Linux Server Administration

A Linux server can report a full filesystem even after someone deletes old logs. One common reason is that a running process still has the deleted file open: the directory entry is gone, but the storage is not released until the process closes it. Other causes include a different full mount, large container layers, temporary files, or filesystem...

Zombie processes are finished child processes whose parent has not collected their exit status; they do not consume active CPU but can indicate faulty process handling. Checks to make Inspect process IDs and parent processes, review application logs and service versions, and identify whether the parent is stuck or failing to reap children. Restarting...

Write failures can come from ownership, permissions, mount options, quotas, SELinux policy, or a full filesystem. Checks to make Capture the exact error and service identity, inspect directory ownership and permissions, verify mount and quota state, and check security audit logs. Avoid broad chmod changes; grant only the required access and test the...

Name resolution failures can originate in resolver configuration, search domains, local caching, network access, or upstream DNS. Checks to make Compare lookup results using the configured resolver and an approved diagnostic path. Inspect resolver settings, service status, network reachability, and recent DNS changes. Check both short names and fully...

Logs may be stored only in volatile memory, rotated aggressively, or removed by a startup cleanup task. Checks to make Check journal persistence settings, logrotate policy, filesystem paths, and cleanup units. Compare timestamps and disk capacity, then configure retention appropriate to operational and security needs. Verify logs survive a controlled...

A package update can change configuration defaults, library behavior, service users, or startup ordering. Checks to make Review package and service logs around the update, inspect changed configuration files, compare dependency versions, and check service status and journal output. Test a known-good configuration or rollback in a controlled way before...

Connection resets during load can point to socket limits, firewall state, application saturation, or upstream timeouts. Checks to make Correlate reset timestamps with socket statistics, kernel counters, service logs, and load balancer events. Check connection tracking and file descriptor limits, then reproduce safely while monitoring both client and...

Swap usage may persist after memory pressure passes, or indicate workloads that exceed available RAM. Checks to make Review memory pressure, process resident sets, kernel logs, and application behavior over time. Distinguish allocated swap from active swapping, inspect major page faults and I/O, and avoid changing swappiness before identifying demand....