Health Check

Linux System Health Checks and Monitoring Guide with Explanations

This guide provides a complete understanding of system health monitoring and includes what happens when you run each command along with common issues & solutions.

---

🚀 Step 1: Monitor CPU, Memory, and Disk Usage

1.1 Check CPU Usage

🔹 Check real-time CPU usage:

top

What Happens?

• Displays real-time CPU, memory, and process usage.

• Press q to exit.

🔹 Alternative (more user-friendly):

htop

What Happens?

• Similar to top, but with better visuals and colors.

• Press F9 to kill processes directly.

🔹 Check CPU usage history:

sar -u 5 10

What Happens?

• Captures CPU usage every 5 seconds for 10 times.

🔹 View CPU usage by each core:

mpstat -P ALL

What Happens?

• Shows CPU utilization per core.

✅ Common Issue: High CPU Usage 🔹 Find the process consuming CPU:

ps -eo pid,ppid,cmd,%cpu --sort=-%cpu | head

What Happens?

• Lists top CPU-consuming processes.

🔹 Kill high CPU-consuming process:

kill -9 <PID>

What Happens?

• Immediately terminates the process with no chance of cleanup.

• Useful when service/process consuming high ram/CPU u can kill it and restart it

• Prevents the server from crashing due to high CPU usage.

• we can kill service when there is port conflict

• sudo lsof -i :80 and sudo kill -9

• Useful when service is hang and not responsive

🔹 Safer alternative:

kill -15 <PID>

What Happens?

• Sends a graceful termination signal, allowing the process to shut down properly.

---

1.2 Check Memory Usage

🔹 Check available and used memory:

free -m

What Happens?

• Displays memory usage in MB.

🔹 Detailed memory usage:

vmstat -s

What Happens?

• Shows swap, active, and inactive memory details.

✅ Common Issue: Memory Running Low 🔹 Find high memory-consuming processes:

ps aux --sort=-%mem | head

What Happens?

• Lists top memory-consuming processes.

🔹 Clear cached memory:

sync; echo 3 > /proc/sys/vm/drop_caches

What Happens?

• Clears disk cache without affecting running applications.

---

1.3 Check Disk Usage

🔹 View disk space usage:

df -h

What Happens?

• Shows disk usage in human-readable format.

🔹 Check individual file sizes:

du -sh /var/log/*

What Happens?

• Shows size of each file in /var/log.

🔹 Find large files (above 1GB):

find / -type f -size +1G

What Happens?

• Searches for files larger than 1GB.

✅ Common Issue: Disk Full 🔹 Find and delete old logs:

rm -rf /var/log/*.gz

What Happens?

• Deletes compressed log files.

🔹 Remove unnecessary packages:

apt autoremove -y  # (Debian/Ubuntu)
yum autoremove -y  # (RHEL/CentOS)

What Happens?

• Removes unused dependencies.

---

🚀 Step 2: Monitor System Load

🔹 Check system load (1, 5, 15 min avg):

uptime

What Happens?

• Shows system load averages over time.

🔹 Detailed load average:

cat /proc/loadavg

What Happens?

• Displays CPU load statistics.

✅ Common Issue: High Load Average 🔹 Check which process is causing load:

top -o %CPU

What Happens?

• Sorts processes by CPU usage.

🔹 Reduce load by stopping unnecessary services:

systemctl stop apache2

What Happens?

• Stops the Apache web server.

---

🚀 Step 3: Check Running Services

🔹 List all running services:

systemctl list-units --type=service

What Happens?

• Lists active systemd services.

🔹 List only failed services:

systemctl list-units --failed

What Happens?

• Displays failed services.

🔹 Check service status:

systemctl status sshd

What Happens?

• Shows the running status of the SSH service.

✅ Common Issue: Service Not Running 🔹 Restart a failed service:

systemctl restart nginx

What Happens?

• Stops and then starts the service.

🔹 Enable a service on boot:

systemctl enable nginx

What Happens?

• Ensures the service starts on boot.

---

🚀 Step 4: Log Analysis

🔹 View system logs:

journalctl -xe

What Happens?

• Shows detailed logs of recent issues.

🔹 Check kernel logs:

dmesg | tail -20

What Happens?

• Displays the last 20 kernel logs.

✅ Common Issue: Too Many Log Errors 🔹 Clear logs safely:

logrotate -f /etc/logrotate.conf

What Happens?

• Rotates logs based on configured policies.

---

🚀 Step 5: Network Diagnostics

🔹 Check network connections:

netstat -tulnp

What Happens?

• Shows open ports and listening services.

🔹 Check bandwidth usage:

iftop

What Happens?

• Displays real-time network usage.

5.2 Test Network Connectivity

🔹 Ping a server:

ping -c 4 google.com

What Happens?

• Sends 4 ICMP packets to check connectivity.

🔹 Check if a port is open:

nc -zv google.com 443

What Happens?

• Tests if port 443 (HTTPS) is open.

✅ Common Issue: Internet Not Working 🔹 Check if default gateway is set:

ip route show

What Happens?

• Displays network routing table.

🔹 Restart network service:

systemctl restart networking

What Happens?

• Restarts all network interfaces.

---

🚀 Step 6: Security Health Check

🔹 Check failed login attempts:

cat /var/log/auth.log | grep "Failed password"

What Happens?

• Finds unauthorized login attempts.

🔹 Check for running root processes:

ps aux | grep root

What Happens?

• Lists processes running as root.

✅ Common Issue: SSH Brute Force Attacks 🔹 Block repeated failed login attempts:

fail2ban-client status sshd

What Happens?

• Displays ban status for failed SSH attempts.

🔹 Manually block IP:

iptables -A INPUT -s <IP> -j DROP

What Happens?

• Blocks the IP from accessing the system.

---

🚀 Summary

✔ Monitored CPU, Memory, and Disk Usage ✔ Checked System Load and Running Services ✔ Analyzed Logs for Errors ✔ Diagnosed Network Issues ✔ Performed Security Audits

---

Next: Do you want to configure system alerts using Prometheus and Grafana? 🚀