High I/O wait: find the disk queue behind the slowdown
Correlate device latency and queue depth with the process issuing I/O; CPU graphs alone make this incident look mysterious.
Load balancer says unhealthy while the app looks fine
Validate bind address, path, host header, protocol, status code, timeout, and firewall from the load balancer's perspective.
No space left on device: disk blocks, inodes, and deleted files
During failed writes despite confusing disk reports, the first danger is the outage.
The OOM killer terminated your app: what to inspect next
Identify the killed cgroup, memory growth, limits, and swap behavior before merely restarting with more RAM.
Address already in use: find the owner without killing the wrong service
Identify process ownership and supervisor state; random kill -9 commands often create duplicate restart loops.
Postgres lock incident: find the blocker, not just the blocked
Trace the blocking transaction and its owner; terminating every waiting query treats victims as the cause.
Redis latency incident: slow commands, forks, and network stalls
Distinguish command complexity, blocked clients, persistence forks, swapping, and network latency before flushing anything.
Locked out of SSH: recovery paths before desperation
Use the provider console to distinguish firewall, daemon, disk, user, and key failures; restore a narrow safe path before hardening again.
Build an incident timeline from logs, metrics, traces, and changes
The search intent behind this problem is converting conflicting signals into an ordered explanation.
Expired TLS certificate incident: restore trust without creating a second outage
Confirm which terminator serves the certificate, renew there, reload safely, and validate the full chain from outside.
Website down: the first 15 minutes of production triage
Prove DNS, TLS, routing, proxy, application, and database layers in that order before changing anything.
IPv6 works but IPv4 fails—or the reverse
The search intent behind this problem is testing address families as separate production paths.
journalctl for incidents: filters that cut through the noise
Start with unit, boot, severity, and time boundaries; export the relevant window before rotation removes it.
Kubernetes ConfigMap changed but the pod did not: why
The search intent behind this problem is understanding environment, volume, and application reload behavior.
Kubernetes CrashLoopBackOff: debug the exit before changing the manifest
When finding why a container repeatedly starts and exits, speed comes from ordering the investigation—not from typing more commands.
Kubernetes DNS debugging without restarting CoreDNS first
The search intent behind this problem is isolating pod DNS, service discovery, upstream resolution, and policy.
Kubernetes HPA not scaling: metrics, requests, and stabilization
The search intent behind this problem is diagnosing an autoscaler that ignores visible load.
ImagePullBackOff: fix registry, tag, and credential failures safely
The search intent behind this problem is diagnosing why a Kubernetes node cannot retrieve an image.
Kubernetes Ingress 502 errors: trace ingress to pod
The search intent behind this problem is finding where an ingress-to-service-to-pod request fails.
Kubernetes Job keeps failing: retries, exit codes, and idempotency
The search intent behind this problem is debugging batch work without duplicating side effects.
kubectl logs --previous: the command that explains vanished crashes
The search intent behind this problem is retrieving evidence from the last terminated container.
Kubernetes NetworkPolicy debugging: prove which flow is denied
The search intent behind this problem is isolating ingress, egress, namespace selectors, and DNS.
Kubernetes Node NotReady: kubelet, runtime, network, or pressure?
The search intent behind this problem is determining why the control plane stopped trusting a worker.
Kubernetes OOMKilled: limit breach or node memory pressure?
The search intent behind this problem is distinguishing a container memory-limit kill from host-wide pressure.