Linux Troubleshooting Course

Lesson 1 • Boot Process from BIOS to Login

This traces the full startup sequence from firmware through init to a running shell. It provides the foundation for diagnosing boot failures in later chapters.

Lesson 2 • Filesystem Hierarchy and Layout

This maps the standard directory tree and explains the purpose of each top-level path. It enables accurate file location during incident investigation.

Lesson 3 • Kernel and Userspace Interaction

This covers the role of the kernel, system calls, and process privilege levels. It establishes the conceptual boundary that explains most Linux failure modes.

Lesson 1 • System Information and Hardware Queries

This uses dmidecode, lscpu, lshw, and uname to extract hardware and OS metadata. It provides the context needed to interpret diagnostic output accurately.

Lesson 2 • Process and Resource Inspection

This teaches ps, top, htop, and related tools to observe running processes and resource consumption. This forms the baseline for CPU and memory diagnostics.

Lesson 3 • Text Processing for Diagnostics

This applies grep, awk, sed, and sort to filter and transform diagnostic output. This enables efficient extraction of relevant data from large log files.

Lesson 4 • Disk and Filesystem Utilities

This covers df, du, lsblk, and fdisk for storage inspection. This directly supports storage troubleshooting covered in later chapters.

Lesson 1 • Correlating Events Across Log Sources

This synchronises timestamps and correlates entries from multiple log files. This produces a unified event timeline essential for complex incident reconstruction.

Lesson 2 • Syslog Architecture and Log Files

This explains rsyslog and syslog-ng configuration, facility/severity levels, and log routing. This establishes the structure behind /var/log entries.

Lesson 3 • Systemd Journal Deep Dive

This covers journalctl filtering, persistent storage, and structured log fields. This enables precise time-bounded queries during incident analysis.

Lesson 4 • Kernel and Boot Log Analysis

This reads dmesg output and early boot logs to identify hardware and driver errors. This bridges boot-process knowledge from Chapter 1 to real failure diagnosis.

Lesson 1 • OOM Killer Behaviour and Tuning

This analyses OOM killer log entries and adjusts oom_score_adj to protect critical processes. This directly applies log analysis skills from Chapter 3.

Lesson 2 • Performance Profiling with perf and strace

This uses perf record and strace to profile hot code paths and trace system call sequences. This enables deep-dive analysis beyond surface-level metrics.

Lesson 3 • Memory Usage and Leak Detection

This reads /proc/meminfo, uses free and valgrind to detect leaks and excessive consumption. This connects memory metrics to OOM events observed in logs.

Lesson 4 • Zombie and Orphan Process Handling

This explains process lifecycle, parent-child relationships, and how zombies accumulate. This provides remediation steps without disrupting dependent services.

Lesson 1 • Mount Failures and fstab Errors

This resolves boot-time mount failures caused by incorrect fstab entries or missing devices. This applies boot-process knowledge from Chapter 1 to storage recovery.

Lesson 2 • LVM and RAID Troubleshooting

This diagnoses degraded RAID arrays and LVM volume group failures using mdadm and pvdisplay. This covers rebuild procedures and data integrity verification.

Lesson 3 • Disk Health and SMART Diagnostics

This uses smartctl to read drive health attributes and predict failures before data loss. This establishes proactive storage monitoring as a troubleshooting habit.

Lesson 4 • Filesystem Integrity and Repair

This applies fsck and e2fsck to detect and repair filesystem errors on ext and xfs volumes. This covers safe unmounting procedures to prevent further corruption.

Lesson 1 • Service Port and Socket Troubleshooting

This uses ss and netstat to verify that services are listening on expected ports and addresses. This resolves port conflicts and binding failures.

Lesson 2 • Interface and Link Layer Diagnostics

This uses ip link, ethtool, and mii-tool to inspect physical and logical interface state. This identifies duplex mismatches, carrier loss, and driver errors.

Lesson 3 • IP Routing and Gateway Issues

This reads routing tables with ip route and diagnoses missing or incorrect default gateways. This connects interface diagnostics to end-to-end reachability testing.

Lesson 4 • DNS Resolution Failures

This uses dig, nslookup, and /etc/resolv.conf inspection to trace DNS failures. This distinguishes between resolver misconfiguration and upstream DNS outages.

Lesson 1 • Systemd Unit Status and Failure Analysis

This uses systemctl status and journalctl -u to read unit state and exit codes. This builds directly on log analysis skills from Chapter 3.

Lesson 2 • Dependency and Ordering Failures

This maps unit dependency graphs with systemd-analyze and resolves ordering conflicts. This prevents cascading failures caused by missing After= or Requires= directives.

Lesson 3 • Service Crash and Restart Policies

This configures Restart= and RestartSec= directives and interprets crash loop patterns. This balances automatic recovery with preventing resource exhaustion.

Lesson 4 • Resource Limits and Cgroup Controls

This sets CPUQuota, MemoryMax, and IOWeight in unit files to constrain misbehaving services. This connects cgroup concepts introduced in Chapter 4 to service management.

Lesson 1 • AppArmor Profile Diagnostics

This reads AppArmor denial logs and uses aa-logprof to update profiles. This provides an alternative MAC troubleshooting path for Debian-based systems.

Lesson 2 • Sudo and Privilege Escalation Issues

This diagnoses sudoers syntax errors and permission denials using visudo and sudo -l. This ensures privilege escalation paths are correct and auditable.

Lesson 3 • SELinux Policy Troubleshooting

This uses audit2allow, sealert, and restorecon to diagnose and fix SELinux denials. This avoids the common mistake of disabling SELinux instead of fixing the policy.

Lesson 4 • SSH Authentication Failures

This resolves key-based and password authentication failures using ssh -vvv and sshd logs. This covers common permission errors on authorized_keys and .ssh directories.