Processes, memory, CPU and troubleshooting

Essential commands

ps aux
ps -eo pid,ppid,user,%cpu,%mem,cmd --sort=-%cpu | head
uptime
free -h
vmstat 1 5
df -h
df -i
du -sh /var/log
sudo ss -lntp

ps provides a snapshot; top provides a live view. Load average counts runnable and certain uninterruptible tasks, not just CPU usage. Compare load with CPU count and inspect I/O wait. Linux uses spare RAM for cache; low “free” memory alone does not prove shortage. Inspect “available” memory, swapping and OOM events.

Signals and jobs

sleep 300 &
jobs
# Replace PID with the background process ID printed by the shell:
kill -TERM PID

TERM requests graceful termination; KILL is a last resort because cleanup handlers cannot run. Ctrl+C normally sends SIGINT to the foreground process group. Ctrl+Z stops it; fg resumes it in the foreground. A process tied to an SSH session may terminate when the session ends; use systemd for services, not a fragile background shell.

Incident walkthrough

The website returns 502. First verify Nginx runs, then check its error log. “Connection refused” to PHP-FPM suggests the upstream listener is absent or incorrect. A socket permission error requires checking its owner/group and parent-directory traversal. Restarting the entire instance may hide evidence while leaving the cause unresolved. If disk space is full, distinguish bytes from inodes. A removed file held open by a process may continue consuming space; lsof +L1 can identify it when lsof is installed. Do not blindly delete database files or active logs.

Advanced observation

Use iostat from sysstat for storage activity and pidstat for per-process activity where installed. Use short, targeted strace sessions only when authorized; tracing may reveal secrets and adds overhead. Inspect journalctl -k for kernel messages and OOM evidence.

Assignment

Generate a small file in your practice directory, observe its disk use, then remove it. Prepare a three-column incident record: symptom, evidence, next hypothesis. Explain why a 502 is different from an SSH timeout.

Official reference

Linux man-pages project

Interview and revision check

Why is low free RAM not enough to diagnose memory exhaustion?

Linux uses memory for cache. Inspect available memory, swap activity, workload pressure and OOM evidence.