Details
Goals & objectives
Hardware & software
Solution overview
In this lab you inherit a host that has been running unattended and someone says it "feels slow." Your job is to replace that feeling with measurements. You first make the systemd journal persistent so evidence stops disappearing at every reboot, then prove that a CPU spike happened overnight by lining up sar's history against the journal at the same timestamp. From there you follow a runaway logging service from its disk I/O signature in iostat and iotop to the memory it is slowly leaking, and you watch a MemoryMax cap contain it so the host stays healthy. You finish by measuring swap activity before and after the sysctl change everyone recommends, keeping only the kernel setting the numbers actually justify.