Skip to main content
Alertinglesson 4 of 4 · 3 min read

Runbooks

Written for somebody at their worst

A page at 3am lands on a person at their cognitive worst, often for a service they did not write.

Close that gap with a runbook, which converts one engineer's hard-won knowledge into something a stranger can execute half asleep.

Link every alert that can page a human directly to one. Your alerting tools let you put that link in the notification itself, so it arrives with the page instead of being hunted for during it.

The shape

Give your runbooks a shape. What this alert means, in one sentence a tired brain can absorb. Who or what is affected, which calibrates the urgency.

How to verify, with the dashboard link and the query confirming the problem is real and current. What to try, as concrete commands with their expected output: restart this consumer, flip this flag, fail over with this script.

Who to escalate to when that fails, after how long, with the paging handle rather than a name somebody has to go and look up.

Keep the diagnosis brief. Your goal at 3am is stopping user pain, and hunting the root cause belongs to the postmortem in daylight.

Fight staleness, because it is what kills runbook programmes. A runbook pointing at a decommissioned dashboard or a renamed command is worse than none at all, since it burns fifteen minutes and your trust at the worst possible moment.

Keep two habits alive. Every postmortem includes a runbook change as an action item, since an incident is exactly when the gaps get discovered. And game days, where somebody executes a runbook against a staged failure, catch rot before a real incident does.

Value the deeper payoff, which is organisational. Runbooks turn on-call from a heroism contest into a system a new hire can join in their second month.

Watch for what to automate while you are at it. Every mitigation step you keep executing by hand is a documented candidate. Write it down three times, script it the fourth.

the shape of it
Alert firesSLO burn detectedPagerDutyrunbook link insideOn-callRunbookverify, mitigateMitigationusers recoveredEscalationif 15 min no fixpage + linkfollows stepsfallback
step 1 of 4
The runbook link travels with the page, so verification, mitigation, and escalation steps are one tap away at 3am.

Worked example

Two pages, same alert, five months apart, at Nadia's logistics company. In March, Kafka consumer lag on the shipment-updates topic pages an engineer who has never touched the pipeline. No runbook. He spends 40 minutes finding the right dashboard, 30 more discovering that a stuck consumer holds the partition, and pings four people before someone asleep in another timezone would have told him the fix is a one-line consumer group restart. Total: 2 hours 10 minutes, and 40,000 shipment updates delayed. The postmortem's first action item is a runbook. In August the same alert fires on a different engineer, equally unfamiliar. The page links to the runbook, the verification query confirms one stuck consumer, and the documented restart command clears it. Twelve minutes, no escalation. The team's third repetition of that restart gets scripted into an automated remediation with a page only on failure.

Alerting: wrapping up

In the real world

  • 01Google's SRE Workbook documents the multi-window, multi-burn-rate alerting recipe, including the 14.4x over 1 hour and 6x over 6 hours thresholds that many teams adopt verbatim.
  • 02Google's SRE book states that pages must be actionable and treats more than two incidents per 12-hour on-call shift as operational overload requiring intervention.
  • 03Prometheus Alertmanager ships grouping, inhibition, and silencing as first-class features, built specifically so one root cause produces one notification instead of a page storm.
  • 04Etsy popularized blameless postmortems in the early 2010s through John Allspaw's writing, establishing the incident review culture in which alert and runbook audits happen.
  • 05PagerDuty publishes annual on-call health reports showing that off-hours interruptions concentrate on a small fraction of noisy services, which is the statistical face of alert fatigue.

Questions people ask

What should page a human versus create a ticket?

Page only when a human must act now to protect users: SLO-threatening error rates, latency breaches, fast error budget burn. Everything predictive or slow-moving, disk filling over days, a slow budget leak, a flaky nightly job, becomes a ticket for business hours. If nobody would take action within the hour, it is not a page.

Do burn-rate alerts require having SLOs first?

Yes, and that ordering is the point. A burn rate is measured against an error budget, which comes from an SLO target over a window. If you have no SLO yet, pick a defensible starting number from a few weeks of real data, like 99.9 percent success over 30 days, and refine it. The act of choosing forces the availability conversation your alerting was avoiding.

How detailed should a runbook be?

Detailed enough that an engineer who has never touched the service can verify the problem and attempt mitigation without asking anyone: exact dashboard links, exact commands with expected output, and a named escalation path with a time limit. Skip long architecture essays. If a step needs deep context to execute safely, that step is really an escalation in disguise.

Quick review

Alert on symptoms, not causes:
'error rate > 1%' not 'CPU > 80%'. Symptoms always matter; causes are for investigation
SLO burn-rate alerts:
if consuming error budget 10× faster than normal → page immediately. 1× faster → ticket
Multi-window alerting:
short window (5 min) catches fast burns, long window (1 hour) catches slow burns. Use both
Alert fatigue:
every alert that fires and requires no action reduces trust in all alerts. Audit and prune monthly
Runbook:
every alert must link to a runbook with: what is this, impact, investigation steps, escalation path
On-call tooling:
PagerDuty, OpsGenie. Escalation: 5 min → engineer, 15 min → senior, 30 min → manager
Post-incident review (PIR):
blameless analysis of what happened, timeline, contributing factors, and action items
the trade-off

Too sensitive → alert fatigue (alerts ignored). Too lenient → long MTTD. Tune thresholds based on real incident data.

in the room

Set up alerting before launch. Define SLOs first, derive alerts from error budget burn rate.