Linux Troubleshooting Course

Lesson 1 • Boot Process from BIOS to Login

Traces the full startup sequence from firmware through init to a running shell. Provides the foundation for diagnosing boot failures in later chapters.

Lesson 2 • Filesystem Hierarchy and Layout

Maps the standard directory tree and explains the purpose of each top-level path. Enables accurate file location during incident investigation.

Lesson 3 • Kernel and Userspace Interaction

Covers the role of the kernel, system calls, and process privilege levels. Establishes the conceptual boundary that explains most Linux failure modes.

Lesson 1 • System Information and Hardware Queries

Uses dmidecode, lscpu, lshw, and uname to extract hardware and OS metadata. Provides context needed to interpret diagnostic output accurately.

Lesson 2 • Process and Resource Inspection

Teaches ps, top, htop, and related tools to observe running processes and resource consumption. Forms the baseline for CPU and memory diagnostics.

Lesson 3 • Text Processing for Diagnostics

Applies grep, awk, sed, and sort to filter and transform diagnostic output. Enables efficient extraction of relevant data from large log files.

Lesson 4 • Disk and Filesystem Utilities

Covers df, du, lsblk, and fdisk for storage inspection. Directly supports storage troubleshooting covered in later chapters.

Lesson 1 • Correlating Events Across Log Sources

Synchronises timestamps and correlates entries from multiple log files. Produces a unified event timeline essential for complex incident reconstruction.

Lesson 2 • Syslog Architecture and Log Files

Explains rsyslog and syslog-ng configuration, facility/severity levels, and log routing. Establishes the structure behind /var/log entries.

Lesson 3 • Systemd Journal Deep Dive

Covers journalctl filtering, persistent storage, and structured log fields. Enables precise time-bounded queries during incident analysis.

Lesson 4 • Kernel and Boot Log Analysis

Reads dmesg output and early boot logs to identify hardware and driver errors. Bridges boot-process knowledge from Chapter 1 to real failure diagnosis.

Lesson 1 • OOM Killer Behaviour and Tuning

Analyzes OOM killer log entries and adjusts oom_score_adj to protect critical processes. Directly applies log analysis skills from Chapter 3.

Lesson 2 • Performance Profiling with perf and strace

Uses perf record and strace to profile hot code paths and trace system call sequences. Enables deep-dive analysis beyond surface-level metrics.

Lesson 3 • Memory Usage and Leak Detection

Reads /proc/meminfo, uses free and valgrind to detect leaks and excessive consumption. Connects memory metrics to OOM events observed in logs.

Lesson 4 • Zombie and Orphan Process Handling

Explains process lifecycle, parent-child relationships, and how zombies accumulate. Provides remediation steps without disrupting dependent services.

Lesson 1 • Mount Failures and fstab Errors

Resolves boot-time mount failures caused by incorrect fstab entries or missing devices. Applies boot-process knowledge from Chapter 1 to storage recovery.

Lesson 2 • LVM and RAID Troubleshooting

Diagnoses degraded RAID arrays and LVM volume group failures using mdadm and pvdisplay. Covers rebuild procedures and data integrity verification.

Lesson 3 • Disk Health and SMART Diagnostics

Uses smartctl to read drive health attributes and predict failures before data loss. Establishes proactive storage monitoring as a troubleshooting habit.

Lesson 4 • Filesystem Integrity and Repair

Applies fsck and e2fsck to detect and repair filesystem errors on ext and xfs volumes. Covers safe unmounting procedures to prevent further corruption.

Lesson 1 • Service Port and Socket Troubleshooting

Uses ss and netstat to verify that services are listening on expected ports and addresses. Resolves port conflicts and binding failures.

Lesson 2 • Interface and Link Layer Diagnostics

Uses ip link, ethtool, and mii-tool to inspect physical and logical interface state. Identifies duplex mismatches, carrier loss, and driver errors.

Lesson 3 • IP Routing and Gateway Issues

Reads routing tables with ip route and diagnoses missing or incorrect default gateways. Connects interface diagnostics to end-to-end reachability testing.

Lesson 4 • DNS Resolution Failures

Uses dig, nslookup, and /etc/resolv.conf inspection to trace DNS failures. Distinguishes between resolver misconfiguration and upstream DNS outages.

Lesson 1 • Systemd Unit Status and Failure Analysis

Uses systemctl status and journalctl -u to read unit state and exit codes. Builds directly on log analysis skills from Chapter 3.

Lesson 2 • Dependency and Ordering Failures

Maps unit dependency graphs with systemd-analyze and resolves ordering conflicts. Prevents cascading failures caused by missing After= or Requires= directives.

Lesson 3 • Service Crash and Restart Policies

Configures Restart= and RestartSec= directives and interprets crash loop patterns. Balances automatic recovery with preventing resource exhaustion.

Lesson 4 • Resource Limits and Cgroup Controls

Sets CPUQuota, MemoryMax, and IOWeight in unit files to constrain misbehaving services. Connects cgroup concepts introduced in Chapter 4 to service management.

Lesson 1 • AppArmor Profile Diagnostics

Reads AppArmor denial logs and uses aa-logprof to update profiles. Provides an alternative MAC troubleshooting path for Debian-based systems.

Lesson 2 • Sudo and Privilege Escalation Issues

Diagnoses sudoers syntax errors and permission denials using visudo and sudo -l. Ensures privilege escalation paths are correct and auditable.

Lesson 3 • SELinux Policy Troubleshooting

Uses audit2allow, sealert, and restorecon to diagnose and fix SELinux denials. Avoids the common mistake of disabling SELinux instead of fixing the policy.

Lesson 4 • SSH Authentication Failures

Resolves key-based and password authentication failures using ssh -vvv and sshd logs. Covers common permission errors on authorized_keys and .ssh directories.