Linux / Debian Centre
Linux / Debian Center
A practical starting point for diagnosing a Linux server: services, networking, SSH, storage, packages, performance, logs and local security.
Generator of report express
Select the contexte : BAOI génère a bloc of commands en lecture seule to exécuter then to Copy in a ticket or a report.
uname -a && cat /etc/os-release
uptime
systemctl --failed
journalctl -b -p err..alert
ps aux --sort=-%cpu | head
free -h && swapon --show
ps aux --sort=-%mem | head
df -hT
df -i
du -xhd1 /var | sort -h
ip -br addr
ip route
ss -lntup
resolvectl status
dig example.com
sshd -t
journalctl -u ssh -b --no-pager
dpkg --audit
dpkg --configure -a
apt-get -f install
journalctl --since '1 hour ago'
journalctl --disk-usage
timedatectl
namei -l /chemin/file
nft list ruleset
docker ps -a
docker system df
Logs d’abord
Read journalctl before of restart a service en boucle.
df -h et df -i
A system can manquer inodes with still beaucoup of Go disponibles.
Permissions
Avoid chmod 777 : identifier owner, group, ACL and contexte.
APT
Ne never delete a lock dpkg without confirmer no process valid ne tourne.
Filesystem
A remount read-only can signaler a outage disk or a corruption.
Load
A load high can provenir of I/O, pas only of the CPU.
Center mission
8 playbooksQualify a Linux incident by service, resources, storage, network, DNS, SSH, permissions and packages, collecting systemd state and logs first.
Quick triage
- Record uptime, load, memory and disk space.
- Identify the actually affected service or process.
- Read journalctl for the incident window.
- Validate IP, route and DNS before network applications.
- Keep a configuration copy before making changes.
Decision tree
Use systemctl status + journalctl, then dependencies/configuration.
Check load, memory, I/O and disk before rebooting.
Check link, address, route, DNS then firewall.
Read dpkg/apt logs and compare versions/configuration.
Intervention playbooks
Start read-only, collect evidence, then change one variable at a time.
01systemd service failedControlled change
Service is failed/inactive or repeatedly restarting.
Checks
- Read full status and exit code.
- Inspect service logs and dependencies.
- Validate configuration syntax before restart.
Commands / evidence
systemctl status <service> --no-pagerjournalctl -u <service> -n 100 --no-pagersystemctl list-dependencies <service>Expected result
Failure cause is visible and service remains active after correction.
Corrective actions
- Fix configuration/dependency then restart only this service.
- Keep log output before rotation.
Escalate when
Binary crash, data corruption or critical service remains unstable.
02Disk or inodes fullControlled change
No space left on device, services unable to write or apt fails.
Checks
- Compare block and inode usage.
- Identify growing directories.
- Check logs, cache, snapshots or deleted-but-open files.
Commands / evidence
df -hTdf -ihdu -xhd1 /var | sort -hlsof +L1Expected result
A precise consumer explains saturation and sustainable margin is restored.
Corrective actions
- Reduce retention/clean only safe data.
- Extend filesystem if growth is legitimate.
Escalate when
Critical filesystem, complex LVM/RAID or unidentified business data.
03High CPU / memory loadRead-only
High load average, heavy swap or process monopolizing resources.
Checks
- Separate CPU, I/O wait and memory pressure.
- Identify dominant processes/threads.
- Correlate with cron, backup or traffic.
Commands / evidence
uptimefree -hps aux --sort=-%cpu | head -20vmstat 1 5Expected result
CPU/memory/I/O bottleneck is clearly identified.
Corrective actions
- Address responsible process or schedule.
- Avoid kill -9 as first action on a stateful service.
Escalate when
OOM killer, kernel stall or persistent saturation without identifiable process.
04No network connectivityRead-only
Server can no longer reach gateway or network after reboot/change.
Checks
- Check link, address and expected interface.
- Read routing table.
- Check NetworkManager/systemd-networkd/ifupdown as applicable.
Commands / evidence
ip -br addrip routeip -s linkping -c 4 <gateway>Expected result
Interface is up, address is correct and default route usable.
Corrective actions
- Fix persistent configuration rather than temporary ip addr change.
- Check VLAN/hypervisor if OS link looks correct.
Escalate when
Complex bond/bridge/VLAN, asymmetric route or upstream loss.
05DNS failureRead-only
IP ping works but names no longer resolve.
Checks
- Read resolv.conf and effective resolver.
- Test DNS server explicitly.
- Check search domains and systemd-resolved if used.
Commands / evidence
cat /etc/resolv.confresolvectl statusdig example.comdig @<DNS> example.comExpected result
Resolver answers without timeout and returns expected address.
Corrective actions
- Fix DNS configuration source (DHCP/netplan/resolved), not only generated resolv.conf.
- Test internal and external names separately.
Escalate when
Internal authoritative DNS unavailable or UDP/TCP 53 filtering outside server.
06SSH unreachableControlled change
Timeout, connection refused or authentication failed on SSH.
Checks
- Separate unreachable port from authentication failure.
- Check sshd, listener and firewall.
- Read auth.log/journal for user/key.
Commands / evidence
systemctl status ssh --no-pagerss -lntp | grep :22journalctl -u ssh -n 100 --no-pagerssh -vvv <user>@<host>Expected result
sshd listens and log precisely explains acceptance or rejection.
Corrective actions
- Fix key/permissions/config then test a second session before closing first.
- Run sshd -t before reload.
Escalate when
Only remote access path, external firewall or PAM/SSSD/LDAP issue.
07Permission deniedControlled change
Application or user cannot read/write/execute despite file existing.
Checks
- Read owner, group and mode through directory chain.
- Check ACL and SELinux/AppArmor context if applicable.
- Identify actual process UID/GID.
Commands / evidence
namei -l <path>getfacl <path>id <user>ps -o user,group,cmd -p <pid>Expected result
A precise permission rule explains the failure.
Corrective actions
- Apply minimum permission at correct level.
- Avoid chmod -R 777 as workaround.
Escalate when
NFS/CIFS storage, complex inherited ACLs or mandatory security controls.
08APT / update errorControlled change
apt update/upgrade fails, dpkg is locked or packages remain unconfigured.
Checks
- Read exact error and configured repositories.
- Check active apt/dpkg processes before removing a lock.
- Check disk, DNS and time for TLS.
Commands / evidence
apt updatedpkg --auditps aux | egrep "apt|dpkg"journalctl -u apt-daily.service -n 50Expected result
Repositories are reachable and dpkg has no broken package.
Corrective actions
- Repair identified package or repository configuration.
- Never remove a lock while dpkg is genuinely active.
Escalate when
Interrupted major upgrade, critical dependency breakage or essential third-party repository unavailable.
End-of-intervention checklist
- Check systemctl --failed.
- Check disk space and load after fix.
- Retest service from its real client.
- Archive useful commands and log excerpts.
- Document changed configuration or package.