Linux Processes & Troubleshooting

When production breaks, most Linux problems reduce to one of these:

• the wrong process is running (or not running)
• the process exists but is stuck
• the process can’t access files/ports/config
• the process is failing due to system dependencies

This tutorial gives you a quick, repeatable debugging workflow.

Learning outcomes

By the end, you’ll be able to:

• identify processes by name, PID, and resource usage
• inspect open files and network connections
• read systemd logs and correlate them with restarts
• use basic strace to see what a program is trying to do

1) Find the right process

ps: snapshot

# show processes matching a name
ps aux | grep nginx

# inspect a single PID
ps -p 12345 -o pid,ppid,user,cmd,%cpu,%mem,etime

top/htop: live resource view

# interactive view (CPU/memory)
top

# sort by memory usage (top has keybinds too; this is just a reminder)

Tip: If you see repeated restarts, check whether a systemd service is cycling.

2) If you need ports: who is listening?

Use ss (fast) instead of netstat.

# listening TCP/UDP sockets
sudo ss -lntp

# example: filter by port
sudo ss -lntp | findstr :80

3) If you need files: what is the process holding/open?

Use lsof.

sudo lsof -p 12345

# find which process has a specific file open
sudo lsof /var/log/myapp/app.log

4) systemd: logs + restart behavior

If the process is managed by systemd:

# see service status
sudo systemctl status myapp --no-pager

# show recent logs
sudo journalctl -u myapp --since "1 hour ago" --no-pager

# show logs for a previous failed run
sudo journalctl -u myapp -b -1 --no-pager

Troubleshooting pattern:

1. check status (restart count, exit code)
2. read journal logs around the failure time
3. fix config/files/permissions
4. confirm process is listening and healthy

5) strace: see system calls (advanced but practical)

When an app is “hanging,” strace helps you understand whether it’s:

• blocked on I/O
• repeatedly failing to open files
• waiting on DNS/network
• stuck on futex/threads (less common for basic service issues)

# show syscalls for a PID (attach to a running process)
sudo strace -p 12345 -s 200 -f

# trace for a specific command
sudo strace -f -s 200 -o trace.log ./myapp --config /etc/myapp/config.yml

# inspect the output
head -n 50 trace.log

Common “gotchas”

• Permission errors: process can’t read config/log directory
• Port already in use: service fails to bind and systemd restarts it
• Missing environment variables: app runs but can’t find dependencies
• Wrong working directory: relative paths break after service startup

Next steps

Move on to:

• Linux networking fundamentals
• users/groups and permission patterns
• shell scripting patterns for repeatable ops