🎯 About this course

You can already run a Linux server. This course teaches you to find out what is wrong with one, and why it is slow, without guessing. You learn a method (state the symptom, look wide, form one guess, change one thing with a way back, check) and then apply it to the faults that really happen: a load average that does not match the CPU graph, a process that eats a processor, a memory leak and the process the kernel ends, a disk that fills and space that will not come back, a disk that is slow, a service that will not start, a pause before every page, and a machine that does not boot. Behind the commands you learn where the numbers come from, how the kernel's managers share the machine, and how monitoring, capacity and runbooks keep the next fault small. Every exercise names who needs it and why, uses a simulated server, and ends with a check of the effective state rather than the command you meant to type.

By the end you will be able to

Apply a troubleshooting method: state the symptom exactly, look wide first, form one guess, change one thing with a way back and check the result.
Use /proc, the journal and the kernel log to read what the machine records, and use strace and lsof to follow one program.
Analyse load, the run queue and the CPU states, and use priorities and signals to share the processors fairly.
Evaluate memory, cache and swap, recognise a leak by sampling, and read the OOM killer's evidence.
Use df, du, find and lsof to find what fills a disk and free space in the safest order, including space held by open files.
Analyse a slow disk with iostat and iowait, and read and raise file-descriptor limits safely.
Use dig, ping and curl to split a slow request into name lookup, connection and answer, and fix a dead resolver.
Use systemctl and the journal to repair a service that will not start, and diagnose a boot problem with fstab, mount -a and systemctl --failed.

Curriculum

Topics covered

The method 5 topics

Entry check: are you ready to investigate?
A forty-five minute check of the skills this course builds on (processes, files, logs, services), with a pointer to the earlier topic to revisit for each one.
The troubleshooting method
Say the symptom exactly, look at the whole machine in the first minute, make a guess you can disprove, change one thing at a time, measure again and write it down.
Reading what the machine tells you
Load average against CPU count, /proc/loadavg and /proc/meminfo, a process's folder under /proc, the STAT letters in ps and top, and how to read all of it without being…
Logs and the journal as evidence
Where the machine writes its records (text logs, the journal, the kernel ring buffer), how to count and group them, how to ask the journal for one service, and how to…
Following a program: strace and lsof
System calls and their error names, tracing a program with strace, what a process holds open (lsof and /proc/PID/fd), finding the owner of a port, and fixing the…

CPU and memory 4 topics

CPU, load and the run queue
The states a CPU can be in, the run queue against the CPU count, splitting a process's time into user and system, and using sar to find when a CPU jump began.
Priorities, pausing and fair sharing
Nice values and the fair-share rule, renice and nice, who may change them, pausing and resuming with STOP and CONT, and choosing the gentlest control that works.
Memory, cache and swap
Reading free and /proc/meminfo correctly, the page cache, swap and thrashing, ranking processes by RSS, and tuning and persisting vm.swappiness.
Memory leaks and the OOM killer
Recognising a leak by sampling RSS, computing time to failure, reading the OOM killer's lines in dmesg, mitigating with a restart, and reporting the real fix.

Disk and I/O 4 topics

A full disk
Finding the full filesystem with df, the culprit with du and find, freeing space in the safest order, truncating an open log, and preventing a repeat with rotation and…
Space that will not come back
Why rm does not free space held by a process, finding the holder with lsof +L1, releasing it by restarting the owner, the inode table filling with tiny files, and a…
Slow disks and I/O wait
How a slow disk looks (idle CPUs, iowait, load, D state), reading iostat -x, naming the writer with pidstat and iotop, finding the start with sar -d, and choosing a…
Limits and open files
File descriptors and the open-files limit, soft and hard limits, reading /proc/PID/limits and counting descriptors, raising a limit for a shell, a process and a service…

