS puts it plainly: “Use established runbooks for well-understood events, and use playbooks to aid in investigation and resolution of issues.” AWS operational guidance
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAssess candidate actions against the factors that determine whether a fix is defensible:
Rank #3
- Impact and urgency: How many customers, users, or business processes are affected, and how quickly must the issue be addressed?
- Evidence strength: Does the evidence support this action, and does it cover the likely failure path?
- Security and reliability risk: Could the change expose data, weaken a control, or destabilize another component?
- Scope and blast radius: Which accounts, regions, and workloads would be affected?
- Reversibility: Can the action be safely rolled back, and is the recovery path understood?
- Ownership and approval: Is the responsible owner involved, and does the person authorizing the change have the right authority?
- Telemetry cost and retention: Would collecting or retaining more data materially change storage or query costs, and is that justified by the investigation need?
Make the smallest change that the evidence and business context support, assign an owner, and follow the required approval and escalation route. Afterward, verify that the intended outcome has returned using the same relevant indicators that defined the problem. AWS advises prioritizing event responses by business and customer impact; it does not prescribe one fix for every architecture. AWS operational guidance AWS Well-Architected Framework definitions
5. Preserve useful evidence and improve operations
Preserve relevant logs with appropriate access controls and a retention policy suited to investigation, business, and compliance needs. AWS says organizations commonly keep three months to one year of logs readily queryable and may retain logs for up to seven years depending on security, statutory, regulatory, and business requirements. These are AWS guidance figures, not universal legal requirements. The same guidance cautions against both deleting logs too soon and retaining everything indefinitely. AWS logging guidance
Once the issue is understood, update the operational material that would make the next response faster or safer: alert thresholds, runbooks, investigation playbooks, and baselines. Keep the changes tied to what the incident showed rather than adding telemetry without a defined use.
6. Use Well-Architected pillars as lenses, not a universal checklist
If the issue points to a broader design weakness, assess it in the context of the workload. AWS’s Well-Architected Framework has six pillars:
Best Value
- Operational excellence
- Security
- Reliability
- Performance efficiency
- Cost optimization
- Sustainability
These are assessment dimensions, not a rule that every problem has the same fix. A change that improves one pillar can affect another, so the appropriate trade-off depends on the business context and the workload. AWS Well-Architected Framework definitions
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
