Linux Field Kit · part of ReliabilityOps

What's wrong with this box?

Paste the output you already have. top, dmesg, df, free, journalctl, a failed unit. It reads the signals, ranks what matters, and hands you the next read-only command to run. Nothing installs. Nothing leaves the tab.

✓ Nothing to install ✓ Never connects to a host ✓ Pasted output stays in your browser ✓ Read-only by design

Paste and triage

Drop in one or several outputs. It matches known trouble signatures and orders findings by risk. This runs entirely in your browser.

Why read-only: this kit never touches a server. It reads text you paste and points you at the next command. You stay in control of what actually runs on the box, which is exactly what a change-controlled or audited environment wants.

Read-only diagnostic commands

The "what do I run to see X" library. Every command here only reads. Nothing changes state. Copy and paste.

Trouble signatures

The failures that page you at 2am, what they look like in the logs, and the read-only confirm.

Quick reference

Load average, honestly

  • The 3 numbers are 1, 5, 15-minute run-queue length.
  • Compare to core count: nproc. Load 8 on 8 cores is full, not on fire.
  • Rising 1min over 15min means it's getting worse right now.
  • High load + low CPU usually means I/O wait or D-state processes.

free -m, what's real

  • Look at available, not free. Linux uses spare RAM for cache on purpose.
  • buff/cache is reclaimable. It is not "used up".
  • Swap climbing while available is near zero is the real pressure signal.

Disk: space vs inodes

  • df -h shows space. df -i shows inodes.
  • "No space left" with free space in df -h means inodes are exhausted. Millions of tiny files.
  • Deleted-but-open files still hold space: lsof +L1.

Signals worth knowing

  • SIGTERM (15) polite stop. SIGKILL (9) forced, no cleanup.
  • SIGHUP (1) reload config for many daemons.
  • OOM killer sends SIGKILL. You'll see it in dmesg, not app logs.

systemd states

  • failed the unit died and stayed dead.
  • activating (auto-restart) it's crash-looping.
  • inactive (dead) stopped cleanly, may be normal.
  • Why it died: systemctl status NAME then journalctl -u NAME -b.

Where things live

  • Kernel ring buffer: dmesg or /dev/kmsg.
  • Systemd journal: journalctl. Persistent if /var/log/journal exists.
  • Per-process: /proc/PID/, limits, fd, status, cmdline.
  • Mounts: /proc/mounts. Open files: lsof.