tag: #tip-of-the-week

top tells you a process is busy. It does not tell you why. The perf toolchain, plus a handful of eBPF-based tools, answer the why at the level of functions, cache misses, and individual block-device latencies. This is the advanced layer, for when the basic tools have already told you which process to look at.

Plain ip link and ip addr dump a wall of text for every interface, most of it irrelevant when you just want to know what is up and what has an address. The -br flag collapses each interface to a single line, and it is the version you should be reaching for on every troubleshooting call.

On Debian and Ubuntu, two commands look like they do the same thing. They do not. adduser is a Perl wrapper from the adduser package. useradd is the raw binary from upstream shadow-utils. The difference catches operators who write portable scripts and expect either name to work the same way on RHEL or Alpine.

PID 1 in Linux has special responsibilities that most application processes are not designed to handle. The --init flag in Docker inserts a tiny init process between PID 1 and your application, which solves the zombie reaping problem and the signal forwarding problem in one line.

A zombie process is already dead. kill minus nine does nothing to it. The fix is always one level up the process tree, because the bug is in the parent that failed to reap its child, never in the child itself.

A binary deleted from disk while the process is still running is not actually gone. The kernel keeps the inode alive as long as the process holds it, and /proc/PID/exe is a real readable handle to it. You can copy a running program out of /proc and reconstruct it on disk byte for byte.

The bash !$ history expansion substitutes the last argument of the previous command which turns destructive operations like rm into a two-step ritual where the first step is always a preview.