Plainnoteshttps://www.ysllsyysl.online/notes on networks and systemsOut of inodes while the disk is half emptyhttps://www.ysllsyysl.online/en/posts/2026-11-05-inode-full.htmlhttps://www.ysllsyysl.online/en/posts/2026-11-05-inode-full.htmldf -h says there is space; touch says No space left on device.A restart loop hides the error that caused ithttps://www.ysllsyysl.online/en/posts/2026-11-02-restart-loop.htmlhttps://www.ysllsyysl.online/en/posts/2026-11-02-restart-loop.htmlRestart policies turn one failed start into an infinite loop and flush the logs.An incomplete certificate chain that browsers hidehttps://www.ysllsyysl.online/en/posts/2026-10-29-cert-chain.htmlhttps://www.ysllsyysl.online/en/posts/2026-10-29-cert-chain.htmlBrowsers fetch missing intermediates; curl and many clients do not.Who killed the process: reading the OOM loghttps://www.ysllsyysl.online/en/posts/2026-10-26-oom-killer.htmlhttps://www.ysllsyysl.online/en/posts/2026-10-26-oom-killer.htmlNo core, no exception — the kernel log has the answer.Container logs filling the diskhttps://www.ysllsyysl.online/en/posts/2026-10-20-docker-log.htmlhttps://www.ysllsyysl.online/en/posts/2026-10-20-docker-log.htmlThe default json-file driver does not rotate; one chatty container can eat the partition.What to check in the first minute of a 502https://www.ysllsyysl.online/en/posts/2026-10-15-nginx-502.htmlhttps://www.ysllsyysl.online/en/posts/2026-10-15-nginx-502.htmlSeparate nobody-listening from timeout from an upstream that died mid-request.Eight hours off inside a containerhttps://www.ysllsyysl.online/en/posts/2026-10-09-tz-container.htmlhttps://www.ysllsyysl.online/en/posts/2026-10-09-tz-container.htmlNo tzdata in the image, so TZ points at a file that does not exist.Packet capture beats ping for finding slownesshttps://www.ysllsyysl.online/en/posts/2026-10-02-tcp-retrans.htmlhttps://www.ysllsyysl.online/en/posts/2026-10-02-tcp-retrans.htmlA clean ping says nothing about retransmissions, and retransmissions are what hurt.Long connections cut by something in the middlehttps://www.ysllsyysl.online/en/posts/2026-09-26-keepalive.htmlhttps://www.ysllsyysl.online/en/posts/2026-09-26-keepalive.htmlNAT entries expire in five minutes; keepalive was set to ten.Slow DNS is often not DNShttps://www.ysllsyysl.online/en/posts/2026-09-19-slow-dns.htmlhttps://www.ysllsyysl.online/en/posts/2026-09-19-slow-dns.htmlSeparate lookup time from connect time before blaming the resolver.Why some clients got slower after enabling HTTP/2https://www.ysllsyysl.online/en/posts/2026-09-12-nginx-http2.htmlhttps://www.ysllsyysl.online/en/posts/2026-09-12-nginx-http2.htmlOn a six-request static site, h2 has little to give. Packet loss and a missing session cache were the real problems.Too many open files: find the leak before raising the limithttps://www.ysllsyysl.online/en/posts/2026-09-05-too-many-files.htmlhttps://www.ysllsyysl.online/en/posts/2026-09-05-too-many-files.htmlRaising nofile buys time; it does not close the descriptor nobody closed.Logs that never rotate: two usual causeshttps://www.ysllsyysl.online/en/posts/2026-08-29-logrotate.htmlhttps://www.ysllsyysl.online/en/posts/2026-08-29-logrotate.htmlThe config is never read, or the process keeps writing to the old inode.Cron runs your script with a different environmenthttps://www.ysllsyysl.online/en/posts/2026-08-22-cron-env.htmlhttps://www.ysllsyysl.online/en/posts/2026-08-22-cron-env.htmlThree entries in PATH, no profile, no LANG — and that is by design.When the filesystem goes read-onlyhttps://www.ysllsyysl.online/en/posts/2026-08-15-disk-readonly.htmlhttps://www.ysllsyysl.online/en/posts/2026-08-15-disk-readonly.htmlAfter an I/O error the kernel remounts ext4 read-only to stop the damage spreading.SSH takes ten seconds to reach a prompthttps://www.ysllsyysl.online/en/posts/2026-08-08-ssh-slow.htmlhttps://www.ysllsyysl.online/en/posts/2026-08-08-ssh-slow.htmlUsually a reverse DNS lookup timing out, or GSSAPI looking for something absent.Two surprises after moving from cron to systemd timershttps://www.ysllsyysl.online/en/posts/2026-08-03-systemd-timer.htmlhttps://www.ysllsyysl.online/en/posts/2026-08-03-systemd-timer.htmlPersistent catch-up does not behave like a missed cron job, and a stale timer keeps running without a reload.Lots of TIME_WAIT: usually not a problemhttps://www.ysllsyysl.online/en/posts/2026-07-28-timewait.htmlhttps://www.ysllsyysl.online/en/posts/2026-07-28-timewait.htmlIt is the normal state of the side that closed first. Only port exhaustion matters.High load, idle CPUhttps://www.ysllsyysl.online/en/posts/2026-07-21-load-high.htmlhttps://www.ysllsyysl.online/en/posts/2026-07-21-load-high.htmlLoad counts uninterruptible sleep too, so blocked I/O shows up as load.Port in use, but no process in sighthttps://www.ysllsyysl.online/en/posts/2026-07-15-port-in-use.htmlhttps://www.ysllsyysl.online/en/posts/2026-07-15-port-in-use.htmlWrong namespace, TIME_WAIT without SO_REUSEADDR, or the kernel using it as an ephemeral port.