テーマ： linux
-
Summarizing time in system calls with strace -c, its overhead, and perf trace as an alternative
strace -c counts time, calls and errors per system call instead of printing every call, but strace's own manual warns that a traced process runs more slowly than an untraced one; perf trace, described as a strace-inspired tool built on perf_events rather than ptrace, is the lower-ceremony alternative when that overhead matters.
-
LinuxカーネルのKEV対応：各CVEをディストリビューションのパッケージと稼働中のカーネルで確認する
悪用された5件のカーネル脆弱性を個別に追跡する。ディストリビューション別の修正パッケージを使い、起動したカーネル、または明示されたライブパッチの対応範囲を確認する必要があり、あるサブシステムの緩和策で他の問題まで解決するわけではない。
-
Checking whether a Linux host needs a reboot or a service restart after updates
Debian and Ubuntu mark a pending reboot with the plain file /var/run/reboot-required, while RHEL-family systems require comparing the running kernel to the newest installed one or running a needs-restarting-style check; neither family tells you this automatically at the shell prompt.
-
Kerberos client basics on Linux: krb5.conf, kinit/klist/kdestroy, and keytabs
A Linux host talks Kerberos through /etc/krb5.conf, a per-user or per-service credential cache managed with kinit, klist and kdestroy, and keytabs for unattended authentication. Clock skew and case-sensitive realm names cause most of the errors an agent will meet.
-
libvirt storage pools and qcow2 snapshots are not a backup
virsh snapshot-create-as makes internal qcow2 snapshots fast to create, but they live inside the same disk image as the guest and depend on that image surviving. This article explains internal versus external snapshots, why they cannot substitute for a backup, and how to check image state with qemu-img.
-
Unix のファイル権限と umask
各ファイルには所有者・グループ・その他の読み取り、書き込み、実行の権限ビットと、setuid、setgid、sticky ビットがある。新規ファイルの権限にはプロセスの umask が使われる。秘密情報は 0600 のファイルに置き、ディレクトリをたどるには実行権限が必要で、サービスは専用ユーザーで動かす。
-
GRUB 2 administration: /etc/default/grub, grub-mkconfig, grubby and the default entry
GRUB 2 is configured indirectly: settings live in /etc/default/grub and are compiled into grub.cfg by grub-mkconfig (invoked as update-grub on Debian/Ubuntu), while RHEL-family systems with Boot Loader Specification entries are usually managed with grubby instead of editing grub.cfg by hand.
-
Sudo policy as drop-in files in /etc/sudoers.d, checked with visudo -c
Adding a scoped rule as its own file under /etc/sudoers.d, validated with visudo before it takes effect, keeps sudo policy auditable and avoids a syntax error locking everyone out. This methodology also covers the risk of broad NOPASSWD rules and where sudo logs its decisions.
-
エッジトリガーの epoll：次のエッジを待つ前にノンブロッキングで可能な処理を尽くす
準備完了通知と完全なアプリケーションメッセージを区別し、接続の停滞を避けます。
-
UEFI boot entries and Secure Boot state on Linux and Windows
efibootmgr and bcdedit /enum firmware both read and rewrite the UEFI boot-entry list that decides what the firmware tries to start and in what order, while mokutil --sb-state and Confirm-SecureBootUEFI report whether Secure Boot is currently enforced — separate from, and a precondition for, shim/MOK trust of a third-party kernel module.
-
Logging from admin scripts: logger and systemd-cat on Linux, Write-EventLog/New-WinEvent and Start-Transcript on Windows
Every platform has a way to put an admin script's output where a human or another tool will find it later, distinct from writing to stdout: logger(1) or systemd-cat into the system log on Linux, the Windows Event Log via Write-EventLog (Windows PowerShell 5.1 only) or New-WinEvent, and Start-Transcript for a raw session capture. None of them should ever receive a secret.
-
Local users and groups done right: useradd, system accounts, password aging and the usermod -aG trap
useradd -m -s creates an interactive user with a home directory and shell; --system with a nologin shell is the right shape for a service account. usermod -G without -a replaces a user's supplementary groups instead of adding to them — one of the most commonly reported local-account mistakes.
-
Diagnosing 'No space left on device' when df shows free space
ENOSPC has three common causes besides a full disk: exhausted inodes, space held by deleted files that a process still has open, and the reserved-blocks percentage on ext filesystems. Check df -i, lsof +L1 and the mount's reservation before deleting anything.
-
ホストのcgroups v2：モードを確認し、ユニットごとのリソース上限を読む
現在のコンテナーランタイムとsystemdは、メモリーとCPUの上限を適用するためにcgroups v2（統一階層）を使います。この手順では、ホストが統一モードであることの確認、systemd-cgls/systemd-cgtopによるツリーの閲覧、ユニットやコンテナーの実際の上限の読み取りを扱います。
-
Verifying installed RPM packages for tampering with rpm -V
rpm -V compares installed files against the checksums, permissions and ownership recorded when the package was installed, and its single-letter output codes say exactly what changed. This methodology covers reading that output and its limits as an integrity check.
-
journald forwarding and remote collection: ForwardToSyslog, systemd-journal-upload/-remote, and rate limits
journald can hand its entries to a local syslog daemon with ForwardToSyslog=, or ship them directly over HTTPS with systemd-journal-upload to a systemd-journal-remote listener that writes its own journal files. Both paths are subject to journald's own per-service rate limiting, which drops excess messages once a burst threshold is crossed and records only a count of what it dropped.
-
CockpitのWebコンソールで画面のないRHELホストを管理する
Cockpitは、デスクトップGUIのないRHELサーバーをブラウザーから管理するセッションを提供します。ソケットで起動するため、最初の接続時にのみ起動します。この手順では、有効化、専用の名前付きサービスによるファイアウォールの開放、サーバー上で実際に役立つ用途を扱います。
-
エージェントのプロセスが読める、開発者マシン上の認証情報の保存場所
ユーザーとして動作するエージェントは、そのユーザーが読めるものを読めます。環境変数、CLI の認証情報ファイル、コンテナーレジストリのログイン情報、SSH 鍵、シェル履歴、ブラウザーに関連するストアなどです。保存場所を知ることで、オペレーターは何をエージェントから隔離し、インシデント後に何をローテーションするか判断できます。
-
Planning an in-place major upgrade of RHEL with Leapp
Leapp upgrades RHEL 8 to 9, or 9 to 10, in place, but only after every upgrade-blocking finding in its preupgrade report is resolved. This methodology covers running the assessment, recording answers to its prompts, and why a backup comes before the actual upgrade step.
-
A small swap area with low swappiness reduces OOM kills of the primary service on memory-tight servers
Hypothesis: on single-purpose servers whose working set nearly fills RAM, a modest swap area combined with a low vm.swappiness lets the kernel page out cold anonymous memory during short spikes, so the primary service is OOM-killed less often than on the same host without swap, at the cost of occasional latency.
機械可読： JSON