Glossary · Monitoring

Runbook

A runbook is a documented, step-by-step procedure for handling a known operational task or alert, such as restarting a service or failing over a database.

Updated October 6, 2026

A runbook is a written guide that tells an operator what to check and do in a specific situation. It usually covers diagnosis steps, safe commands, expected results, who to contact and how to confirm the fix. A playbook is a closely related term, often used for broader or security-focused response plans.

Why it matters

At 3 a.m., memory and judgment are poor. A runbook lets a tired responder, or someone new to the system, act correctly and quickly. Linking a runbook from every alert reduces recovery time and spreads knowledge beyond the person who built the system. Runbooks are also a good candidate for later automation.

Example

Alert: disk usage above 90% on db-01
1. Confirm: df -h /var/lib/mysql
2. Find large files: du -sh /var/lib/mysql/* | sort -h | tail
3. Purge old binary logs: PURGE BINARY LOGS BEFORE NOW() - INTERVAL 3 DAY;
4. If still above 85%, escalate to the database owner
Verify: alert clears within 5 minutes

Common mistakes

  • Letting runbooks go stale after architecture changes.
  • Writing vague advice such as "investigate the database".
  • Hiding them on a system that is down during the incident.
  • Including destructive commands with no warning.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · MonitoringAlert (Monitoring)A monitoring alert is an automatic notification sent when a check or metric crosses a defined condition, such as a site failing to respond.Glossary · MonitoringAlert DeduplicationAlert deduplication merges repeated alerts about the same underlying problem into one incident, so responders are notified once rather than hundreds of times.Glossary · MonitoringAvailabilityAvailability is the share of time a service is working and reachable when users need it, usually expressed as a percentage over a defined period.Guide · MonitoringAlert Fatigue and On-Call Basics for Small TeamsSet severity levels, escalation paths, alert thresholds and runbooks so a small team gets paged for real problems only and still sleeps through the night.8 min readGuide · MonitoringCron Job Heartbeat Monitoring to Catch Silent Failures EarlyLearn how heartbeat monitoring catches silent cron failures, with copy-ready examples for crontab, systemd, GitHub Actions, Docker, WP-Cron, Laravel and more.9 min readGuide · MonitoringA Blameless Incident Postmortem Template With a Worked ExampleWrite a blameless incident postmortem that drives real fixes: timeline, root cause vs contributing factors, 5 whys limits, a copy-paste template and an example.10 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.