Runbook Template (Free, Copy-Paste)

A runbook is not documentation. Documentation explains how the system works; a runbook tells the person being paged at 2am what to do in the next five minutes, assumes they're half-awake, and doesn't require them to read anything else. Most small teams skip runbooks because "we don't have ops." Then the same outage happens twice and the second time still takes ninety minutes because nothing was written down.

The 7-section runbook — copy this

What this service does (2 sentences max). What breaks for the user when this fails. "Checkout calls the payments API; if it's down, customers can't pay." Not architecture — impact.
Symptoms → diagnosis. What the alert looks like, what the user sees, and the first three checks in order (endpoint up? logs erroring? dependency down?). Written as steps, not paragraphs.
Mitigations, in try-first order. Restart command. Failover flag. Rollback command. Each with the exact command to paste, who may run it, and what "it worked" looks like. The safe-but-slow fix goes first if it's reversible.
Escalation. When to stop self-serving and page a human, with names and a hard time threshold — 15 minutes of no progress beats two hours of heroics.
Known failure modes. The top 3–5 past incidents with one-line resolutions. This section is the runbook's memory; every incident should end with a line added here.
Verification after fix. How to confirm recovery from the user's side (a real checkout, a real request), not just "service is green."
Post-incident hooks. Link to the postmortem template and where the incident timeline lives. The runbook is the front door of the incident system, not a substitute for it.

When to write a runbook

The trigger isn't "when we have time" — it's the second occurrence. First incident: fix it. Second incident: write the runbook while it's fresh, or you'll pay for the third one at full price. One page per service that pages someone. If a runbook would need more than one screen, it's two runbooks or a wiki page with a runbook on top.

The 2am rule

The only test that matters: could the on-call engineer — whoever is least familiar with this system this week — follow it at 2am without asking anyone anything? If any step says "check the usual suspects" or "ask Dave," it fails. Exact commands, named owners, hard thresholds. A runbook that requires tribal knowledge isn't a runbook; it's a scavenger hunt with a pager attached.

---

The Agent Ops 24/7 ($19) kit extends runbooks to unattended agents: watchdog patterns, escalation ladders, and the monitoring design that pages a human only when a human is actually needed — launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.