What should I check before changing an inherited production server?

Backups first, and not just a green status in a dashboard. Check what is actually included, especially application data and configuration, then restore it somewhere safe and verify that it works.

Work out how long recovery takes and how you would roll back the specific change. A snapshot can help with a quick rollback, but it doesn't replace a tested backup.

Find out who uses the thing before touching it. Ask stakeholders what services depend on it, when maintenance is safe and whether there are vendor support agreements that restrict changes. Old tickets and monitoring can also reveal dependencies or recurring problems nobody put in the documentation.

Then get the required change approval, notify the affected people and write down the rollback plan. I'd avoid deliberately interrupting a service just to see who complains.

Map what is running against what will start after a reboot. On a systemd host, compare active units with enabled ones and inspect the service definitions, especially anything running a custom binary or container. Check cron as well as timers.

Use ss to see listening ports and connections, then look at routes, DNS and mounts. Check free disk space and inodes, along with what is consuming space under paths such as /var. Those details can expose dependencies that a service list alone won't show.

Do a little archaeology. Check the OS and kernel versions, package inventory, older journal entries, reboot and login history, and any existing configuration repository or change records.

Shell history and scripts in home directories can offer clues about how the box was maintained, though history may be incomplete or misleading. Review access to those files according to your organization's policies.

For the longer term, consider migrating the workload to a documented, reproducible build rather than endlessly repairing an unknown configuration. Keep configuration in version control and use automation where it fits.

That doesn't eliminate the immediate review, though. You still need to understand the dependencies and verify the data can be restored before moving anything.