Incident Overview
At 09:12 on a Thursday, the on-call engineer for a fictional platform receives two paging alerts within four minutes. The first reports that the log-forwarding service on host app-log-03 has stopped writing new entries to /var/log/app/current.log.
The second, from a separate monitoring check, reports that the same host's disk usage sits at 61 percent, comfortably below the 90 percent alert threshold. The engineer opens a shell on app-log-03 to begin triage, aware that the two alerts appear to contradict one another: an application that cannot write to disk, on a disk that is not full.
Investigation Options
Review the available operational moves and select the best immediate action.
Run df -i to check inode usage on the affected filesystem
Delete old log files immediately to free space
Restart the logging service and monitor for recurrence
Extend or grow the disk partition to add capacity