'The server is acting up' becomes an actual diagnosis once you know which specific command answers which specific question — disk space, memory, what's actually running, and what a service logged right before it failed. This closing lesson ties the whole domain together into a real diagnostic workflow.
3 min read
df (disk free) shows how much space is used and available on each
mounted filesystem — the first thing worth checking when something fails with
a vague "no space left on device" error:
$ df -h # -h: human-readable sizes (GB, MB) instead of raw byte counts
Filesystem Size Used Avail Use%
/dev/sda1 50G 47G 3G 94%du (disk usage) shows what's actually consuming space within a
directory — the natural next step once df confirms a disk is nearly full,
narrowing down which specific directory is the actual culprit:
$ du -sh /var/log/* # -s: summarize each item, -h: human-readable
2.1G /var/log/nginx
340M /var/log/appfree shows memory usage — how much is used, available, and (on Linux)
held in cache that can be reclaimed if something else needs it:
$ free -h
total used free available
Mem: 16G 12G 1G 3GA system that's technically "out of free memory" isn't necessarily in
trouble — much of "used" memory is often reclaimable cache, which is exactly
why the available column (accounting for that reclaimable portion) is the
more meaningful number to actually watch, not raw free.
On systems using systemd (most modern Linux distributions), journalctl
shows system and service logs — including exactly what a service logged
right before it crashed or failed to start:
$ journalctl -u nginx -n 50 # last 50 log lines for the nginx service specifically
$ journalctl -u nginx -f # follow it live, exactly like tail -f from earlier in this domainFor an application's own log files (not managed by systemd), the tools from
earlier in this domain apply directly: tail -f app.log to watch it live,
grep "ERROR" app.log to search it, combined together
(tail -f app.log | grep "ERROR") to watch only the error lines as they
happen in real time.
systemctl checks and controls services (long-running background
programs managed by the system, like a web server or database):
$ systemctl status nginx # is it running? when did it last start or fail?
$ systemctl restart nginx # stop and start it again
$ systemctl enable nginx # make it start automatically on bootsystemctl status is very often the single fastest first check on an
unresponsive server — it directly answers "is the actual service even
running at all," before investigating anything more specific.
Putting this whole domain together, a genuinely common real scenario — "the app on this server stopped responding":
ssh into the server (this domain's SSH lesson)systemctl status myapp — is the process even running?journalctl -u myapp -n 100 — what did it log right before
it stopped?top/htop — is it stuck at 100% CPU, or out
of memory? (free -h to confirm)df -h — is the disk actually full, silently causing writes to fail?Every lesson here builds toward exactly this kind of moment: navigating to where the problem actually is, reading and searching the right files, checking permissions and ownership when something is unexpectedly inaccessible, understanding what's running and why, and having the specific command that answers the specific question a real failure raises — turning "something's wrong with the server" from a source of dread into a routine, answerable diagnosis.
Check your understanding
A quick comprehension check — not tracked, not graded, just for you.
1. What's the practical difference between what `df` and `du` reveal?
2. Why is `systemctl status` often the fastest first check on an unresponsive server?
3. Why is the 'available' memory figure from `free -h` often more meaningful than raw 'free' memory?
Linux & the Command Line