The difference from incident resolution: the service is back once the full disk is cleaned up. The RCA asks why it filled up, why monitoring did not warn, and why customers noticed first. A simple method is to keep asking why until a cause you can change remains (5 Whys).
A useful RCA report contains:
- a timeline with times taken from logs, not from memory
- impact: who, what, how long
- root cause and contributing factors
- actions with an owner and a due date
A good RCA does not look for someone to blame. If the result is just human error, the analysis usually stopped too early; the real question is why the process allowed the mistake.