A cloud engineer receives alerts that a customer-facing web application on a Linux VM has stopped responding. The application process is running but returns HTTP 500 errors for every request. System metrics show CPU and memory are well within normal ranges, but application logs stop being written at the exact time the errors began. Following a structured troubleshooting methodology, what should the engineer check FIRST?