Incidents at a glance
How SysAdmin Crisis picks incidents: seven types plus one variant, when they arrive and how many can run at once, each with a log signature.
Last updated:
There are seven incident types, plus one variant. Each has three parts: a log signature that identifies it, an impact curve describing what happens if you do nothing, and a resolution space — which is the part this wiki leaves for you to find.
The catalogue
| Incident | Earliest night | Weight | Needs a role |
|---|---|---|---|
| DDoS flood | 1 | 100 | web |
| Memory leak | 2 | 100 | web |
| Disk full | 2 | 100 | web |
| Database lock pile-up | 3 | 80 | db |
| Overheating | 3 | 70 | web |
| Runaway scheduled job | 4 | 85 | db |
| Certificate expiry | 4 | 55 | lb |
Weight is the relative likelihood of being picked when several incidents are eligible — a flood is picked with roughly twice the likelihood of a certificate expiry. Earliest night and the role requirement are gates: an incident that needs a load balancer cannot appear before night three, because that is the night load balancers join the rack.
Each type limits itself to one instance at a time. Two floods never run together; a flood and a leak very well can.
When they arrive
The first injection waits 120 steps — thirty seconds of quiet to read the opening state. After that the scheduler picks an interval around a base of 420 steps with up to 90 steps of jitter, and no two incidents ever arrive closer than 90 steps apart.
That interval is divided by the night's pace multiplier, which is why late nights feel relentless: the same scheduler, 1.9× faster.
| Night | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|---|---|---|---|---|---|---|---|---|---|
| Pace | 1.00 | 1.10 | 1.20 | 1.30 | 1.40 | 1.50 | 1.60 | 1.70 | 1.80 | 1.90 |
| At once | 1 | 1 | 1 | 2 | 2 | 3 | 3 | 3 | 4 | 4 |
Difficulty multiplies that pace once more — 0.7× on easy, 1.4× on hard.
The mercy window
If uptime drops below 70%, new injections are held back for 45 seconds. This is a real breather, not a hidden difficulty drop: incidents already running keep running, and the clock keeps ticking.
On the tenth night the window shrinks to 20 seconds, and once half the shift has passed the pace surges another 1.35×. The finale was designed to stop being fair.