---
name: disk-pressure-triage
description: Find what is filling a volume before deciding whether to delete anything, so the deletion is informed rather than hopeful.
runbook:
  schema_version: v1
  semver: 1.0.0
  profile: P1
  min_runtime_profile: R1
  domain: cloud-infra
  targets:
    - linux
  trigger: alert
  execution: human-with-agent
  risk: read-only
  blast_radius: resource
  duration: <5m
  capabilities:
    - cli:df
    - cli:du
  publisher: std
  lang: en
  license: CC-BY-4.0
  inputs:
    mount:
      type: string
      required: true
      description: mount point under pressure
  steps:
    - id: s1
      kind: check
      title: Confirm the volume is actually full
      tool: cli:df
      command: df -h {{inputs.mount}}
      expect: use percentage is above 85
      assert:
        exit_code: 0
      on_fail: escalate:s9
      next: s2
    - id: s2
      kind: check
      title: Find the largest directories
      tool: cli:du
      command: du -sh {{inputs.mount}}
      expect: a size is reported for the mount, even if some subdirectories are unreadable
      assert:
        stdout_matches: ^[0-9.]+[KMGT]?\s
      on_fail: escalate:s9
      next: end:success
    - id: s9
      kind: escalate
      title: Escalate to the platform team
      to: team:platform
  source:
    url: https://runbooks.directory/r/std/disk-pressure-triage/source.md
    fetched_at: 2026-09-02
    upstream_state: current
---

## When to reach for this

A volume has crossed its pressure threshold. Find out what is filling it before deleting
anything — an informed deletion is a different act from a hopeful one.

## Notes

`du` exits non-zero on a shared mount whenever a subdirectory is unreadable. That is
ordinary rather than a failure, which is why the postcondition matches the output rather
than the exit code.