Deleted file still growing
At 02:50 a fleet of app hosts starts returning 500s; `df -h` shows / at 100% and writes fail with ENOSPC. `du -sh /var/log/*` finds a single `app.log` at 180GB. You `rm app.log` and `df` *still* shows the disk full — and the file keeps growing in `du` even though it's gone from `ls`. A config push three days ago changed the log level to DEBUG on a hot request path, and `logrotate` exists but its postrotate sends SIGHUP, which this app ignores. Triage and fix without taking an outage.
What a strong answer looks like
Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.
0:00 of about 30 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.