Start with the affected resource
A VM behaves unexpectedly after an intervention. Before changing its configuration again, identify its VMID, hosting node and the time of the incident. These three details narrow the investigation and help distinguish events affecting similarly named machines.
Read the before-and-after values
A configuration event becomes more useful when it shows the affected parameter and successive values. A CPU core change differs from a network change. ProxTrace connects observed changes to their resource; before-and-after values are shown when supported by the sources.
Check the evidence and context
Review the time, author when identifiable, task and original observation. Temporal proximity alone does not establish the cause of an incident: compare the event with the symptoms and check other changes during that period. A migration or backup task may provide useful context without causing the problem.
Keep an actionable record
The aim is to preserve the reasoning: which resource changed, during which period and what evidence supports the conclusion. The ProxTrace demo lets you browse an example change and its details without connecting your environment.