Trace system calls of a process
Prints out all system calls a PID makes (crucial for deep debugging).
strace -p <pid>Slows the traced process noticeably; be careful on busy production hosts.
Debugging commands
11 commands from the cloud runbook. Fill in a placeholder once and every command uses it.
List open files by process
Shows all files, sockets, and connections opened by a PID.
lsof -p <pid>Live CPU profiling (perf)
Shows a live view of the hottest CPU functions in the system.
sudo perf topVirtual memory stats
Shows system performance statistics (CPU, memory, I/O) every 2 seconds.
vmstat 2 10Disk I/O statistics
Shows CPU and disk I/O stats, refreshing every second.
iostat -xz 1Count connections by state
Groups and counts TCP connections by their state (ESTABLISHED, TIME_WAIT, etc.).
ss -tan | awk 'NR>1 {print $1}' | sort | uniq -c | sort -rnCapture a core dump of a running process
Writes a core file and lets the process carry on; it pauses only while the dump is written. gcore ships with gdb.
sudo gcore -o core <pid>Curl with timing breakdown
Shows detailed timing of DNS, connect, TLS, and transfer phases.
curl -o /dev/null -s -w "DNS: %{time_namelookup}s\nConnect: %{time_connect}s\nTLS: %{time_appconnect}s\nTotal: %{time_total}s\n" https://example.comDebug a pod with an ephemeral container
Attaches a temporary debug container that shares the target container's processes; useful when the image has no shell.
kubectl debug -it <pod-name> -n <namespace> --image=busybox:1.36 --target=<container-name>Find deleted files still held open
Lists files that were deleted but are still open. Their space is not freed until the process closes them, so a disk can be full while du looks fine.
sudo lsof +L1Find out-of-memory kills
Searches the kernel log for processes the OOM killer ended.
sudo journalctl -k | grep -iE 'out of memory|killed process'