Library
Incident runbooks
Operational decision aids for use during incidents — not articles. Symptoms first, safety actions before diagnostics, copyable commands, and a verification step so you know when it is actually over.
ALB 5xx spike
reviewed 2026-09-195xx on the Application Load Balancer: split ELB-generated 502/503/504 from target-side errors first — they have completely different fixes.
12 canonical sections · 4 command blocks
Kafka consumer lag
reviewed 2026-09-21A consumer group's lag is climbing and the lag alert is firing — triage whether it is the consumer, the broker, or a rebalance storm, and drain it safely.
12 canonical sections · 3 command blocks
Kubernetes CrashLoopBackOff
reviewed 2026-09-21A pod restarts in a loop and its container status shows CrashLoopBackOff — find the exit reason from the pod spec and logs before reaching for restarts.
12 canonical sections · 3 command blocks
Kubernetes Node NotReady
reviewed 2026-09-19A node reports NotReady and its pods stop rescheduling — decide between reviving the kubelet and replacing the node before workloads starve.
12 canonical sections · 5 command blocks
Kubernetes OOMKilled
reviewed 2026-09-19The container exits 137 with reason OOMKilled — separate a limit set too low from a genuine leak, and size memory from measurements, not guesses.
12 canonical sections · 4 command blocks
PostgreSQL connection exhaustion
reviewed 2026-09-19"FATAL: too many clients already" or app pool waiters climbing — find who holds the slots, free them safely, and size the pool against max_connections.
12 canonical sections · 5 command blocks
PostgreSQL slow query
reviewed 2026-09-19A query that used to be fast is now slow — read the real plan with EXPLAIN (ANALYZE, BUFFERS), then fix the cause: stats, index, bloat, or lock queue.
12 canonical sections · 5 command blocks
RDS high CPU
reviewed 2026-09-21CPUUtilization on the RDS instance is pegged and queries are queueing — separate a bad query from a sizing ceiling before scaling.
12 canonical sections · 3 command blocks
Runbooks work best with coverage data
An assessment shows whether the practices behind these pages — incident roles, severity scales, postmortem follow-through — actually exist in your organization.
Assess my stack