When a Linux server is slow, the order of the first commands matters more than the tools. A ten-minute triage routine that tells CPU, memory, disk and network pressure apart, what each column actually means, and the mistakes that send people down the wrong path.
Every night API latency tripled for an hour and the 1 Gbit uplink of one server sat at 100%. We traced it from interface counters to a host, a socket and finally a backup job with no rate limit, then shaped it with tc and fixed the schedule.
After a Tuesday dnf update, image uploads on our Rocky Linux PHP servers returned 500s. A repository update moved ImageMagick to a new library version, and our hand-built imagick extension still linked to the old one. How we found it in dnf history, rolled back, pinned versions and made updates boring again.
An engineer with nine keys in ssh-agent could not log in to a new server: the connection closed with Too many authentication failures before the right key was tried. How OpenSSH offers keys, why MaxAuthTries cuts it off, and a per-host config that fixes it and is safer.
Uploads and deploys failed with No space left on device while df showed 30% free. The filesystem had run out of inodes: a session directory held 9.6 million tiny files. How we found it with df -i, cleaned it without locking the box, and stopped it coming back.
Requests on a reporting server took ten seconds every morning while CPU sat mostly idle. iowait at 60% pointed at storage; iostat and pidstat pointed at logrotate compressing a 40 GB log on the same volume as the database. How we found it and moved the work off the hot path.
During an incident you rarely need a dashboard; you need answers from a log file in under a minute. The handful of grep, awk, sort, uniq, cut and jq patterns we use most, each run against the same sample nginx and JSON logs, with the output and the mistakes to avoid.
A queue worker with Restart=always was found dead in the morning with result start-limit-hit. systemd had stopped restarting it after five crashes in ten seconds while Redis was briefly down. How to read the failure, tune StartLimit and RestartSec, and stop flapping services from staying dead.
An overview of Cloudflare's Free, Pro, Business and Enterprise plans, then a practical guide to everything the free tier offers a small team: DNS, CDN, Universal SSL, DDoS protection, WAF managed rules, rate limiting, Tunnel, Zero Trust, Pages, Workers, R2 and Turnstile, with a setup order.
After a routine deploy our Node.js API failed to start with EADDRINUSE on port 3000. Everyone blamed TIME_WAIT. The real cause was the old node process surviving the restart, because systemd only killed the npm wrapper above it. How we proved it with ss and fixed the unit.