Linux Server Administration

Unexpected listening ports can belong to a monitoring agent, container, temporary test process, or unapproved service. An unfamiliar port alone does not establish compromise, but it should have an accountable owner and purpose. What to check Map listening sockets to process IDs, system services, containers, and package ownership. Check process start...

Many failed logins can result from internet scanning, a stale application credential, a misconfigured monitoring check, or a real attempt to access an account. Counts alone do not show whether an attacker succeeded. What to check Review source addresses, usernames, authentication methods, timing, exposed services, and successful sessions around the...

Existing SSH sessions may remain open while new connections fail because of connection limits, firewall rules, resource pressure, daemon configuration, or an upstream network change. Restarting SSH without a fallback can remove the only working access path. What to check Check the listening socket, daemon status and logs, connection limits,...

A server can have working network connectivity until reboot, then lose its default route because settings were temporary, cloud-init overwrote them, or multiple network managers compete. Remote access may be lost if no console path is available. What to check Check persistent network configuration, interface names, DHCP leases, cloud-init logs, routing...

Logs may show an outdated or generic hostname after a clone, cloud migration, container change, or incomplete provisioning. Incorrect identity makes monitoring, incident investigation, and access policy harder to trust. What to check Compare system hostname, DNS name, cloud instance metadata, monitoring agent identity, application configuration, and...

A cloud volume or virtual disk can be enlarged while the partition or filesystem remains at its previous size. The operating system may detect the larger device but applications still see limited free space. What to check Compare provider volume size, kernel device size, partition table, logical volume, and filesystem capacity. Check storage and...

A filesystem can have free bytes but no free inodes to create new files. Large numbers of sessions, cache fragments, mail files, or temporary objects can cause this condition. What to check Check inode usage by mount and directory, identify high file counts, and inspect cache, session, email, and temporary-file retention. Confirm whether an application...

A server may report fewer CPU cores after restart because of a VM size change, container limits, processor hotplug, kernel parameters, or a cloud host move. Applications may then slow down or fail worker assumptions. What to check Compare provider instance size, operating system CPU visibility, cgroup limits, kernel boot parameters, and recent...