The goal is to document common Linux commands, troubleshooting workflows, and investigation patterns used to diagnose real server issues.
Use these commands to understand the server, OS version, hostname, uptime, kernel, and current user context.
hostname
hostnamectl
uname -a
uptime
whoami
id
date
Check OS release:
cat /etc/os-release
Check kernel version:
uname -r
Check system architecture:
uname -m
Useful when:
Use these commands when the server is slow or CPU usage is high.
top
If installed:
htop
uptime
Example output:
10:30:15 up 5 days, 2:10, 2 users, load average: 1.20, 2.10, 3.50
The load average shows system demand over:
1 minute, 5 minutes, 15 minutes
ps aux --sort=-%cpu | head
lscpu
Use these commands when the server is slow, applications are crashing, or the system may be running out of memory.
free -h
top
ps aux --sort=-%mem | head
vmstat 1
swapon --show
free -h
dmesg | grep -i "out of memory"
dmesg | grep -i "killed process"
Or with journalctl:
journalctl -k | grep -i "out of memory"
journalctl -k | grep -i "killed process"
Use these commands when the disk is full or applications cannot write files.
df -h
df -i
A disk can fail because of:
Storage full
Inodes full
Read-only filesystem
Permission issues
Large log files
du -sh * | sort -h
sudo du -xh / | sort -h | tail -n 20
sudo find / -type f -size +500M 2>/dev/null
sudo find / -type f -mtime -1 -size +100M 2>/dev/null
df -h to identify the full filesystem.df -i to check inode exhaustion.du to find the largest directories.find to locate large files./var/log.Use these commands to inspect disks, mounts, partitions, and block devices.
lsblk
mount
More readable:
findmnt
sudo fdisk -l
df -Th
blkid
cat /etc/fstab
lsblk./etc/fstab if the disk should mount after reboot.Use these commands to inspect running processes.
ps aux
ps aux | grep nginx
Better:
pgrep -a nginx
pstree
If not installed:
ps -ef --forest
kill <PID>
Force kill:
kill -9 <PID>
Use kill -9 only when normal termination does not work.
systemctl.Use these commands when a Linux service is down, unhealthy, or failing to start.
systemctl status nginx
sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl enable nginx
sudo systemctl disable nginx
systemctl is-active nginx
systemctl is-enabled nginx
journalctl -u nginx
Follow logs live:
journalctl -u nginx -f
View recent logs:
journalctl -u nginx --since "1 hour ago"
Logs are one of the most important sources during troubleshooting.
/var/log/syslog
/var/log/messages
/var/log/auth.log
/var/log/secure
/var/log/nginx/
/var/log/httpd/
/var/log/audit/
tail -f /var/log/syslog
For RHEL/CentOS:
tail -f /var/log/messages
grep -i "error" /var/log/syslog
Ubuntu/Debian:
grep -i "failed password" /var/log/auth.log
RHEL/CentOS:
grep -i "failed password" /var/log/secure
journalctl
Follow logs live:
journalctl -f
Kernel logs:
journalctl -k
Logs since one hour ago:
journalctl --since "1 hour ago"
Logs for a service:
journalctl -u nginx
Use these commands to inspect network interfaces and routes.
ip a
ip route
ip -s link
cat /etc/resolv.conf
Use these commands to test if the server can reach another host or service.
ping 8.8.8.8
curl -v http://example.com
curl -I https://example.com
nc -vz example.com 443
If nc is not installed, use:
telnet example.com 443
traceroute example.com
If using systems with tracepath:
tracepath example.com
Use these commands when hostname resolution is failing.
dig example.com
Alternative:
nslookup example.com
dig @8.8.8.8 example.com
cat /etc/resolv.conf
cat /etc/hosts
/etc/resolv.conf./etc/hosts for overrides.Use these commands when an application is not reachable or a port conflict is suspected.
ss -tulpn
ss -tlpn
sudo lsof -i :8080
Alternative:
sudo ss -tulpn | grep 8080
curl -v http://localhost:8080
Firewall commands depend on the Linux distribution.
Check status:
sudo ufw status verbose
Allow a port:
sudo ufw allow 80/tcp
Check status:
sudo firewall-cmd --state
List rules:
sudo firewall-cmd --list-all
Allow a port:
sudo firewall-cmd --add-port=80/tcp --permanent
sudo firewall-cmd --reload
List rules:
sudo iptables -L -n -v
Use these commands when seeing Permission denied errors.
ls -l
ls -la
chmod 644 file.txt
chmod 755 script.sh
chmod +x script.sh
sudo chown user:user file.txt
sudo chown -R user:user /path/to/directory
chmod 777 as a quick fix.Use these commands to find files, clean logs, and investigate disk usage.
find /var/log -name "*.log"
find / -type f -size +500M 2>/dev/null
find . -type f -mtime -1
find . -type f -name "*.yaml"
Ubuntu/Debian:
sudo apt clean
RHEL/CentOS:
sudo yum clean all
sudo truncate -s 0 /var/log/app.log
Use with caution.
Package commands depend on the Linux distribution.
Update package index:
sudo apt update
Install package:
sudo apt install nginx
Remove package:
sudo apt remove nginx
Search package:
apt search nginx
Install package:
sudo yum install nginx
Remove package:
sudo yum remove nginx
For newer systems:
sudo dnf install nginx
sudo dnf remove nginx
Use these commands for access and permission troubleshooting.
whoami
id
who
w
sudo useradd username
sudo passwd username
sudo usermod -aG groupname username
groups username
Use these commands when you cannot connect to a server over SSH.
ssh user@server
ssh -v user@server
More verbose:
ssh -vvv user@server
systemctl status ssh
On some systems:
systemctl status sshd
ss -tulpn | grep ssh
Ubuntu/Debian:
sudo tail -f /var/log/auth.log
RHEL/CentOS:
sudo tail -f /var/log/secure
Use this quick command set when a server is slow.
hostname
uptime
free -h
df -h
df -i
top
ps aux --sort=-%cpu | head
ps aux --sort=-%mem | head
ss -tulpn
journalctl --since "1 hour ago" | tail -n 100
Quick investigation logic:
1. Confirm the server and time.
2. Check CPU and load average.
3. Check memory and swap.
4. Check disk and inodes.
5. Check top processes.
6. Check listening ports.
7. Check recent system logs.
8. Check application logs.
9. Check recent changes.
10. Document findings.
Commands:
uptime
top
free -h
df -h
ps aux --sort=-%cpu | head
ps aux --sort=-%mem | head
What to check:
Possible fixes:
Commands:
df -h
df -i
du -sh * | sort -h
sudo find / -type f -size +500M 2>/dev/null
What to check:
Possible fixes:
Commands:
systemctl status nginx
journalctl -u nginx --since "1 hour ago"
ss -tulpn | grep nginx
What to check:
Possible fixes:
Commands:
ss -tulpn
sudo lsof -i :8080
curl -v http://localhost:8080
systemctl status app-service
What to check:
Possible fixes:
Commands:
dig example.com
nslookup example.com
cat /etc/resolv.conf
cat /etc/hosts
What to check:
Possible fixes:
/etc/hosts.Commands:
ping server
nc -vz server 22
ssh -vvv user@server
systemctl status ssh
sudo tail -f /var/log/auth.log
What to check:
Possible fixes:
Commands:
free -h
top
ps aux --sort=-%mem | head
swapon --show
dmesg | grep -i "killed process"
What to check:
Possible fixes:
Commands:
ls -l
ls -la
whoami
id
namei -l /path/to/file
What to check:
Possible fixes:
chown.chmod.chmod 777.