Linux field reference for system, processes, systemd, logs, storage, networking, DNS, firewall, accounts and SSH.
System & load
- Distribution — cat /etc/os-releaseIdentifies distribution/version before distro-specific commands.
- Kernel — uname -aChecks kernel, architecture and build.
- Uptime & load — uptimeLoad averages are roughly 1, 5 and 15 minutes.
- Memory — free -hFocus on available memory rather than free alone.
Processes
- Top CPU — ps aux --sort=-%cpu | head -20Lists top CPU consumers at capture time.
- Top memory — ps aux --sort=-%mem | head -20Correlate with RSS/VSZ and application behavior.
- Interactive view — tophtop is convenient when installed; top is more universal.
- Process tree — pstree -apHelps relate workers, parents and services.
systemd & logs
- Service status — systemctl status nginx --no-pagerShows state, PID and recent journal lines.
- Failed units — systemctl --failedQuick starting point after reboot.
- Service journal — journalctl -u nginx --since '-2 hours' --no-pagerTargets a time window near the incident.
- Boot errors — journalctl -b -p err..alert --no-pagerFilters errors from the current boot.
Storage & filesystems
- Filesystem usage — df -hTAdds filesystem type to capacity view.
- Inodes — df -iA filesystem can be full due to inode exhaustion.
- Block devices — lsblk -fShows partitions, filesystems, UUIDs and mounts.
- Large directories — du -xhd1 /var 2>/dev/null | sort -h-x prevents crossing into other mounted filesystems.
Network
- Addresses — ip -br addrCompact interface/address view.
- Routes — ip routeChecks default and specific routes.
- Neighbors — ip neighModern ARP/ND neighbor view.
- Listening ports — ss -lntupMaps sockets, ports and processes when permissions allow.
DNS & HTTP
- Resolver status — resolvectl statusShows per-interface DNS with systemd-resolved.
- DNS lookup — dig +short exemple.frSimple lookup for A/AAAA/CNAME checks.
- HTTP headers — curl -I https://exemple.frChecks status, redirects and headers without full body.
- Verbose TLS — curl -vkI https://exemple.fr-k disables validation; diagnostic only, not proof of valid TLS.
Firewall & network security
- nftables — sudo nft list rulesetModern firewall view on many distributions.
- UFW — sudo ufw status verboseCommon on Ubuntu when UFW is enabled.
- firewalld — sudo firewall-cmd --list-allUsed on distributions running firewalld.
- Connections — ss -ant state establishedQuick view of established TCP connections.
Accounts, permissions & SSH
- Identity — id utilisateurShows UID, GID and groups.
- Path permissions — namei -l /var/www/html/index.phpShows each path component and permissions.
- SSH host keys — sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pubLets you compare the server host-key fingerprint.
- Effective SSH config — sudo sshd -T | head -50Shows effective configuration rather than only the main file.
Key points
- Use sudo only when required.
- du, find and recursive scans can generate significant I/O.
- Before restarting critical services, capture status and logs.
- Firewall commands depend on the distribution and active firewall stack.