1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
[
{"category":"sysadmin","language":"shell","attribution":"systemd","explanation":"Why a unit failed, without paging through the whole journal. -u scopes to the unit, -n limits the lines, --no-pager keeps it in the pipeline.","content":"journalctl -u nginx -n 50 --no-pager -p err"},
{"category":"sysadmin","language":"shell","attribution":"systemd","explanation":"Lists units that failed at boot. The first thing to run on a machine that came up wrong.","content":"systemctl --failed --no-pager"},
{"category":"sysadmin","language":"shell","attribution":"systemd","explanation":"Shows what a unit will actually run, including drop-ins, after every override has been merged.","content":"systemctl cat sshd.service && systemctl show sshd -p ExecStart"},
{"category":"sysadmin","language":"shell","attribution":"systemd","explanation":"Ranks services by how long they delayed boot. The usual answer to a slow start is one unit near the top.","content":"systemd-analyze blame | head -15"},
{"category":"sysadmin","language":"shell","attribution":"Disk","explanation":"Largest directories at this level, human readable. -x stays on one filesystem so it does not wander into /proc or a mount.","content":"du -xh --max-depth=1 / 2>/dev/null | sort -rh | head -15"},
{"category":"sysadmin","language":"shell","attribution":"Disk","explanation":"A disk that reports free space but still refuses writes is usually out of inodes, not bytes.","content":"df -i | awk '$5+0 > 80 {print}'"},
{"category":"sysadmin","language":"shell","attribution":"Disk","explanation":"Finds space held by deleted files that a process still has open. Deleting the file does not free the space until the handle closes.","content":"lsof +L1 2>/dev/null | awk '$7 > 100000000 {print $1, $7, $NF}'"},
{"category":"sysadmin","language":"shell","attribution":"Processes","explanation":"The heaviest processes by resident memory. --sort takes a minus for descending order.","content":"ps -eo pid,user,rss,pcpu,comm --sort=-rss | head -12"},
{"category":"sysadmin","language":"shell","attribution":"Processes","explanation":"What a process is actually waiting on. Reading its file descriptors and stack says more than another look at top.","content":"ls -l /proc/$PID/fd | head && cat /proc/$PID/wchan"},
{"category":"sysadmin","language":"shell","attribution":"Processes","explanation":"Traces the system calls a command makes, with a count and timing summary rather than a wall of output.","content":"strace -c -f -p $PID 2>&1 | tail -20"},
{"category":"sysadmin","language":"shell","attribution":"Network","explanation":"Listening sockets with the process behind each one. The modern replacement for netstat -tulpn.","content":"ss -ltnp | awk 'NR>1 {print $4, $6}'"},
{"category":"sysadmin","language":"shell","attribution":"Network","explanation":"Which route the kernel will actually use for a destination, including the source address it will pick.","content":"ip route get 8.8.8.8"},
{"category":"sysadmin","language":"shell","attribution":"Network","explanation":"Captures the start of connections only. -n skips DNS lookups, which otherwise generate the traffic you are trying to read.","content":"tcpdump -ni any 'tcp[tcpflags] & tcp-syn != 0' -c 20"},
{"category":"sysadmin","language":"shell","attribution":"Network","explanation":"Resolves a name through a specific server, which is how you tell a stale local cache from a stale zone.","content":"dig +short @1.1.1.1 example.com A"},
{"category":"sysadmin","language":"shell","attribution":"Permissions","explanation":"World-writable files outside the places that are meant to be. A common way a service ends up modifiable by anyone.","content":"find /etc /usr -type f -perm -o+w -ls 2>/dev/null"},
{"category":"sysadmin","language":"shell","attribution":"Permissions","explanation":"Copies the ownership and mode of one file onto another, rather than typing the numbers and getting them wrong.","content":"chmod --reference=/etc/passwd /etc/passwd.new && chown --reference=/etc/passwd /etc/passwd.new"},
{"category":"sysadmin","language":"shell","attribution":"Users","explanation":"Accounts with a real login shell, which is the set that can actually sign in.","content":"awk -F: '$7 !~ /(nologin|false)$/ {print $1, $7}' /etc/passwd"},
{"category":"sysadmin","language":"shell","attribution":"Users","explanation":"Accounts with an empty password field. Should return nothing on any machine you care about.","content":"sudo awk -F: '$2 == \"\" {print $1}' /etc/shadow"},
{"category":"sysadmin","language":"shell","attribution":"SSH","explanation":"Reuses one connection for subsequent sessions, so every later ssh or scp to the same host skips the handshake.","content":"ssh -o ControlMaster=auto -o ControlPersist=10m -o ControlPath=~/.ssh/cm-%r@%h:%p host"},
{"category":"sysadmin","language":"shell","attribution":"SSH","explanation":"Forwards a remote port to the local machine, so a service bound to localhost on the server is reachable here.","content":"ssh -N -L 5432:127.0.0.1:5432 dbhost"},
{"category":"sysadmin","language":"shell","attribution":"Backup","explanation":"Mirrors a tree, deletes what no longer exists on the source, and shows what it would do first. Never run this without -n the first time.","content":"rsync -avhn --delete /src/ /dest/"},
{"category":"sysadmin","language":"shell","attribution":"Backup","explanation":"Streams a directory to another host without a temporary archive on either side.","content":"tar czf - /var/www | ssh backup 'cat > www-$(date +%F).tar.gz'"},
{"category":"sysadmin","language":"shell","attribution":"Scheduling","explanation":"A cron entry that logs both streams. Without the redirect, cron mails the output to a mailbox nobody reads.","content":"0 3 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1"},
{"category":"sysadmin","language":"shell","attribution":"Containers","explanation":"Removes stopped containers, unused networks and dangling images. The usual cause of a full disk on a build host.","content":"docker system prune -af --volumes --filter 'until=168h'"}
]
|