Incident guide · System health
Linux system health cheat sheet
A read-first reference for CPU, memory, process, hardware, clock, and host identity checks during an incident.50explained commands3practical sections100%concrete examples
20
Establish a baseline
Capture load, memory, host identity, resource limits, and time synchronization.
Show system uptime and load averagesuptimeRead-only
Show Linux memory and swap usagefree -hRead-only
Show hostname and operating system identityhostnamectl statusRead-only
Show all shell resource limitsulimit -aRead-only
Show chrony synchronization and clock offsetchronyc trackingRead-only
Print kernel, architecture, and system informationuname -aRead-only
Show the current user and group identitiesidRead-only
List environment variables alphabeticallyenv | sortRead-only
Print the current time in ISO 8601 formatdate -IsecondsRead-only
Show recent system reboot historylast reboot | head -10Read-only
List active login sessionsloginctl list-sessionsRead-only
Inspect one login sessionloginctl show-session 2 -p Name,Remote,Type,Class,StateRead-only
List users known to logindloginctl list-usersRead-only
Show clock, timezone, and synchronization statetimedatectl statusRead-only
Show time synchronization detailstimedatectl timesync-statusRead-only
Search available time zonestimedatectl list-timezones | rg '^Europe/' | headRead-only
Export host identity as JSONhostnamectl status --json=shortRead-only
Print only the static hostnamehostnamectl hostnameRead-only
List IPv4 kernel networking parameterssysctl -a 2>/dev/null | rg '^net\.ipv4\.' | headRead-only
Show whether IPv4 forwarding is enabledsysctl net.ipv4.ip_forwardRead-only
20
Locate resource pressure
Compare scheduler, CPU, memory, process, and sensor evidence before acting.
Sample scheduler, memory, I/O, and CPU statevmstat 1 5Read-only
Sample extended device I/O statisticsiostat -xz 1 3Read-only
Sample per-process CPU usagepidstat -u 1 3Read-only
Sample per-process page faults and memorypidstat -r 1 3Read-only
Show hardware temperature and fan sensorssensorsRead-only
Show the ten processes using the most memoryps aux | sort -nrk 4,4 | head -10Read-only
Show the ten processes using the most CPUps aux | sort -nrk 3,3 | head -10Read-only
Capture one non-interactive process snapshottop -b -n 1 | head -20Read-only
Rank processes by CPU with memory, age, and full commandps -eo pid,ppid,user,%cpu,%mem,rss,etime,stat,command --sort=-%cpu | head -<count>Read-only
Show a process subtree with PIDs and command argumentspstree -aps <process-id>Read-only
Show the boot critical path and activation delayssystemd-analyze critical-chainRead-only
Inspect Linux CPU, memory, and I/O pressure stall metricsgrep -H . /proc/pressure/{cpu,memory,io}Read-only
Sample scheduler, memory, paging, I/O, and CPU pressurevmstat -w <seconds> <count>Read-only
Take a batch snapshot of cgroup CPU, memory, and I/O usagesystemd-cgtop --batch --iterations=1 --depth=<count>Read-only
Trace file-related system calls from a running Linux processsudo strace -f -p <process-id> -e trace=%file -s 256caution
Summarize system call counts, errors, and time for a programstrace -c <executable>caution
Find open files that were deletedlsof +L1Read-only
Show processes using a pathlsof <path>Read-only
List established TCP connections with ownerslsof -nP -iTCP -sTCP:ESTABLISHEDRead-only
Show processes using a mounted filesystemfuser -vm <path>Read-only
10
Correlate services and logs
Connect host pressure to failed units, boot warnings, and bounded journal evidence.