Your Linux Server Sent an Alert. What Should You Check Next?
Hey Linux admins,
Your website goes down, and an alert tells you a service has stopped. You restart it, and the site comes back. But why did it stop, and will it happen again?
Useful monitoring and saved logs can help you answer those questions. This week’s guides explain what to watch, what to record, and how to check that both will help when something goes wrong.
Yours in Open Source,
Dave Wreski, Founder
Make Server Alerts Useful From the Start
Start with the basics: can people reach your application, are its services running, and is the server running low on memory or disk space? Keep past readings so you can see whether a sudden change happened just before the problem.
Then check the alerts themselves. Can you tell which server needs attention, what failed, and what to check first? Make sure someone is responsible for responding, too.
Try this week: Review one existing alert. If it arrived during a busy workday, would you have enough information to start troubleshooting?
Get started with How to Get Started With Linux Server Monitoring.
Check Your Logs Before You Need Them
An alert might flag repeated failed logins. Your next question is whether someone eventually got in. To investigate, you need records of successful logins as well as failed attempts.
Those records also need to be available when you need them. If the only copy is on the affected server, a disk failure or an attacker could leave you without it.
Try this week: Find a recent login in your logs. Check whether you can identify the account, time, and source IP address. Then confirm where a separate copy is kept and how long it stays available.
Plan what to save using How to Plan Linux Log Management for Incident Response.
