1 03 Services and logs
Stefan Tanta edited this page 2026-10-08 20:29:19 +02:00

Services, logs, and storage

Goal

Connect a service's state with its process, listening socket, logs, and user-visible behavior.

A process is a running program. A service manager starts and supervises configured services. A listening socket accepts traffic at an address and port.

These are different observations. An active service can still return application errors.

Worked example on the server

systemctl status nginx --no-pager
journalctl -u nginx -n 30 --no-pager
ss -ltn
curl --connect-timeout 3 --max-time 10 http://127.0.0.1/
df -h
df -i

Journal access may require your mentor to run the command with sudo. Nginx also writes application logs under /var/log/nginx/.

ss -ltn selects listening TCP sockets and prints numeric addresses and ports. 127.0.0.1:80 is local-only. 0.0.0.0:80 listens on all IPv4 interfaces.

Listening on all interfaces does not guarantee remote access. Routing and firewall policy still matter. IPv6 listeners need separate interpretation.

df -h reports filesystem capacity and available space. Find / in the mount-point column. df -i reports inode usage.

du -sh ~/interview-practice measures space used by that directory tree. It answers a different question from df.

For file permissions, read ls -l: owner, group, and other each have read/write/execute permissions. Directory execute permission permits traversal.

Do not use chmod 777 as a general fix. Identify the process user and the access it needs first.

Independent exercise

Inspect SSH using systemctl status ssh --no-pager. Find its listening port with ss. Explain what you would inspect if the service were inactive.

Request nginx from the client. Compare this with the local request. Record service state, port, response, and available root filesystem space.

Explain aloud

  • Does an active service prove that a client can use it?
  • What is the difference between starting a service now and enabling it at boot?
  • Why inspect logs before restarting?

Completion check

Show evidence from the service manager, sockets, and a client request. Explain each observation separately.

References: Debian ss manual. For installed tools, use man systemctl, man journalctl, and man df.

Next: Guided troubleshooting