Something keeps starting a process on my server. How do I catch it? Try: sudo execsnoop-bpfcc Info: execsnoop uses eBPF to trace exec() system calls in real-time, catching ephemeral or short-lived processes that standard monitoring tools (top/ps) miss. Examples: $ sudo execsnoop-bpfcc -t # Include timestamps for process launches $ […]
Read More
My binary exists but Linux says 'command not found'. What's wrong? Try: file /usr/local/bin/mytool && ldd /usr/local/bin/mytool Info: "No such file or directory" when executing an existing binary typically points to a missing dynamic loader/interpreter or missing shared libraries (.so). ldd reveals unresolvable dependencies. Examples: $ file /path/to/binary # Verify […]
Read More
Who accessed /etc/shadow and when, over the last week? Try: sudo aureport --file --start week-ago | grep shadow Info: aureport summarizes audit log reports by file access. Using ausearch -i translates UIDs and syscalls into human-readable text, while auid tracks the original login user even across sudo sessions. Examples: $ […]
Read More
Two servers behave differently. Which packages differ between them? Try: diff <(ssh linuxteck@server1 'dpkg -l | awk "/^ii/{print \$2}"' | sort) <(ssh linuxteck@server2 'dpkg -l | awk "/^ii/{print \$2}"' | sort) Info: dpkg -l lists installed packages, filtered via awk for active (ii) entries. Process substitution pipes remote outputs directly […]
Read More
My server is low on RAM but has no swap partition. How do I add swap? Try: sudo fallocate -l 4G /swapfile sudo chmod 600 /swapfile sudo mkswap /swapfile sudo swapon /swapfile Info: fallocate preallocates space instantly without writing zeros. chmod 600 secures swap permissions, mkswap formats the file, and […]
Read More
A command is slow. Which syscalls are eating all its time? Try: strace -c -w ls -laR /home 2>&1 >/dev/null | tail -20 Info: strace -c summarizes system call execution time. Adding -w measures wall-clock time rather than CPU time, exposing I/O bottlenecks like heavy directory scans or file status […]
Read More
A process is misbehaving. Can I dump its memory for post-mortem analysis? Try: sudo gcore -o /tmp/mysqld_dump 3456 Info: gcore generates a core dump of a running process without terminating it. The resulting core snapshot can be analyzed offline using gdb. Examples: $ sudo gcore 3456 # Dumps process memory […]
Read More
I see unexpected open ports. What program is behind each one? Try: sudo ss -tulnp Info: ss flags: -t=TCP, -u=UDP, -l=listening, -n=numeric, -p=processes. Displays active listening sockets alongside process names, PIDs, and file descriptors. Examples: $ sudo ss -tulnp | grep :80 # Filter for specific port bindings $ sudo […]
Read More
How do I measure DNS lookup, connect, and download time separately? Try: curl -w '@-' -o /dev/null -s https://google.com <<'EOF' time_namelookup: %{time_namelookup}s time_connect: %{time_connect}s time_appconnect: %{time_appconnect}s time_pretransfer: %{time_pretransfer}s time_starttransfer: %{time_starttransfer}s time_total: %{time_total}s EOF Info: curl -w customizes output formatting using predefined variables. Breaking down […]
Read More
The kernel is using tons of RAM. Which modules are the biggest? Try: sudo lsmod | sort -k2 -rn | head -10 Info: lsmod lists currently loaded kernel modules alongside their size in bytes. Sorting numerically by size quickly highlights memory-intensive display drivers, filesystems, and device modules. Examples: $ sudo […]
Read More
My server clocks drift. How do I get millisecond-accurate time sync? Try: chronyc tracking Info: chrony replaces legacy ntpd with faster clock convergence and better accuracy on VM/cloud instances. Running chronyc tracking monitors stratum, offset, and real-time sync performance. Examples: $ sudo chronyc sourcestats # View drill-down statistics for active […]
Read More
My server is swapping. Which processes are the culprits? Try: for pid in $(ls /proc/ | grep -E '^[0-9]+$'); do awk -v pid=$pid '/VmSwap/ {print pid, $2, $3}' /proc/$pid/status 2>/dev/null; done | sort -k2 -rn | head -10 Info: /proc/PID/status tracks per-process VmSwap usage. Iterating through numeric PIDs extracts and […]
Read More
Some files won't delete due to attributes. How do I find Linux file attributes? Try: sudo lsattr -R /var/log 2>/dev/null | grep -E '^-*[aiu]' | head -10 Info: Linux file attributes control how files can be modified or deleted. The i attribute makes a file immutable, a enables append-only access, […]
Read More
How do I count error occurrences in Linux over time? Try: watch -n 5 'grep -c "ERROR" /var/log/nginx/error.log' Info: watch reruns commands at defined intervals (-n seconds) to track changing metrics. Coupling tail -f with awk increments and displays a live rolling tally as new log entries land. Examples: $ […]
Read More
Which system calls is a slow process making the most? Try: sudo perf trace -p 3456 --summary Info: perf trace offers lower overhead than strace. Using --summary aggregates syscall frequency and latency metrics (min/avg/max/stddev) to reveal true application execution bottlenecks. Examples: $ sudo perf trace -p 3456 # Trace live […]
Read More
How do I create an encrypted compressed backup in Linux? Try: tar -czf - /home/linuxteck/documents | openssl enc -aes-256-cbc -pbkdf2 -out backup.tar.gz.enc Info: tar -czf - writes the compressed archive directly to standard output. Piping it to openssl enc encrypts the archive on the fly, so the unencrypted backup does […]
Read More