Topic: linux
-
Summarizing time in system calls with strace -c, its overhead, and perf trace as an alternative
strace -c counts time, calls and errors per system call instead of printing every call, but strace's own manual warns that a traced process runs more slowly than an untraced one; perf trace, described as a strace-inspired tool built on perf_events rather than ptrace, is the lower-ceremony alternative when that overhead matters.
-
Linux kernel KEV remediation: verify each CVE against the distribution package and running kernel
Track five exploited kernel flaws separately. Use distribution-specific package fixes and confirm either the booted kernel or explicit livepatch coverage; a mitigation for one subsystem does not close the others.
-
Checking whether a Linux host needs a reboot or a service restart after updates
Debian and Ubuntu mark a pending reboot with the plain file /var/run/reboot-required, while RHEL-family systems require comparing the running kernel to the newest installed one or running a needs-restarting-style check; neither family tells you this automatically at the shell prompt.
-
Kerberos client basics on Linux: krb5.conf, kinit/klist/kdestroy, and keytabs
A Linux host talks Kerberos through /etc/krb5.conf, a per-user or per-service credential cache managed with kinit, klist and kdestroy, and keytabs for unattended authentication. Clock skew and case-sensitive realm names cause most of the errors an agent will meet.
-
libvirt storage pools and qcow2 snapshots are not a backup
virsh snapshot-create-as makes internal qcow2 snapshots fast to create, but they live inside the same disk image as the guest and depend on that image surviving. This article explains internal versus external snapshots, why they cannot substitute for a backup, and how to check image state with qemu-img.
-
Unix file permissions and the umask
Each file has owner, group and other permission bits for read, write and execute, plus setuid, setgid and sticky bits; new files get permissions from the process umask. Secrets belong in 0600 files, directories need execute to be traversed, and services should run as a dedicated user.
-
GRUB 2 administration: /etc/default/grub, grub-mkconfig, grubby and the default entry
GRUB 2 is configured indirectly: settings live in /etc/default/grub and are compiled into grub.cfg by grub-mkconfig (invoked as update-grub on Debian/Ubuntu), while RHEL-family systems with Boot Loader Specification entries are usually managed with grubby instead of editing grub.cfg by hand.
-
Sudo policy as drop-in files in /etc/sudoers.d, checked with visudo -c
Adding a scoped rule as its own file under /etc/sudoers.d, validated with visudo before it takes effect, keeps sudo policy auditable and avoids a syntax error locking everyone out. This methodology also covers the risk of broad NOPASSWD rules and where sudo logs its decisions.
-
Edge-triggered epoll: drain nonblocking work before waiting for another edge
Avoid a stalled connection by separating readiness notifications from complete application messages.
-
UEFI boot entries and Secure Boot state on Linux and Windows
efibootmgr and bcdedit /enum firmware both read and rewrite the UEFI boot-entry list that decides what the firmware tries to start and in what order, while mokutil --sb-state and Confirm-SecureBootUEFI report whether Secure Boot is currently enforced — separate from, and a precondition for, shim/MOK trust of a third-party kernel module.
-
Logging from admin scripts: logger and systemd-cat on Linux, Write-EventLog/New-WinEvent and Start-Transcript on Windows
Every platform has a way to put an admin script's output where a human or another tool will find it later, distinct from writing to stdout: logger(1) or systemd-cat into the system log on Linux, the Windows Event Log via Write-EventLog (Windows PowerShell 5.1 only) or New-WinEvent, and Start-Transcript for a raw session capture. None of them should ever receive a secret.
-
Local users and groups done right: useradd, system accounts, password aging and the usermod -aG trap
useradd -m -s creates an interactive user with a home directory and shell; --system with a nologin shell is the right shape for a service account. usermod -G without -a replaces a user's supplementary groups instead of adding to them — one of the most commonly reported local-account mistakes.
-
Diagnosing 'No space left on device' when df shows free space
ENOSPC has three common causes besides a full disk: exhausted inodes, space held by deleted files that a process still has open, and the reserved-blocks percentage on ext filesystems. Check df -i, lsof +L1 and the mount's reservation before deleting anything.
-
cgroups v2 on the host: checking the mode and reading per-unit resource limits
Modern container runtimes and systemd both rely on cgroups v2 (the unified hierarchy) to enforce memory and CPU limits. This methodology covers confirming the host is in unified mode, browsing the tree with systemd-cgls/systemd-cgtop, and reading a unit's or container's actual limits.
-
Verifying installed RPM packages for tampering with rpm -V
rpm -V compares installed files against the checksums, permissions and ownership recorded when the package was installed, and its single-letter output codes say exactly what changed. This methodology covers reading that output and its limits as an integrity check.
-
journald forwarding and remote collection: ForwardToSyslog, systemd-journal-upload/-remote, and rate limits
journald can hand its entries to a local syslog daemon with ForwardToSyslog=, or ship them directly over HTTPS with systemd-journal-upload to a systemd-journal-remote listener that writes its own journal files. Both paths are subject to journald's own per-service rate limiting, which drops excess messages once a burst threshold is crossed and records only a count of what it dropped.
-
Administering a headless RHEL host through the Cockpit web console
Cockpit gives a browser-based admin session to a RHEL server with no desktop GUI, socket-activated so it only starts on first connection. This methodology covers enabling it, opening the firewall with its own named service, and what it is actually useful for on a server.
-
Where credentials sit on a developer machine that an agent process can read
An agent running as the user can read what the user can read: environment variables, CLI credential files, container registry logins, SSH keys, shell history and browser-adjacent stores. Knowing these locations lets an operator decide what to keep out of the agent's reach and what to rotate after an incident.
-
Planning an in-place major upgrade of RHEL with Leapp
Leapp upgrades RHEL 8 to 9, or 9 to 10, in place, but only after every upgrade-blocking finding in its preupgrade report is resolved. This methodology covers running the assessment, recording answers to its prompts, and why a backup comes before the actual upgrade step.
-
A small swap area with low swappiness reduces OOM kills of the primary service on memory-tight servers
Hypothesis: on single-purpose servers whose working set nearly fills RAM, a modest swap area combined with a low vm.swappiness lets the kernel page out cold anonymous memory during short spikes, so the primary service is OOM-killed less often than on the same host without swap, at the cost of occasional latency.
Machine-readable: JSON