Ravindra BagaleCourses & study guides मराठी Track your progress

Appendix A: Troubleshooting Checklist

By Last updated:

Friends, when something breaks, don't panic. Work through the list from outside to inside — most problems are found in the first few steps.

A.1 Cannot SSH into the instance

Check How
Instance is running and status checks 2/2 EC2 console
Correct public IP (changes after stop/start) Console → Instance → Public IPv4
Security group allows TCP 22 from your current IP (mobile hotspot / college Wi-Fi IPs change!) SG inbound rules → My IP
Correct username ec2-user (AL/CentOS Stream), ubuntu (Ubuntu), centos (old CentOS)
Correct key and permissions chmod 400 key.​pem / icacls on Windows; key pair name shown in console
Subnet has route 0.0.0.0/0 → Internet Gateway VPC → Route tables
Network ACL allows 22 inbound and ephemeral ports outbound VPC → Network ACLs
College/office network blocks outbound port 22 Try mobile hotspot, or use EC2 Instance Connect / Session Manager
Verbose output ssh -​v -​i key.​pem ec2-​user@IP

Common error messages:

Message Meaning
Connection timed out Network/security group/NACL/wrong IP
Connection refused Host reachable but sshd not running (rare on EC2)
Permission denied (publickey) Wrong user name or wrong key
UNPROTECTED PRIVATE KEY FILE Key permissions too open → chmod 400
REMOTE HOST IDENTIFICATION HAS CHANGED New instance reused the same IP → ssh-​keygen -​R <IP>

A.2 Website not loading

  1. curl -I http://localhost on the server — works? If not, the problem is on the server (step 3 onwards).
  2. From your laptop: curl -I http://<PUBLIC_IP> — timeout → security group (80/443), firewalld, NACL, public IP, typed https.
  3. sudo service nginx status (or httpd / apache2) — running? sudo nginx -t / apachectl configtest — syntax OK?
  4. sudo ss -tlnp | grep -E ':80|:443' — who is listening? Two web servers fighting for port 80?
  5. Read the error log (/var/log/nginx/error.log, /var/log/httpd/error_log, /var/log/apache2/error.log).
  6. 403 → permissions (namei -l <file>), missing index file, SELinux (restorecon -Rv, ls -Z).
  7. 404 → wrong root / DocumentRoot / file name case.
  8. 502/504 → backend app down or wrong port; curl 127.0.0.1:<port>; pm2 status; sudo service <app> status; CentOS: setsebool -P httpd_can_network_connect 1.
  9. 500 → application error; check app logs (journalctl -u <app>, pm2 logs, PHP-FPM log).

A.3 Database problems

Symptom Check
Can't connect sudo service mariadb status / mysql / mongod; sudo ss -​tlnp | grep -​E '3306|​27017'
Access denied User/host/password: SELECT user,​host FROM mysql.​user;
Works locally, not from another server bind-address/bindIp, security group from the app server's SG only
mongod won't start sudo tail -​50 /​var/​log/​mongodb/​mongod.​log; disk full? permissions on data dir? SELinux?

A.4 Server problems

Symptom Check
Disk full df -h, sudo du -​h --​max-​depth=​1 / | sort -​h, clear old logs sudo journalctl --​vacuum-​size=​200M, grow EBS
Out of memory / processes killed free -h, dmesg | grep -​i oom, add swap, bigger instance type
High CPU top/htop; T-instance CPU credits exhausted? (CloudWatch CPUCreditBalance)
Instance won't boot after editing fstab Stop instance, detach root volume, attach to a helper instance, fix fstab, re-attach (or use EC2 Serial Console)
Service not starting at boot systemctl is-​enabled <svc>; sudo systemctl enable <svc>; pm2 startup + pm2 save
Website/SSH broken after stop/start or type change Public IP changed — attach an Elastic IP (Chapter 14)
Time zone wrong in logs sudo timedatectl set-​timezone Asia/​Kolkata

A.5 Web-server configuration and domains

Symptom Check / fix
403 after changing root / DocumentRoot namei -l <file> (755 dirs, 644 files); matching <Directory> with Require all granted; CentOS SELinux: ls -Z, semanage fcontext -​a -​t httpd_​sys_​content_​t "/​path(/.*)?" + restorecon -Rv; never serve from home folders
New port not reachable sudo ss -tlnp (listening?); security group inbound rule; firewall-​cmd --​add-​port=​PORT/​tcp; CentOS: semanage port -​a -​t http_​port_​t -​p tcp PORT (service fails with Permission denied otherwise)
Domain not resolving dig example.​com +short and dig @8.​8.​8.​8 example.​com; record name typo (blog, not blog.example.com); dig NS example.​com — editing records at the wrong DNS host?; domain verified and not expired?; wait for TTL / flush local cache
Default site shows instead of your vhost server_name / ServerName + ServerAlias include the exact name?; Ubuntu: remove sites-​enabled/​default or a2dissite 000-​default.​conf; Nginx default_server elsewhere; inspect sudo nginx -T / sudo apachectl -​S; forgot reload?
Domain resolves but page times out Security group 80/443; DNS points to the right Elastic IP?; curl -​I http://​EIP -​H "Host: example.​com"

Ravindra Bagale's Tip

While troubleshooting, make one change at a time and test with curl or the log after each change. If you change five things at once, you never know which one actually worked. And back up the config file before any change.

Got it? Outside to inside – security group, service, config, permissions, logs – search in this order. Now let's move on to the command cheat sheet.

Practice Tasks

About this scenario

Milan Furniture is a furniture business in Milan. Giulia Rossi looks after its IT and cloud work. They count money in EUR and run their AWS resources in the eu-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 12

Easy Port for SSH

Why: Security group rules need the right port.

What to do: Which TCP port must the security group open for SSH?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Easy Check memory

Why: If RAM is full the server slows down or kills apps.

What to do: Show used and free memory in human-readable units.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Easy Protect an SSH key file

Why: SSH refuses to use a key file that other users can read.

What to do: Make milanfurniture-key.pem readable only by its owner and nobody else (no write).

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Easy Connect to an EC2 server

Why: SSH with a key file is the standard way to log in to a Linux EC2 instance.

What to do: Log in to the server 13.157.20.5 as ec2-user using the key milanfurniture-key.pem.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Easy Restart a service after a change

Why: Config changes only apply after the service restarts or reloads.

What to do: Restart the nginx service.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Easy Check if a service is running

Why: When a site is down, first check whether the web server process is running.

What to do: Show the status of the httpd service.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Copy your public key to another server

Why: After this, you can SSH to that server without a password.

What to do: Copy your public key to user ec2-user on 10.0.5.25.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Create an SSH key pair

Why: Passwordless SSH between servers needs a key pair on the first server.

What to do: Create a new SSH key pair of type ed25519.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Upload a file to the server

Why: scp copies files over SSH, so it uses the same key and user.

What to do: Upload index.html from your laptop to /home/ec2-user/ on 13.157.20.5 using milanfurniture-key.pem.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Start a service now and at boot

Why: enable makes it start after reboot; --now also starts it right away.

What to do: Enable the nginx service and start it immediately, in one command.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium CloudFormation: web security group

Why: Opening only 443 keeps the server safer.

What to do: Template with an AWS::EC2::SecurityGroup that allows TCP 443 from 0.0.0.0/0. Add a GroupDescription.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Fill in each property with the value from the task.
  4. Click Check answer. Key order does not matter.

Medium Create a security group

Why: A security group is the firewall around your instance.

What to do: Create a security group named milanfurniture-web-sg with description "Web servers" in vpc-01541f2c2fdeadbee.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

See all practice tasks in the Task Hub →