System & Service Management

Combine journalctl -u nginx.service to select the unit, -b to scope to the current boot, and -p err to keep priority error and above. Add -f to follow live, -n 100 for the last lines, or --since for a time window.

systemctl restart stops the service and starts a new process, so the PID changes and in-flight work is dropped. systemctl reload runs only the unit's ExecReload= command, leaving the same process running; a unit that defines no ExecReload= rejects reload with an error.

A .timer unit only schedules; the work lives in a separate .service unit that it activates — by default the same-named one. You must enable and start the timer itself (systemctl enable --now backup.timer), not the service.

[Unit] holds Description= and relationship keys such as After=; [Service] holds how to run the process, including ExecStart= and User=; [Install] holds WantedBy= and is read only when the unit is enabled. A key in the wrong section is ignored with a warning.

Requirement and ordering are separate axes in systemd. Requires= only says the other unit must be pulled in and must not fail; it never says "wait for it". Without After=, both units are started in parallel, so either can win the race.

An eBPF map is a kernel-resident key/value store shared by BPF programs and user space. BPF code uses helpers like bpf_map_lookup_elem(); user space copies values in and out via the bpf() syscall on the map's file descriptor.

An eBPF program's type fixes which kernel hooks it may attach to, the layout of the single context argument it receives, which BPF helper functions it may call, and how the kernel interprets its return value.

The eBPF verifier runs inside the kernel at load time, when the bpf() syscall submits the program — before it is attached to anything and before a single instruction executes. A rejected program never runs: the load call fails and the kernel returns a verifier log saying why.

LVM stacks three layers: pvcreate initialises each disk as a physical volume, vgcreate pools those PVs into a volume group, and lvcreate carves logical volumes out of the pool. Then you mkfs and mount the LV like any block device.

An LVM logical volume and the filesystem on it are separate layers. lvextend grew only the block device, so the filesystem still records its old size. Run resize2fs (ext4) or xfs_growfs (XFS) afterwards, or pass lvextend -r to do both.

apt update refreshes the package index from every configured repository and installs nothing. With no index apt cannot resolve the package name at all; with a stale index it asks the mirror for a .deb the archive has already replaced, so the download 404s.

On RHEL 8 and 9 the yum command is a symlink to dnf-3, so running yum runs dnf. /etc/yum.conf is a symlink to /etc/dnf/dnf.conf, and /etc/yum.repos.d is still the directory dnf reads repository files from.

apt upgrade never removes an installed package; anything whose upgrade would require a removal is kept back. apt full-upgrade and apt-get dist-upgrade are the same command and may remove packages to resolve conflicts. apt-get upgrade is stricter still: it also refuses to add new packages.

dnf records every transaction locally. dnf history lists them with IDs, dnf history info <id> shows every package the transaction added, removed or upgraded, and dnf history undo <id> reverses it — provided the older RPMs are still obtainable.

Strict snap confinement sandboxes the process with AppArmor and seccomp, so access depends on the interfaces the snap has connected rather than on Unix permissions. Paths under /mnt need the removable-media interface, which does not auto-connect; attach it with snap connect.

Check the kernel log with dmesg -T or journalctl -k, searching for "Out of memory" or "oom-kill". The kill line names the PID and command and reports total-vm, anon-rss, file-rss, shmem-rss and oom_score_adj — anon-rss being what the process actually held in RAM.

ps aux and ps -ef are BSD-style and UNIX-style invocations of the same tool, differing in default columns: aux prints %CPU, %MEM, VSZ and RSS; -ef prints PPID and start time. ps -eo lets you choose columns and sort order.

Iowait is idle CPU time that happened while at least one I/O request was outstanding. It is a subset of idle, so a high value means the CPUs had nothing else to run — it locates spare capacity, not a slow disk. Confirm with iostat -x latency before blaming storage.

Read the await columns for per-request latency, aqu-sz for queue depth, and r/s/w/s for offered load. Latency up with load and queue flat means the device slowed; latency up with a deeper queue means you sent more work. %util only counts time with at least one request in flight, so on parallel devices 100% is not saturation.

The first report from vmstat (and from iostat, mpstat and pidstat) is an average since system boot, not a sample of the last second. Ignore it and read the interval lines that follow.

A failed ping proves only that ICMP echo replies are not coming back, which is usually firewall or security-group policy rather than a dead host. Test the port the service actually listens on, using nc -zv or curl -v.

Run ss -tulpn as root: t selects TCP, u UDP, l listening sockets only, p the owning process, n numeric ports. The process column is empty for sockets owned by other users unless you are root.

The inet family is nftables' dual-stack address family: one table whose base chains are evaluated for both IPv4 and IPv6 packets. It replaces keeping two parallel rulesets, so each rule is written, reviewed and audited once.

iptables walks a chain from top to bottom and stops at the first matching rule with a terminating target, so an ACCEPT appended below an existing catch-all DROP is never reached. Insert it above that rule with -I and a position instead of appending with -A.

The Local Address is almost certainly 127.0.0.1, so the socket is bound to loopback only and is unreachable from any other host. Fix it in the application's own bind configuration, not in the firewall.

A trailing slash on an rsync source means "copy this directory's contents"; without it rsync copies the directory itself. So /var/www/ fills /backup, while /var/www creates /backup/www. A trailing slash on the destination changes nothing.

ssh-copy-id logs in with the credentials you already have, then appends your public key file (for example id_ed25519.pub) to the remote account's ~/.ssh/authorized_keys, creating the directory and file with safe permissions. The private key never leaves your machine.

The receiver splits its existing copy into blocks and sends the sender a weak rolling checksum plus a strong checksum for each. The sender rolls a window byte by byte through its version, and transmits only unmatched literal data plus references to blocks the receiver already has. Local-to-local copies skip this and send whole files.

OpenSSH's sshd runs with StrictModes yes by default: it ignores a key file that anyone but the owner could modify. The account's home directory must not be group- or world-writable, ~/.ssh should be 700 and authorized_keys 600, all owned by that user.

rsync's -a is shorthand for -rlptgoD: recurse, copy symlinks as symlinks, preserve permissions, times, group, owner, and device and special files. It does not cover hard links (-H), ACLs (-A), extended attributes (-X) or sparse files (-S), and preserving owner requires superuser rights on the receiving side.