Solid checklist. The piece I wish teams always grabbed first is a bounded journal slice with wall-clock and monotonic timestamps together — something like journalctl -u --since "20 min ago" -o short-iso — plus systemctl show for NRestarts, ExecMainStatus, and the last result codes. That often survives a rushed restart better than memory of "it was failing".

One more cheap capture before touching anything: df -h and df -i on the volumes the service writes to. Inode exhaustion looks like a mystery crash until those two lines are in the incident notes, and a restart alone will not fix it.