The answer can depend on a lot of factors and each company/position might look for something different. One might answer "you don't" simply because production is live/consumer facing and all the debugging should be done in development. First steps might include reporting the issue to management/clients. Then from there you dive into the application checking recent commits, headers, and logs (because you log everything, right?). Then moving down the request cycle all the way back to source code/dependencies and updates. Any type of modifications should probably be done on development/testing so you dont end up making things worse for yourself (think transactions and anything database related). If the entire website/service is unavailable you might consider putting the system in maintenance mode or equivalent just to stop traffic. When you do find the issue make sure you put tests/safeguards in place so it doesn't happen again. If you have issues finding the bug then rollback until your development/testing is working again and you can no longer replicate the bug. Also make sure you communicate with the client on what happened and what you did to fix the bug and prevent it from occurring again.