I need to audit what root users typed in their sessions. Try: sudo tail -f /root/.bash_history /home/*/.bash_history 2>/dev/null Info: Streams multiple history files concurrently with header markers for simple multi-user monitoring. Examples: $ echo 'export HISTTIMEFORMAT="%F %T "' >> ~/.bashrc # Add precise timestamps to history $ echo 'PROMPT_COMMAND="history -a"' […]
Read More
I deleted sensitive files but worry forensics could recover them. How do I wipe free space? Try: sudo dd if=/dev/zero of=/wipe-file bs=1M status=progress; sudo rm /wipe-file Info: dd fills remaining disk free space with zeros, overwriting blocks of previously deleted files before rm releases the space. "No space left" is […]
Read More
Something is pegging my CPU. How do I pinpoint it with real-time refresh? Try: top -b -n 1 -o %CPU | head -20 Info: Running top in batch mode (-b -n 1) executes a single non-interactive snapshot, while -o %CPU dynamically sorts processes by CPU utilization for quick diagnostics and […]
Read More
DNS is failing intermittently. How do I trace the resolution path? Try: dig +trace +noanswer google.com Info: dig +trace performs iterative DNS lookups from root servers (.), down to TLDs (.com), and final authoritative servers to isolate propagation and delegation bottlenecks. Examples: $ dig @8.8.8.8 example.com # Query specific upstream […]
Read More
A single TCP connection seems slow. Can I measure its real throughput? Try: sudo iftop -i eth0 -nNP -f 'port 443' Info: iftop acts as top for network bandwidth, tracking individual connections and displaying 2s/10s/40s moving averages to pinpoint bandwidth hogs. Examples: $ sudo iftop -i eth0 # Launch interactive […]
Read More
I keep typing shutdown on the wrong server. How do I protect against this? Try: sudo tee /etc/molly-guard/run.d/50-prod-check <<'EOF' > /dev/null #!/bin/bash if [[ -f /etc/is_production ]]; then read -r -p "PRODUCTION server! Type the hostname to confirm shutdown: " input [[ "$input" == "$(hostname)" ]] || exit 1 fi […]
Read More
How do I create a true incremental backup without using rsync? Try: tar --listed-incremental=/backup/snapshot.snar -czf /backup/incr_$(date +%Y%m%d).tar.gz /home/linuxteck Info: tar --listed-incremental tracks file state in a .snar metadata file. The initial run produces a full backup, while subsequent runs only capture modified files. Examples: $ tar --listed-incremental=/dev/null -czf full.tar.gz /data […]
Read More
Something keeps starting a process on my server. How do I catch it? Try: sudo execsnoop-bpfcc Info: execsnoop uses eBPF to trace exec() system calls in real-time, catching ephemeral or short-lived processes that standard monitoring tools (top/ps) miss. Examples: $ sudo execsnoop-bpfcc -t # Include timestamps for process launches $ […]
Read More
My binary exists but Linux says 'command not found'. What's wrong? Try: file /usr/local/bin/mytool && ldd /usr/local/bin/mytool Info: "No such file or directory" when executing an existing binary typically points to a missing dynamic loader/interpreter or missing shared libraries (.so). ldd reveals unresolvable dependencies. Examples: $ file /path/to/binary # Verify […]
Read More
Who accessed /etc/shadow and when, over the last week? Try: sudo aureport --file --start week-ago | grep shadow Info: aureport summarizes audit log reports by file access. Using ausearch -i translates UIDs and syscalls into human-readable text, while auid tracks the original login user even across sudo sessions. Examples: $ […]
Read More
Two servers behave differently. Which packages differ between them? Try: diff <(ssh linuxteck@server1 'dpkg -l | awk "/^ii/{print \$2}"' | sort) <(ssh linuxteck@server2 'dpkg -l | awk "/^ii/{print \$2}"' | sort) Info: dpkg -l lists installed packages, filtered via awk for active (ii) entries. Process substitution pipes remote outputs directly […]
Read More
My server is low on RAM but has no swap partition. How do I add swap? Try: sudo fallocate -l 4G /swapfile sudo chmod 600 /swapfile sudo mkswap /swapfile sudo swapon /swapfile Info: fallocate preallocates space instantly without writing zeros. chmod 600 secures swap permissions, mkswap formats the file, and […]
Read More
A command is slow. Which syscalls are eating all its time? Try: strace -c -w ls -laR /home 2>&1 >/dev/null | tail -20 Info: strace -c summarizes system call execution time. Adding -w measures wall-clock time rather than CPU time, exposing I/O bottlenecks like heavy directory scans or file status […]
Read More
A process is misbehaving. Can I dump its memory for post-mortem analysis? Try: sudo gcore -o /tmp/mysqld_dump 3456 Info: gcore generates a core dump of a running process without terminating it. The resulting core snapshot can be analyzed offline using gdb. Examples: $ sudo gcore 3456 # Dumps process memory […]
Read More
I see unexpected open ports. What program is behind each one? Try: sudo ss -tulnp Info: ss flags: -t=TCP, -u=UDP, -l=listening, -n=numeric, -p=processes. Displays active listening sockets alongside process names, PIDs, and file descriptors. Examples: $ sudo ss -tulnp | grep :80 # Filter for specific port bindings $ sudo […]
Read More
How do I measure DNS lookup, connect, and download time separately? Try: curl -w '@-' -o /dev/null -s https://google.com <<'EOF' time_namelookup: %{time_namelookup}s time_connect: %{time_connect}s time_appconnect: %{time_appconnect}s time_pretransfer: %{time_pretransfer}s time_starttransfer: %{time_starttransfer}s time_total: %{time_total}s EOF Info: curl -w customizes output formatting using predefined variables. Breaking down […]
Read More