Q: A service has stopped responding. Walk me through your troubleshooting. "Start at the process level. systemctl status to see if it's running. If running, ss -tlnp to confirm it's listening on the expected port. Curl localhost to test the loopback path. If that works, then test from another box to rule out networking. If the local curl fails, journalctl -u for service logs and dmesg for any kernel messages. Then check the system: disk space with df, inodes with df -i, memory with free, recent CPU spikes with top or sar. Finally, network: firewall rules, DNS resolution, any security group changes. The goal is to narrow down which layer is broken — app, host, network — before deep-diving."
Q: How would you find what's filling up the disk? "df -h to see which filesystem is full. Then du -sh /* on the filesystem root, sorted, to find which top-level directory is the culprit. Recurse into that with du again until I find the source. Log files in /var/log are a common one — uncompressed, no rotation. Also worth checking df -i for inode exhaustion separately, because many small files can break writes before disk space runs out."