Troubleshooting
Method first
Work in order: gather symptoms, form a theory, test it, change one variable at a time, verify, document. Exam questions reward the diagnostic step, not a lucky guess.
Boot and services
Kernel messages: dmesg or journalctl -k. Boot logs: journalctl -b (or -b -1 for the previous boot), -p err to filter. For a service that will not start, use systemctl status for the error code, then journalctl -u name, then check config, permissions, and ports. status=203/EXEC means ExecStart points at a missing or non-executable file; address already in use means a port conflict - locate it with ss -tulpn.
Storage
df -h shows space; df -i shows inodes - a filesystem can be "full" with free space if inodes are exhausted. If df and du disagree, a deleted file still held open by a process is the likely cause; find it with lsof +L1. Unexpected read-only remounts often mean filesystem corruption; fsck it offline.
Network and DNS
Work up the stack: ip a for link and address, ip r for routes, ping the gateway, then DNS with dig or getent. ss -tulpn lists listening sockets - a service bound to 127.0.0.1 is unreachable remotely. Check firewall rules before blaming the application. /etc/resolv.conf and /etc/nsswitch.conf determine name resolution order.
Resources and security
free -h, vmstat, iostat, and top cover CPU, memory, and IO; the OOM killer leaves journal traces. strace shows failing syscalls. SELinux denials appear in the audit log, not in the application error.
Traps: a successful ping does not prove the service works (ICMP ≠ TCP port). Editing /etc/resolv.conf by hand may be overwritten by NetworkManager.
Rule of thumb: read the actual error message and its timestamp before changing anything.