In short: One clear ticket with the service identifier, exact symptom, timestamps and evidence is usually faster to diagnose than several short or duplicate tickets.
Choose the right department
- Technical: faults, configuration and service operation.
- Billing: invoices, payments, renewals and account charges.
- Sales: new services, upgrades and suitability questions.
- Datacentre: access, deliveries, remote hands and colocation work.
- Abuse: suspected misuse, malicious traffic or policy reports.
Include these details
- Service, domain, server or invoice identifier.
- What you expected and what actually happened.
- The complete error text or status code.
- Date and time with timezone.
- Steps that reproduce the problem.
- Recent changes and troubleshooting already attempted.
- Relevant log lines, message headers or traceroute results.
Keep evidence safe
Paste text where possible rather than sending only screenshots. Redact personal message content when it is irrelevant, but preserve timestamps, headers and error codes.
Never include secrets: Do not put passwords, private keys, API tokens, two-factor codes, card numbers or authenticator QR codes in ticket text or attachments.
During an active incident
Reply to the existing ticket with genuinely new evidence. Duplicate tickets divide the history and can slow correlation. If impact changes materially, state the new scope and time clearly.
Good example
“Website example.com returns HTTP 500 for every request from 14:32 Europe/London. A static file works. The PHP error log shows the attached exception after a plugin update at 14:20. Reverting the plugin did not resolve it.”
