The runbook step I always add: "what does normal look like right now?"

Most runbook steps are about what to do when something is broken. The most useful one I've added in years is about what to do before anything is broken: a step that captures what the system looks like when it's healthy, in the moment you're reading the runbook. It sounds trivial. It is not. The story Got paged at 3am. Symptoms: queue depth high, some user reports of slow responses. Opened the runbook. The runbook said: Check if the queue depth is elevated Check if any consumers are crashlooping