When Your Server or System Goes Down: Emergency Triage Steps

When a server or business system suddenly goes down, don't start poking at hardware randomly. Checking things in the following order is the fastest path to a diagnosis. Restarting several devices at once or repeatedly unplugging and reconnecting cables out of panic will only make the cause harder to find and delay recovery.

- ① Check the scope of impact (is everyone affected, or just some people?) — getting this wrong often leads you to suspect the wrong thing
- ② Check the physical state of power and network connections — a loose plug, a bad cable connection, or a tripped breaker are common, simple causes
- ③ Check the state of the hardware (the server itself, routers, etc.) — look at status lights and any error indicators
- ④ Check for problems on the software/application side — if the hardware looks fine, suspect an application or database error

The fastest route to a diagnosis starts with the scope of impact. Simply asking "is everyone affected or just one person?" and "is it just the internal system, or is the internet connection itself down?" narrows down where to look considerably. Use the table below to find the pattern closest to your situation.

If your diagnosis points to a problem with the hardware itself and there's no sign of unauthorized access, restarting is often the simplest fix. But pressing the power button without following the steps below can make later investigation much harder.

- First, record the error message and screen state with a photo or notes (an important clue for later investigation)
- Notify affected users of the temporary disruption (giving them time to save any work in progress)
- Restart the server using its normal shutdown procedure (a forced power cut should be a last resort — it raises the risk of data corruption)
- After restarting, verify the integrity of any data that was being processed (check that order or accounting data wasn't left mid-transaction)

Even if the problem looks like a simple glitch, do not restart if any of the following apply — contact your maintenance vendor or an expert first. A hasty restart can make the damage worse or make the root cause impossible to determine.

- Unauthorized access such as ransomware is suspected (see emergency response to ransomware for details)
- An error occurred while data was being written to a database
- The system keeps crashing for an unknown reason (possible hardware failure — repeated restarts can cause further damage)
- A process is running whose data could be lost if the system restarts
- There are signs of physical trouble, like a burning smell or unusual noise (don't force the power on — contact the manufacturer instead)

If you have a maintenance contract, contact the desk listed in the agreement and check whether an after-hours emergency contact exists, along with the expected response time (SLA). If you don't have a contract, or can't reach anyone, refer to what to do when you can't reach your vendor to find an alternative contact. If nobody on staff is deeply familiar with the system, it's also important to decide early not to force a DIY fix and instead bring in outside help sooner rather than later.

- Record the cause and the actions taken in chronological order (useful reference if the same symptom appears again)
- Confirm that backups are being taken correctly (the outage itself may have interrupted your backup process)
- Consider configuration changes or improved monitoring to prevent the same issue from recurring
- If partners or customers were affected, once things have settled, briefly explain what happened and what you're doing to prevent it recurring

To avoid repeating ad-hoc recoveries, it's essential to review your ongoing maintenance setup. With regular inspection and monitoring in place, many failures can be caught as early warning signs before a system "suddenly" goes down. See the complete guide to IT maintenance and operations for an overview of how to structure it. For initial response to other kinds of IT trouble — such as email outages or website issues — see the IT emergency first response guide as well.