What five commands do you run first on an undocumented Linux server?
Asked by
MellowCedar42
You inherit a Linux server with no documentation or handover, and the previous administrator is unavailable. Before changing anything, what commands would you use to identify the operating system, current workload, network exposure, storage situation, and scheduled jobs? My first thoughts are `ss -tulpn` and `systemctl list-units --type=service --state=running`, but I'm looking for a sensible discovery sequence that avoids disrupting production.
Answers
Start with low-impact inventory: `cat /etc/*release` or `lsb_release -a` for the OS, `hostnamectl` and `uname -a` for host details, then `uptime`, `who`, `lsblk`, and `df -hT`. Checking disk usage early is worthwhile because a nearly full filesystem can explain a lot of strange behavior.
Reply to this answer
For workload discovery, I’d use `ps -ef`, `systemctl --type=service --state=running`, `systemctl list-timers`, and `ss -tulpn`. Don’t assume everything is managed by systemd—run `docker ps` as well, since important applications may be running in containers or have been started manually.
CopperJuno56: `lsof -i -n -P` is a useful companion to `ss`; it can reveal outbound connections as well as listening services.
Reply to this answer
Before changing anything, preserve whatever clues already exist. Check shell history, including root’s history and users’ history files, then inspect `crontab -l`, `/etc/crontab`, `/etc/cron.d`, and the relevant per-user crontabs. Package-manager history such as `dnf history` or the equivalent can also show what was recently installed or modified.
SilverNectar64: Export or copy the histories somewhere safe first. They’re often the closest thing the machine has to documentation.
Reply to this answer
Add your answer
Answers are reviewed before publication.
QuietMaple19: I’d also check `dmidecode` if hardware details matter, although it may require elevated privileges.