Linux Troubleshooting Cheat Sheet

df -h                                  # space per filesystem
df -i                                  # inodes (many small files)
sudo du -xh --max-depth=1 / | sort -h  # biggest directories
sudo find / -xdev -type f -size +500M  # big files
sudo lsof +L1                          # deleted, still open
sudo journalctl --vacuum-size=500M     # shrink the journal
sudo truncate -s 0 /var/log/app.log    # empty an open log

free -h                                # RAM and swap
ps aux --sort=-%mem | head             # top memory users
ps aux --sort=-%cpu | head             # top CPU users
uptime                                 # load average
sudo journalctl -k | grep -i 'out of memory'   # OOM kills
kill PID                               # ask to stop (SIGTERM)
kill -9 PID                            # force (SIGKILL)

systemctl status nginx                 # state + last log lines
systemctl --failed                     # everything that failed
sudo systemctl restart nginx
sudo systemctl enable --now nginx      # start + at boot
sudo systemctl disable --now apache2   # stop + not at boot
systemctl status 812                   # which unit owns a PID

sudo journalctl -u nginx -n 50 --no-pager   # last 50 lines
sudo journalctl -u nginx -f                 # follow
sudo journalctl -xeu nginx                  # after a failed start
sudo journalctl -p err -b                   # errors since boot
sudo tail -f /var/log/nginx/error.log

sudo ss -tlnp                          # listening TCP + process
sudo ss -tlnp | grep ':80 '            # who has port 80?
sudo lsof -i :80 -sTCP:LISTEN
curl -I http://localhost               # does the service answer?
nc -zv db.internal 5432                # can I reach that port?
ip -br a                               # addresses
ip r                                   # routes
getent hosts example.com               # name resolution

sudo ufw status verbose                # Ubuntu
sudo firewall-cmd --list-all           # RHEL family
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload

ls -l file ; ls -ld dir                # mode, owner, group
namei -l /var/www/html/index.html      # every directory on the path
id deploy                              # user's groups
sudo -l                                # what may I run with sudo?
chmod u+x script.sh                    # make it executable
sudo chown -R www-data: /var/www/app   # user nginx: on RHEL
findmnt -no OPTIONS --target /tmp      # noexec?

ssh -v user@server                     # what the client tries
sudo journalctl -u ssh -n 30           # server side (sshd on RHEL)
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys ~/.ssh/id_ed25519
sudo sshd -t && sudo systemctl reload ssh   # check config, reload

getenforce                             # Enforcing / Permissive
sudo ausearch -m avc -ts recent        # recent denials
getsebool -a | grep httpd              # web server booleans
sudo setsebool -P httpd_can_network_connect 1
sudo restorecon -Rv /var/www/html      # reset file labels