Network, services and boot 3 topics

Slow names and broken connections
Splitting a slow request into name lookup, connection and answer, a dead first resolver and the ten-second pause, dig and dig +short, resolv.conf order, testing by…
Services that will not start
The path status, journal, config, one fix, start, check; reading systemctl status and exit statuses (1/FAILURE, 203/EXEC, 217/USER), journalctl -u, -n and -b, fixing…
Boot problems: where did it stop?
The stages of a boot (firmware, bootloader, kernel, systemd), emergency mode and the fstab line for a missing disk, mount -a, nofail, keeping a copy and testing before…

Infrastructure behind the numbers 4 topics

Where the numbers come from: kernel, /proc, counters
The sources of numbers on a Linux machine (kernel counters, /proc and /sys, the reading tools, tracing, logs and the clock), a card for each, and one number followed…
The kernel's scheduler, memory manager and I/O queue
The managers inside the kernel (the CPU scheduler, the I/O scheduler and block layer, the memory manager, the network stack, control groups and limits), a card for each…
Monitoring, history and alerts
The parts of the monitoring chain (collector, time-series store, dashboards, alert rules, notification and on-call, log shipping and retention), a card for each, and one…
Capacity, limits and runbooks
The parts of the capacity and recovery layer (capacity planning, limits and quotas, load testing, runbooks, change and review), a card for each, and one filling disk…

Interview ready 2 topics

Interview ready: the method, CPU, memory and disk
The questions people really ask about the first minutes of an investigation, load and CPU, memory and the OOM killer, full disks and space held by open files, with model…
Interview ready: network, services, boot and the infrastructure
The questions people really ask about slow names, services that will not start, boot problems, the sources of numbers, the kernel's managers, monitoring and capacity…

Course at a glance

See how this course is built

Where the time goes

Longer spokes mean more hours on that module.

Course roadmap click a step

Try a lesson0 / 3

Sample questions from this course. Your progress is kept only in your browser.

Week by week

Drag the slider, or press play, to walk through the course and see what you will have built by each week.

Week 1 of 8

Wk 1

Welcome to the investigation

The entry check and scenes 1 to 4: the method, reading the machine, logs, strace and lsof.

Wk 2

CPU and memory

Scenes 5 to 8: load, priorities, memory, cache and swap, leaks and the OOM killer.

Wk 3

Disk and I/O

Scenes 9 to 12: full disks, space that will not come back, slow disks and limits.

Wk 4

Network, services and boot

Scenes 13 to 15: slow names, services that will not start, boot problems.

Wk 5

Under the hood

Scenes 16 to 19: where numbers come from, the kernel's managers, monitoring, capacity and runbooks.

Wk 6

Interview ready

Scenes 20 and 21: model answers, timed hands-on tasks and a mock round.

Wk 7

Capstone work session

Build the capstone: three investigations and the capacity pack.

Wk 8

Capstone review

Present the capstone.

What you'll build

The investigation notebook

Three investigations written as a symptom, the evidence (commands and output), one guess, one change with its way back and the check: a CPU or load problem, a memory or disk problem and a service or boot problem.

The capacity and monitoring pack

A forecast of days of headroom from the history, a load alert written as a script that has been seen to fire, a log rotation policy, limits set from measurements, and the commands that prove each.

The runbook set

Runbooks of one page each for a full disk, a service that will not start and a slow-names report, tried in a drill, with owners, dates and an escalation contact.

Why take this course

Find the cause of a slow or failing server
Read load, memory and disk numbers correctly
Fix faults safely, with a way back

You will build

An investigation notebook
A capacity and monitoring pack
A set of runbooks

What you can do afterwards

Handle the first call about a sick server with confidence
Explain your evidence, your guess and your change
Answer troubleshooting interview questions with specifics

How to take it

💳 Delivery & fees

One course, four ways to attend. Fees are per course, in rupees excluding 18% GST (the GST-inclusive amount is shown too).Fees are per course, in Canadian dollars, before applicable GST/HST.Fees are per course, in US dollars, before any applicable local taxes. Bulk and institutional volume pricing is available.

Bulk and institutional pricing. Volume discounts are available for institutions, campuses, companies and groups enrolling several learners. Ask for a group quote →

Your fee includes our GPU lab infrastructure — no cloud credits to buy. See how we compare, with sources →

Linux Troubleshooting and Performance