LINUX FIELD GUIDE // 04
Diagnose Linux storage and network pressure methodically
Move from broad system evidence to a specific archive or endpoint check, verifying each transition.
Storage, archives, and network paths must be inspected before the host runs out of room.
BEFORE YOU START
Prerequisites and boundaries
- Confirm available space on both the source and archive destination filesystems.
- Use an account with read access but avoid unnecessary root privileges.
- Know the expected hostname, protocol, port, and response before network testing.
OPERATIONAL REASONING
Why this sequence matters
The goal is not merely to memorize commands. Each inspection, change, and verification step reduces a different failure mode.
Measure before archiving
Filesystem and directory totals distinguish a full mount from one unexpectedly large path.
Inspect the archive before cleanup
Listing archive contents verifies that the intended files were captured and paths are sensible.
Test network layers in order
DNS, reachability, routing, TLS, and HTTP failures require different fixes.
STANDARD PROCEDURE
Investigate disk pressure and archive a large application log directory safely.
Measure filesystem and directory usage, create the archive, inspect its contents, then confirm its size and location.
- 01
- 02
du -sh /var/log/*GNU du documentation ↗ - 03
tar -czf app-logs.tar.gz /var/log/appGNU tar manual ↗ - 04
tar -tzf app-logs.tar.gzGNU tar manual ↗ - 05
ls -lh app-logs.tar.gzGNU ls documentation ↗
INCIDENT RESPONSE
Diagnose why an HTTPS endpoint cannot be reached, moving from name resolution to the application response.
Check DNS first, then reachability and route, followed by HTTP headers and a verbose TLS/HTTP exchange.
- 01
dig example.comBIND 9 dig documentation ↗ - 02
ping -c 4 example.comping(8) manual page ↗ - 03
traceroute example.comtraceroute project documentation ↗ - 04
curl -I https://example.comcurl command-line manual ↗ - 05
curl -v https://example.comcurl command-line manual ↗
COMMON FAILURE MODES
What usually goes wrong
- An archive was written to the same full filesystem and exhausted the remaining space.
- Absolute paths in an archive produced an unsafe or surprising restore layout.
- A ping failure was mistaken for an application outage even though ICMP was intentionally blocked.
VERIFICATION
Evidence to collect
- df confirms sufficient free space after the operation.
- tar -tzf lists the expected files without extracting them.
- curl reports the expected status, certificate host, and response headers.