You inherit a Linux server with no documentation or handover, and the previous administrator is unavailable. Before changing anything, what commands would you use to identify the operating system, current workload, network exposure, storage situation, and scheduled jobs? My first thoughts are `ss -tulpn` and `systemctl list-units --type=service --state=running`, but I'm looking for a sensible discovery sequence that avoids disrupting production.
3 Answers
Before changing anything, preserve whatever clues already exist. Check shell history, including root’s history and users’ history files, then inspect `crontab -l`, `/etc/crontab`, `/etc/cron.d`, and the relevant per-user crontabs. Package-manager history such as `dnf history` or the equivalent can also show what was recently installed or modified.
For workload discovery, I’d use `ps -ef`, `systemctl --type=service --state=running`, `systemctl list-timers`, and `ss -tulpn`. Don’t assume everything is managed by systemd—run `docker ps` as well, since important applications may be running in containers or have been started manually.
`lsof -i -n -P` is a useful companion to `ss`; it can reveal outbound connections as well as listening services.
Start with low-impact inventory: `cat /etc/*release` or `lsb_release -a` for the OS, `hostnamectl` and `uname -a` for host details, then `uptime`, `who`, `lsblk`, and `df -hT`. Checking disk usage early is worthwhile because a nearly full filesystem can explain a lot of strange behavior.
I’d also check `dmidecode` if hardware details matter, although it may require elevated privileges.
Export or copy the histories somewhere safe first. They’re often the closest thing the machine has to documentation.