A customer reports the app is broken but you cannot reproduce it. What do you look at?

Start with specifics: which account, what time, what action, what they saw. Then follow that request across logs, traces and error reports by a shared request or trace id, so you see the whole path instead of one service. Compare error rate and latency against the same window yesterday to separate a real regression from background noise. If nothing shows up, the gap is instrumentation, so add structured logging on that path.

The first thing I do is turn the report into something searchable: account id, rough timestamp with a timezone, which button, what appeared on screen. Vague reports stay unsolvable, so that conversation is worth five minutes. Then I go to the trace for a request in that window and follow it across services, because a single service log line rarely tells you whether the failure was ours, the database or a third party. Alongside that I look at error rate and latency compared to the same time the previous day, since a spike that started at a known deploy time is usually the whole answer. Something I have learned to check early is whether it is environmental: one region, one browser, a stale service worker serving old assets, or a corporate proxy stripping a header. If nothing is visible anywhere, I stop hunting and treat that as the finding, then add structured logs with the request id, user id and the decision branches on that path so the next report takes minutes. Logs get identifiers, never tokens or personal data.