Troubleshooting
Troubleshooting tests your ability to diagnose problems methodically across processes, storage, networking, and performance. The exam expects you to gather evidence from logs and live tools before making changes. A structured approach turns confusing symptoms into identifiable root causes.
Reading Logs with journalctl
The systemd journal centralizes logs, queried with 'journalctl'. Filter by unit with '-u', by boot with '-b', by kernel with '-k', and follow live output with '-f'. Time filters like '--since' and '--until' narrow the window during an incident. Traditional text logs may still exist under /var/log for services that write there directly.
Process and Performance Diagnosis
When a system slows, identify the culprit with 'top', 'htop', or 'ps aux --sort=-%cpu'. Load averages from 'uptime' show whether the CPU run queue is saturated, while 'vmstat' and 'iostat' reveal memory pressure and disk bottlenecks. Runaway processes can be paused, reniced with 'nice'/'renice', or terminated with 'kill'. Distinguishing CPU-bound from I/O-bound problems guides the fix.
Network Troubleshooting
Start at the local interface with 'ip addr' and 'ip route', then test reachability with 'ping' and path with 'traceroute' or 'mtr'. Confirm listening services and connections with 'ss -tlnp'. When hosts resolve by IP but not by name, use 'dig' or 'host' to isolate DNS from routing. Working outward layer by layer prevents chasing the wrong problem.
Storage and Filesystem Issues
A full disk is diagnosed with 'df -h', while 'df -i' catches inode exhaustion when free space still appears available. 'du -sh' locates large directories, and 'lsof +L1' finds deleted files still held open by a process. Filesystem corruption is repaired with fsck on an unmounted volume. Reading dmesg or the journal often reveals underlying hardware or driver errors.
A Structured Method
Effective troubleshooting follows a repeatable process: identify the problem, establish a theory, test it, implement a fix, verify, and document. Change one variable at a time so you can attribute results accurately. Capture the state before and after changes so you can roll back if needed. This discipline is more valuable than memorizing any single command.