A running process is evidence that a process is running. It is not evidence that the service people depend on is available.
Begin at the boundary
When something becomes unreliable, the instinct is often to begin with the most detailed internal signal available: process state, memory usage, application logs or container health.
Those signals matter, but they answer narrower questions. The first useful question is usually simpler: can the intended client reach the intended interface?
Internal health describes a component. External health describes the service people can actually reach.
Work inward
Once the boundary behaviour is known, move inward one layer at a time: name resolution, connection establishment, transport, edge service and application behaviour.
This keeps the investigation attached to observable behaviour rather than assumptions about what should be happening.