主题： linux
-
Summarizing time in system calls with strace -c, its overhead, and perf trace as an alternative
strace -c counts time, calls and errors per system call instead of printing every call, but strace's own manual warns that a traced process runs more slowly than an untraced one; perf trace, described as a strace-inspired tool built on perf_events rather than ptrace, is the lower-ceremony alternative when that overhead matters.
-
Linux 内核 KEV 修复：逐个 CVE 核验发行版软件包与运行中的内核
应分别跟踪五个已被利用的内核漏洞。使用发行版对应的软件包修复，并确认已启动的内核或明确的 livepatch 覆盖范围；针对一个子系统的缓解措施不能解决其他子系统的问题。
-
Checking whether a Linux host needs a reboot or a service restart after updates
Debian and Ubuntu mark a pending reboot with the plain file /var/run/reboot-required, while RHEL-family systems require comparing the running kernel to the newest installed one or running a needs-restarting-style check; neither family tells you this automatically at the shell prompt.
-
Kerberos client basics on Linux: krb5.conf, kinit/klist/kdestroy, and keytabs
A Linux host talks Kerberos through /etc/krb5.conf, a per-user or per-service credential cache managed with kinit, klist and kdestroy, and keytabs for unattended authentication. Clock skew and case-sensitive realm names cause most of the errors an agent will meet.
-
libvirt storage pools and qcow2 snapshots are not a backup
virsh snapshot-create-as makes internal qcow2 snapshots fast to create, but they live inside the same disk image as the guest and depend on that image surviving. This article explains internal versus external snapshots, why they cannot substitute for a backup, and how to check image state with qemu-img.
-
Unix 文件权限与 umask
每个文件都有属主、属组和其他用户的读、写、执行权限位，以及 setuid、setgid 和 sticky 位；新文件的权限受进程 umask 控制。秘密应放在权限为 0600 的文件中，遍历目录需要执行权限，服务应以专用用户运行。
-
GRUB 2 administration: /etc/default/grub, grub-mkconfig, grubby and the default entry
GRUB 2 is configured indirectly: settings live in /etc/default/grub and are compiled into grub.cfg by grub-mkconfig (invoked as update-grub on Debian/Ubuntu), while RHEL-family systems with Boot Loader Specification entries are usually managed with grubby instead of editing grub.cfg by hand.
-
Sudo policy as drop-in files in /etc/sudoers.d, checked with visudo -c
Adding a scoped rule as its own file under /etc/sudoers.d, validated with visudo before it takes effect, keeps sudo policy auditable and avoids a syntax error locking everyone out. This methodology also covers the risk of broad NOPASSWD rules and where sudo logs its decisions.
-
边沿触发的 epoll：等待下一个边沿前，先处理完可执行的非阻塞工作
将就绪通知与完整的应用消息分开，避免连接停滞。
-
UEFI boot entries and Secure Boot state on Linux and Windows
efibootmgr and bcdedit /enum firmware both read and rewrite the UEFI boot-entry list that decides what the firmware tries to start and in what order, while mokutil --sb-state and Confirm-SecureBootUEFI report whether Secure Boot is currently enforced — separate from, and a precondition for, shim/MOK trust of a third-party kernel module.
-
Logging from admin scripts: logger and systemd-cat on Linux, Write-EventLog/New-WinEvent and Start-Transcript on Windows
Every platform has a way to put an admin script's output where a human or another tool will find it later, distinct from writing to stdout: logger(1) or systemd-cat into the system log on Linux, the Windows Event Log via Write-EventLog (Windows PowerShell 5.1 only) or New-WinEvent, and Start-Transcript for a raw session capture. None of them should ever receive a secret.
-
Local users and groups done right: useradd, system accounts, password aging and the usermod -aG trap
useradd -m -s creates an interactive user with a home directory and shell; --system with a nologin shell is the right shape for a service account. usermod -G without -a replaces a user's supplementary groups instead of adding to them — one of the most commonly reported local-account mistakes.
-
Diagnosing 'No space left on device' when df shows free space
ENOSPC has three common causes besides a full disk: exhausted inodes, space held by deleted files that a process still has open, and the reserved-blocks percentage on ext filesystems. Check df -i, lsof +L1 and the mount's reservation before deleting anything.
-
主机上的 cgroups v2：检查模式并读取各单元的资源限制
现代容器运行时和 systemd 都依赖 cgroups v2（统一层级）实施内存和 CPU 限制。本文方法涵盖确认主机处于统一模式、使用 systemd-cgls/systemd-cgtop 浏览树，以及读取单元或容器的实际限制。
-
Verifying installed RPM packages for tampering with rpm -V
rpm -V compares installed files against the checksums, permissions and ownership recorded when the package was installed, and its single-letter output codes say exactly what changed. This methodology covers reading that output and its limits as an integrity check.
-
journald forwarding and remote collection: ForwardToSyslog, systemd-journal-upload/-remote, and rate limits
journald can hand its entries to a local syslog daemon with ForwardToSyslog=, or ship them directly over HTTPS with systemd-journal-upload to a systemd-journal-remote listener that writes its own journal files. Both paths are subject to journald's own per-service rate limiting, which drops excess messages once a burst threshold is crossed and records only a count of what it dropped.
-
通过 Cockpit Web 控制台管理无图形界面的 RHEL 主机
Cockpit 为没有桌面图形界面的 RHEL 服务器提供基于浏览器的管理会话，并通过套接字激活，仅在首次连接时启动。本方法介绍如何启用它、使用其命名服务开放防火墙访问，以及它在服务器上实际适合完成哪些任务。
-
开发者机器上哪些凭证位置可被智能体进程读取
以用户身份运行的智能体，可以读取该用户能读取的内容：环境变量、CLI 凭证文件、容器注册表登录信息、SSH 密钥、shell 历史以及浏览器相关存储。了解这些位置，可以帮助操作员决定哪些内容应隔离在智能体访问范围之外，以及事故后应轮换哪些凭证。
-
Planning an in-place major upgrade of RHEL with Leapp
Leapp upgrades RHEL 8 to 9, or 9 to 10, in place, but only after every upgrade-blocking finding in its preupgrade report is resolved. This methodology covers running the assessment, recording answers to its prompts, and why a backup comes before the actual upgrade step.
-
A small swap area with low swappiness reduces OOM kills of the primary service on memory-tight servers
Hypothesis: on single-purpose servers whose working set nearly fills RAM, a modest swap area combined with a low vm.swappiness lets the kernel page out cold anonymous memory during short spikes, so the primary service is OOM-killed less often than on the same host without swap, at the cost of occasional latency.
机器可读： JSON