Exercise 1: What to Establish Before Opening Any Logs — Possible Solution
====================================================================

Per the chapter, the metrics-level questions to answer first are:

1. WHAT changed -- which specific metric(s) actually moved away from
   normal (error rate, latency, CPU, etc.)?

2. WHEN did it start -- the specific timestamp the abnormal behavior
   began, not just "recently."

3. HOW WIDESPREAD is it -- is this affecting one instance or all
   instances, one region or all regions (per `cloud1-1`'s regions/AZs
   concept)?

Why skipping this risks wasting time:

Per the chapter, this initial triage determines the SCOPE of the
investigation before diving into detail. Without first establishing
scope, an investigator has no way to know whether they should be
looking at logs from ONE specific instance or searching across an
entire fleet, or whether the relevant time window is the last five
minutes or the last hour -- leading to one of two wasteful outcomes:

- Searching too NARROWLY (assuming a single-instance problem when it's
  actually widespread), missing the real pattern because only a
  fraction of the affected systems were examined.

- Searching too BROADLY (treating a genuinely isolated, single-
  instance issue as if it might be systemic), wasting time
  investigating healthy systems that were never actually part of the
  problem.

Per the chapter's own wording, "jumping straight to logs without this
context risks getting lost in detail for a problem that's actually
much narrower or broader than assumed" -- the metrics-level scoping
step exists specifically to prevent searching the wrong-sized haystack
before any log is even opened.

WHY THIS WORKS AS AN ANSWER
------------------------------
This lists the chapter's own three specific triage questions rather
than a vague "check metrics first," and explains the wasted-time risk
in both directions (too narrow AND too broad), matching the chapter's
own framing that getting the SCOPE wrong -- in either direction --
is the actual cost of skipping this step.