# Disk full from new log volume: first 30 minutes checklist

Source: https://releasefailures.com/incidents/disk-full-from-new-log-volume/
Content version: 1.0.0
Verified on: 2026-10-22
Licence: CC BY 4.0

Definition: A logging change fills disks and services stop writing.
- [ ] FM-01 List root partition usage on every application server and sort the servers by percentage used.
- [ ] FM-02 Identify the log files that grew since the last release, checking application logs and kernel audit logs separately.
- [ ] FM-03 Scale out the application server stack if the disk health check has removed several servers at once.
- [ ] FM-04 Free disk space on servers near the 90% threshold by removing or compressing rotated log files, and record what was deleted.
- [ ] FM-05 Decide whether to revert the logging change or lower its log level, or to roll back the operating system update if kernel audit logs drive the growth.
- [ ] FM-06 Replace server instances whose disks are already full rather than waiting for them to recover.
- [ ] FM-07 Post a status update that names intermittent 500 errors and timeouts as the user-visible symptom.
- [ ] FM-08 Watch disk usage for at least one hour after the fix and confirm the growth rate has returned to the pre-release level.