Learn how Linux works, then practise fixing it
Most Linux courses teach commands. This track teaches how the system behaves, so that when something breaks you know where to look. It's written for two readers: a new graduate who has typed a few commands in college, and an associate engineer who uses Linux every day but still escalates when a server misbehaves. Each module builds on the ones before it.
Every module is built to be worked through, not just read. Each one opens with what you'll learn, includes hands-on Try it commands, recaps the key terms, and ends with a five-question pop quiz: three questions on the ideas and two real-world scenarios, shuffled into a new order every time. Score 4 out of 5 to pass.
- New to Linux, or only used it in college? Start at Module 01 and read in order. It sets up the free lab VM that every module uses.
- Use Linux at work already? Take the pop quiz at the end of each Part 1 module. Pass all five, then start at Part 2, where most day-to-day troubleshooting knowledge lives.
- Chasing a specific problem? Go straight to the module for it: services in 07, memory in 09, disks in 10, networking in 11 and 12, a slow server in 13.
- Think you already know it all? Try the capstone incident first, and come back for whatever slows you down.
How every lab ends
Reading about a full disk isn't the same as fixing one. So every module ends with a Break it, fix it exercise. You run one command that breaks your lab VM the way real servers break. Then you get only the symptom a user would report. Three hints are folded underneath, to open one at a time if you get stuck:
- Where to look: the part of the system to check first.
- Which tool: the command that shows the cause.
- The cause and the fix: what went wrong, how to fix it, and how to stop it happening again.
Try to fix it before opening a hint. Being stuck for ten minutes and then finding the cause is how the skill actually forms.
All you need is a laptop. Module 01 sets up a free Ubuntu VM with Multipass that you can break, reset, and recreate in a minute. A small cloud VM, such as an EC2 instance running Ubuntu 24.04, works just as well. Stop it when you finish so it doesn't keep costing money.
Foundations
No Linux experience needed. Get comfortable on a server: move around, find things in logs, understand permissions, sign in securely, and install software the right way.
-
01
Start here →
Shell Survival: Your First Hour on a Linux Server
Set up a free lab VM, move around the filesystem, read files and logs, chain commands with pipes, and use exit codes to tell success from failure.
-
02
Read module →
Text Processing: grep, awk, sed, and Friends
Answer real questions from a web server log in one line: who's calling, what's failing, and when. Plus find, xargs, and jq.
-
03
Read module →
Files, Inodes & Permissions
Where things live on a Linux system, what a file really is, how read, write, and execute work on files and directories, and a shared team folder.
-
04
Read module →
Users, sudo & SSH
Users and groups, safe sudo rules, key-based SSH, a jump host, and changing the SSH server's settings without locking yourself out.
-
05
Read module →
Packages, Repositories & Where Software Lives
What a package is, apt and dnf side by side, adding a signed third-party repository, finding which package owns a file, and safe upgrades.
How Linux works
What the system is doing underneath the commands. Every troubleshooting skill in Part 3 depends on these, so read them in order.
-
06
Read module →
The Boot Process: From Power-On to Login
Firmware, GRUB, the kernel, initramfs, and systemd; reading boot history and timing; and catching a bad fstab line before a reboot.
-
07
Read module →
systemd: Services, Timers & Logs
Turn a script into a hardened service, change it with drop-in overrides, replace cron with a timer, and read logs with journalctl.
-
08
Read module →
Processes, Signals & File Descriptors
Process states including D and Z, stopping processes the right way, open files and their limits, and "Too many open files".
-
09
Read module →
Memory, the Page Cache & the OOM Killer
Reading free correctly, the page cache, swap, memory limits for services and containers, and finding an out-of-memory kill.
-
10
Read module →
Storage, Filesystems & LVM
Disks, filesystems, and mounts; finding what fills a disk; recovering a broken mount; growing an LVM volume live; and space held by deleted files.
-
11
Read module →
Networking Basics: Addresses, Routes, Ports & TCP
Addresses and routing, listening sockets, the TCP handshake and states, and telling "refused" from a timeout.
-
12
Read module →
DNS, Firewalls & Packet Capture
How a name becomes an address, dig versus getent, drop versus reject in nftables, and reading packets with tcpdump.
Troubleshooting
Turning knowledge into a method. How to go from a vague report to a root cause, see inside a process, and know something is wrong before users do.
-
13
Read module →
A Troubleshooting Method: From Symptom to Root Cause
Symptom, change, scope, evidence, hypothesis; the USE method for every resource; and a 60-second checklist that finds most problems.
-
14
Read module →
Seeing Inside a Process: strace, lsof & eBPF
System calls traced with strace, open files and connections with lsof, and safe whole-system tracing with eBPF tools.
-
15
Read module →
Logs, Log Rotation & Monitoring
Querying the journal, logrotate done right, shipping logs off the server, node_exporter metrics, and alerts worth having.
Linux for DevOps
The Linux layer that containers, automation, and cloud platforms are built on.
-
16
Read module →
Containers from Scratch: Namespaces, cgroups & Overlay Filesystems
Build a container by hand, then find the same namespaces, cgroup, and overlay filesystem inside a real Docker container.
-
17
Read module →
Security Hardening, AppArmor & TLS
A practical hardening checklist, auditd, reading AppArmor and SELinux denials, and checking certificates and time sync.
-
18
Read module →
Automation: Safe Bash, cloud-init & Ansible
Scripts that fail safely and run twice without harm, first-boot configuration with cloud-init, and an idempotent Ansible playbook.
-
19
Read module →
Performance & Kernel Tuning
Load testing against a baseline, the kernel settings that matter for busy servers and Kubernetes nodes, and cloud limits.
Capstone
Everything at once, the way real incidents happen.
Production Incident Reviews
Real incidents from a production platform on RHEL 8 servers in AWS, written up as blameless incident reviews: symptom, investigation, root cause, fix, and prevention. Every server name, path, account, and product name is replaced with a generic one, and nothing is added beyond what the engineering notes record. Each review links back to the modules that teach the skills it needed.
-
21
Read review →
Incident Review: SSH Worked by Hand but Failed for the Service
Four stacked faults in a job's own SSH library after a move to RHEL 8, fixed on the client without weakening the server.
-
22
Read review →
Incident Review: A Service Blocked by a Kernel Semaphore Limit
A start-up script that tried to change the kernel and was denied, and why kernel requirements belong in provisioning.
-
23
Read review →
Incident Review: PostgreSQL Locked Out of Its Own Config File
How
cp -pcopied the wrong owner on every start, and why the template had to be fixed as well as the file. -
24
Read review →
Incident Review: Two Faults Behind One Failed Daemon
A pooler pointing at the wrong environment and a non-root change that broke shared memory, at the same time.
-
25
Read review →
Incident Review: "trust" Authentication Failed, Through a Unix Socket
Two silent
psqldefaults, a Unix socket and the Linux user name, exposed by a database migration.
Where this track leads
Finished the capstone? The Kubernetes from Zero to Production on Amazon EKS track builds directly on Parts 2 to 4: pods are the processes and cgroups from Modules 08, 09, and 16, and cluster networking relies on the routing, DNS, and connection tracking from Modules 11, 12, and 19.