Incident guide · Services & logs
Linux services and logs cheat sheet
Investigate systemd units, boots, journal storage, web-server configuration, and recent service failures.50explained commands3practical sections100%concrete examples
25
systemd state and history
Inspect failed units, dependencies, properties, prior boots, and bounded logs.
List failed systemd servicessystemctl --failedRead-only
Show key runtime properties for a servicesystemctl show <unit> -p ActiveState,SubState,MainPID,ExecMainStatusRead-only
Show reverse dependencies for a unitsystemctl list-dependencies --reverse <unit>Read-only
List recorded boots with identifiersjournalctl --list-bootsRead-only
Read service logs since a precise timejournalctl -u <unit> --since '2026-07-24 10:00:00' --no-pagerRead-only
Show journal disk usagejournalctl --disk-usageRead-only
Show priority errors from the current bootjournalctl -p err -bRead-only
Show the latest kernel messagesdmesg | tail -30caution
Find every log file below the current directoryfind . -type f -name '*.log' -printRead-only
Detect services and versions on selected TCP portsnmap -sV --version-light -p <ports> <host>caution
Read one service log for the last hour with precise timestampsjournalctl -u <service> --since '1 hour ago' -o short-iso-precise --no-pagerRead-only
Print status details for every failed systemd unitsystemctl --failed --no-legend | awk '{print $1}' | xargs -r systemctl status --no-pager --lines=<lines>Read-only
Show what depends on a systemd servicesystemctl list-dependencies --reverse --all <service>Read-only
Show kernel and service warnings from the current bootjournalctl -b -p warning..alert --no-pager -o short-isoRead-only
Review successful and failed sudo activity for todayjournalctl _COMM=sudo --since today -o short-iso --no-pagercaution
Connect to a TCP service and read its banner with netcatprintf '\n' | nc -v -w 5 <host> <port>Read-only
List enabled service unit filessystemctl list-unit-files --type=service --state=enabledRead-only
Validate the NGINX configurationnginx -tRead-only
Dump the resolved NGINX configurationnginx -T 2>&1 | head -30Read-only
Show NGINX build options and modulesnginx -V 2>&1Read-only
Validate the Apache HTTP Server configurationapachectl configtestRead-only
Show Apache virtual-host routingapachectl -SRead-only
List loaded Apache modulesapachectl -MRead-only
Validate an HAProxy configurationhaproxy -c -f /etc/haproxy/haproxy.cfgRead-only
Show HAProxy version and build featureshaproxy -vv | head -20Read-only
10
Web service configuration
Validate and inspect NGINX, Apache, and HAProxy configuration before reload.
Show recent HAProxy configuration parse errorshaproxy -c -V -f /etc/haproxy/haproxy.cfg 2>&1 | tail -20Read-only
Check whether PostgreSQL accepts connectionspg_isready -h <host> -p 5432 -d <database>Read-only
Show PostgreSQL server version and recovery statepsql -d <database> -Atc "select version(), pg_is_in_recovery();"Read-only
Summarize PostgreSQL sessions by statepsql -d <database> -c "select state, count(*) from pg_stat_activity group by state order by state;"Read-only
Check whether MySQL respondsmysqladmin -h <host> pingRead-only
Show MySQL server version and uptimemysql -h <host> -NBe "select @@version, @@hostname, uptime from performance_schema.global_status where variable_name='Uptime';"Read-only
Show MySQL thread and connection countersmysql -h <host> -e "show global status where Variable_name in ('Threads_connected','Threads_running','Max_used_connections');"Read-only
Check whether Redis respondsredis-cli -h <host> -p 6379 PINGRead-only
Show compact Redis server and memory stateredis-cli -h <host> --no-auth-warning INFO server memory | rg '^(redis_version|uptime_in_seconds|used_memory_human|maxmemory_human):'Read-only
Run a bounded Redis intrinsic latency sampletimeout 5 redis-cli -h <host> --intrinsic-latency 2Read-only
15
Correlate process and file evidence
Connect a failing service to its processes, open files, resource pressure, and configuration paths.