Deleted files holding disk

df full but du clean? Unlinked files held open by a pid; restart it to reclaim

lsof +L1 | sort -k7 -rn | head
tool
troubleshooting32 commands
tags
troubleshootingdiskdebugperformance

More troubleshooting commands

  • Disk I/O latency saturation
    iostat -x 1 | awk '$1!~/^$/{print $1, "util="$NF, "await="$(NF-2)}'

    %util near 100 with rising await = saturated device; correlate with the noisy pid

  • Per-process block I/O top
    biotop-bpfcc -C 5 1

    bcc biotop: which pid drives block I/O by bytes/latency; modern: bpftrace one-liners

  • Conntrack table full check
    conntrack -L 2>/dev/null | wc -l; conntrack -S

    Count tracked flows vs limit; -S shows insert_failed/drop when table full

  • Conntrack live events
    conntrack -E -p tcp --dport 443 -o timestamp

    Stream NEW/DESTROY events live to catch NAT/timeout drops on a port

  • Ephemeral port exhaustion
    ss -tan state time-wait | wc -l; sysctl net.ipv4.ip_local_port_range

    Count TIME-WAIT sockets vs port range; note: tune tw_reuse not tw_recycle

all 32 troubleshooting commands