Jorge V.
Sample Post incident review lesson is underrated
Writing blameless reviews with clear actions has improved how our team learns from outages.
Linux troubleshooting: performance, logs and systemd
Find the cause of slow, failing and crashing Linux systems with a method: CPU, memory, disk and network analysis, logs, strace, perf and eBPF tools
Created by Sofia Marchetti
- Updated September 2026
- English
- Advanced
What you will learn
- Run a structured first five minutes triage on any Linux server
- Apply the USE method to CPU, memory, disk and network
- Diagnose memory pressure, swapping and OOM kills
- Measure disk and network latency and find the processes responsible
- Debug failing systemd services and slow boots
- Use strace, perf and eBPF tools to explain behaviour other tools cannot
Course content
A method for troubleshooting
Memory problems
- Video: How Linux uses memory 11 min
- Video: Swapping and reclaim 10 min
- Article: The OOM killer and cgroup limits 11 min
- Video: Finding memory leaks 10 min
Disk and file system problems
- Video: Measuring disk latency and queues 11 min
- Article: Which process is doing I/O 9 min
- Video: Full file systems and deleted open files 10 min
- Video: Cloud volume limits and burst credits 8 min
Network problems
- Article: Socket states and connection limits 11 min
- Video: Retransmits, drops and latency 10 min
- Video: DNS and TLS failures 9 min
- Article: Capturing traffic with tcpdump 10 min
systemd and boot problems
- Video: Services that fail or restart in a loop 10 min
- Video: Slow and failed boots 9 min
- Article: Resource control with cgroups 9 min
Deeper tools
- Video: strace: what is this process doing? 11 min
- Video: lsof and the proc file system 8 min
- Article: CPU profiling with perf 11 min
- Video: eBPF tools: bpftrace and bcc 11 min
- Video: Writing a post incident review 8 min
- Quiz: Final check 6 min
Requirements
- Confident Linux administration: services, packages, logs and the shell
- A virtual machine where you have root access for the labs
Description
"The server is slow" is one of the least helpful sentences in operations, and one of the most common. This course teaches you to turn it into a precise answer: which resource is saturated, which process is responsible and why. The goal is not to memorise every tool, but to follow a method that works under pressure.
What you will learn
- A repeatable triage routine for the first minutes of an incident
- The USE method: utilisation, saturation and errors for every resource
- CPU analysis with load, run queues, steal time and per process statistics
- Memory: page cache, reclaim, swap, pressure stall information and the OOM killer
- Disk I/O latency and queueing, and file system full emergencies
- Network sockets, retransmits and connection limits
- systemd failures, boot problems and log analysis with journalctl
- Deeper tools: strace, lsof, perf and eBPF based tools such as bpftrace
How the course works
Each section starts from a reproducible problem on a lab virtual machine: a CPU bound process, a memory leak, a slow disk, a socket exhaustion, a service crash loop. You observe the symptoms, apply the method, find the cause and fix it. You will write short incident notes as you go, a habit that makes you more effective and more trusted on any team.
You should already be comfortable administering a Linux server. Examples use Ubuntu LTS with notes for RHEL based systems.
Who this course is for
- System administrators and SREs on call for Linux systems
- Backend developers who debug their applications in production
- Support engineers who escalate performance problems
Instructor
Sofia Marchetti
Linux systems engineer teaching the shell, Ubuntu servers and calm troubleshooting
- 4.4 instructor rating
- 22 reviews
- 8,330 students
- 3 courses
- Sample
I have administered Linux servers for web applications, build machines and databases. What I enjoy most is the moment a confusing system starts to make sense, and that is what I try to recreate in my lessons.
I begin with the shell and the file system, then move to users, permissions, packages, services and logs. The later courses focus on troubleshooting with systemd, journalctl, and performance tools such as top, vmstat, iostat and ss.
I teach on Ubuntu LTS because it is common and well documented, but I point out where Debian, Fedora and RHEL based systems differ so the skills travel with you.
Student reviews
Magnus E.
Sample The method is what I was missing
I used to run random tools during incidents. The USE method and the first five minutes routine changed how I work.
Leyla H.
Sample Load average finally explained
Understanding that Linux load includes tasks waiting on disk explained an incident we misdiagnosed last year.
Keiko N.
Sample Deleted open files lesson saved a night
A full disk at 2am turned out to be a deleted log still held open. I knew exactly what to check.
Hellen W.
Sample Dense, needs time
Accurate and deep. I needed to repeat several lessons, so plan for more time than the video length suggests.
Robert F.
Sample Excellent hands on labs
Reproducing each problem on the lab VM before learning the answer made it stick. The eBPF lesson could be longer.
Samir B.
Sample Advanced and practical
Strong content on memory and disks. Network section was good but I would like more on tcpdump filters.
Keep exploring
All Linux courses
More in Linux
$69.99
Enroll now