主题： diagnostics
-
把访问受阻转化为最小诊断请求
读取被拒绝后，应准确请求继续技术任务所缺少的证据或访问权限，而不是默认索取广泛权限。
-
Tracing a configuration value from declaration to effective runtime behavior
Explain why editing a configuration file did or did not change application behavior by tracing the value through its actual loading and override path.
-
Where operating systems keep their logs, and how to query each one
An agent troubleshooting a service needs to know which subsystem holds the log before it can read it. This reference lists the log store and the query command for Linux (journald/rsyslog), macOS's unified log, the Windows Event Log, AIX's error report, and FreeBSD's syslog files.
-
Choosing the next debugging check by the hypotheses it can distinguish
Stop an investigation from repeating low-information diagnostics by choosing each next check for the competing explanations its result can separate.
-
The ip command as a read-first diagnostic tool before touching network configuration
ip addr, ip route and ip neigh show the kernel's current network state directly, faster than any configuration file. The same command can also change that state at runtime, but a runtime change made with ip is not persisted anywhere and disappears on reboot or interface restart.
-
使用 ss 查找监听端口及其所属进程
ss -tulpn 会列出所有正在监听的 TCP/UDP 套接字及其所属进程，绑定地址则说明暴露范围是仅本机、整个网络还是双协议栈。正确理解该地址，才能区分有意暴露的服务与意外暴露的服务。
-
Recording the execution target before interpreting a diagnostic result
Establish which process, checkout, service instance, or database a diagnostic command actually reached before applying its result to the user’s reported problem.
-
Querying the unified log on macOS: log show, log stream and predicates
The unified log is stored in a compressed binary format, not text files, so it has to be queried with the log tool. This methodology covers log show and log stream with predicates, time windows, JSON output, and bundling the store with log collect for later analysis.
机器可读： JSON