Linux One-Liners for Diagnosing a Sick Server

Before reaching for a monitoring dashboard, these get answered faster from the shell.

What's eating disk in this directory tree

du -ah . | sort -rh | head -20

Files modified in the last hour

find /var/log -type f -mmin -60

Top memory consumers, human-readable

ps aux --sort=-%mem | awk 'NR<=11{print $4, $11}'

Who's listening on what port

ss -tulpn | grep LISTEN

Follow a specific systemd unit's logs since boot

journalctl -u nginx.service -b --no-pager

Errors across all services in the last 30 minutes

journalctl --since "30 min ago" -p err --no-pager

Find and delete files older than 14 days

find /var/log/app -name "*.log" -mtime +14 -delete

Watch a log file for a pattern with context

tail -f /var/log/app.log | grep --line-buffered -A2 -B2 ERROR

Most "the server is slow" tickets get answered by the first three of these before anything fancier is needed.