Linux Server Administration

Applications and system services use file descriptors for files, sockets, and pipes. A high count can be normal under load or can point to leaked handles and approaching process limits. What to check Identify which processes hold descriptors, distinguish regular files from sockets and pipes, and compare usage with configured limits and traffic. Check...

A configuration file may be regenerated by a package manager, configuration management agent, container entrypoint, or startup script. Editing the generated file directly may not persist. What to check Check file timestamps and ownership, package defaults, systemd units, automation runs, and deployment templates. Identify the authoritative source...

Scheduled processes may use a minimal environment that differs from an administrator’s interactive shell. Locale settings can affect dates, sorting, decimal separators, and generated report content. What to check Compare locale variables for the interactive user and service account, inspect the systemd or cron environment, and verify...

A package update can replace a service unit or override, changing the user or group a process runs under. Unexpected ownership may cause access failures or broaden privileges. What to check Compare the active unit, drop-in overrides, package changelog, process identity, file ownership, and service logs. Avoid changing permissions broadly to mask the...

A server rename may update the system hostname while logs, monitoring agents, certificates, or application settings still use the old identity. Mixed names can complicate incident response. What to check Check the kernel hostname, static hostname, hosts file, agent configuration, certificate names, and central log labels. Review the change history and...

A file can appear readable to an administrator while a service is denied access because of its runtime user, parent directory permissions, ACLs, or mandatory access controls. What to check Check the process identity, every parent directory, ACLs, mount options, and relevant SELinux or AppArmor denials. Reproduce as the service account rather than...

Log timestamps can differ because of timezone settings, clock drift, application formatting, or delayed forwarding. An incorrect timeline can complicate troubleshooting and incident review. What to check Compare system time, time synchronization status, timezone, application timestamp format, and collector ingestion time. Check whether the issue...

A server and workstation can use different resolvers, search domains, caches, or split DNS rules. The difference can make an application connect to an unintended service. What to check Compare resolver configuration, search domains, VPN state, cache, IPv4 and IPv6 answers, and queries to authoritative servers. Check application-specific DNS settings...