Troubleshooting

# Show live CPU, memory, load, and top processes.
top

# List the highest CPU processes.
ps aux --sort=-%cpu | head -20

# Show per-process CPU usage every second.
pidstat -u -p <pid> 1

# Show CPU usage by thread for one process.
ps -T -p <pid> -o pid,tid,pcpu,pmem,comm

# Attach to a process and see frequent syscalls or blocking calls.
strace -tt -p <pid>

# Show memory usage, available memory, cache, and swap.
free -h

# Show memory pressure, swap activity, and run queue every second.
vmstat 1

# List the highest memory processes.
ps aux --sort=-%mem | head -20

# Check whether the kernel or cgroup killed a process because of OOM.
dmesg -T | grep -i -E 'oom|killed process'

# Show enabled swap devices and current swap usage.
swapon --show

# Show filesystem space usage.
df -h

# Show inode usage for filesystems.
df -ih

# Find large first-level directories under /var.
du -h --max-depth=1 /var | sort -h

# Find files larger than 1 GiB under /var.
find /var -type f -size +1G -ls

# Find deleted files that are still held open by processes.
lsof +L1

# Show disk utilization, queueing, and latency every second.
iostat -xz 1

# Show processes currently doing disk IO.
iotop -oPa

# Show per-process disk read/write activity every second.
pidstat -d 1

# Show block devices, filesystems, and mount targets.
lsblk -f

# Show listening TCP ports and owning processes.
ss -lntp

# Find which process is using a specific port.
lsof -i :<port>

# Test whether the service works from the same host.
curl -v http://127.0.0.1:<port>/

# Test whether the service works through the target host or IP.
curl -v http://<host>:<port>/

# Show routing table and default gateway.
ip route

# Capture packets for the target port to see whether traffic reaches the host.
tcpdump -i <iface> port <port>

# Show service state, exit code, recent logs, and restart status.
systemctl status <service>

# Show recent journal logs for the service.
journalctl -u <service> -n 200

# Follow service logs in real time.
journalctl -u <service> -f

# Show the effective systemd unit and override files.
systemctl cat <service>

# Show environment variables configured in systemd for the service.
systemctl show <service> --property=Environment

# Clear systemd failed state after fixing the service.
systemctl reset-failed <service>

# Find PID and full command. Replace <name> with the process keyword.
pgrep -af <name>

# Show PID, parent PID, user, terminal, start time, elapsed time, and command.
ps -o pid,ppid,user,tty,stat,lstart,etime,cmd -p <pid>

# Show the parent chain. This is usually the fastest way to see who started it.
pstree -aps <pid>

# Show the direct parent process.
ps -fp $(ps -o ppid= -p <pid>)

# Show executable path, working directory, and command line.
readlink -f /proc/<pid>/exe
readlink -f /proc/<pid>/cwd
tr '\0' ' ' < /proc/<pid>/cmdline; echo

# Show cgroup. This often reveals systemd service, user session, Docker, or Kubernetes.
cat /proc/<pid>/cgroup

# Ask systemd which unit owns this PID.
systemctl status <pid>

# If a unit is found, inspect its real startup command and config path.
systemctl cat <service>
systemctl show <service> \
  --property=MainPID,ExecStart,User,Group,FragmentPath,DropInPaths,Environment

# See recent logs for that service.
journalctl -u <service> -n 200

/system.slice/<name>.service:
    system service started by systemd

/user.slice/user-1000.slice/...:
    user session or user-level systemd service

/docker/<container-id> or /system.slice/docker-<id>.scope:
    Docker container process

/kubepods/...:
    Kubernetes pod/container process

/session-<id>.scope:
    login session, ssh session, tmux/screen/manual command possible

likely manual foreground:
    parent chain includes sshd -> bash/zsh -> process
    TTY is pts/*
    process dies when terminal/session exits unless protected by tmux/screen/nohup

likely manual background/nohup:
    parent may become PID 1 after shell exits
    no systemd service unit
    cwd may point to user's working directory
    command may include nohup or redirected logs

likely system daemon:
    cgroup points to /system.slice/<service>.service
    systemctl status <pid> finds the unit
    systemctl cat shows ExecStart
    journalctl -u shows logs

likely container:
    cgroup mentions docker/containerd/kubepods
    command may be the container entrypoint
    real startup config is in Docker Compose, Docker inspect, or Kubernetes manifest

# systemd restart policy.
systemctl show <service> --property=Restart,RestartSec,NRestarts

# timers may periodically start jobs.
systemctl list-timers --all

# cron entries.
crontab -l
sudo ls -l /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly
sudo grep -R '<name>' /etc/cron* 2>/dev/null

# supervisor / pm2.
supervisorctl status
pm2 list

# Docker restart policy.
docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
docker inspect <container> --format '{{json .HostConfig.RestartPolicy}}'

crictl ps | grep <name>
kubectl get pod -A -o wide | grep <node-or-pod-keyword>
kubectl describe pod -n <namespace> <pod>
kubectl get deploy,statefulset,daemonset -n <namespace>

# Check whether the current machine's default DNS resolver can resolve the domain.
dig <domain>

# Bypass the local resolver and compare the answer with public DNS.
dig @8.8.8.8 <domain>

# Check the full HTTP/TLS path: DNS, TCP connect, TLS handshake, cert validation, and HTTP status.
curl -v https://<domain>/

# Check TLS handshake, certificate chain, SAN/CN, expiry, and SNI behavior.
openssl s_client -connect <host>:443 -servername <domain>

# Check whether system time is obviously wrong.
date

# Check timezone, NTP status, and whether system time is synchronized.
timedatectl