Use fstab nofail and automount without masking a missing disk
Nofail changes boot dependency behavior and x-systemd.automount defers the real mount until access; neither proves the storage is healthy or present.
Set a service umask without assuming it repairs existing files
Umask removes permission bits during creation; it does not change existing objects and applications can request narrower modes afterward.
Mount a Linux disk by UUID without creating a boot failure
Filesystem UUIDs provide a stable identity across device-name changes, but the UUID must still match the intended filesystem and mount options.
mtr vs traceroute: interpret path evidence without blaming one hop
Traceroute samples TTL-limited replies while mtr repeats them; intermediate response loss does not prove forwarding loss when later hops and application traffic succeed.
Set MySQL binary log retention from recovery and replica needs
Binary logs support replication and point-in-time recovery; expiration must exceed the longest backup, restore, outage, and replica catch-up window.
Use MySQL EXPLAIN ANALYZE without surprising production
EXPLAIN ANALYZE executes the statement and reports iterator estimates, actual rows, loops, and timing, unlike a non-executing estimate-only EXPLAIN.
Choose MySQL KILL QUERY or KILL CONNECTION by transaction impact
KILL QUERY stops the current statement but keeps the session, while KILL CONNECTION terminates the session and rolls back its active transaction.
Create a MySQL least-privilege application account
MySQL combines authenticated account identity, host matching, dynamic and static privileges, roles, and object scope when authorizing a statement.
Plan MySQL online index creation around locks and rebuild cost
InnoDB DDL algorithms and lock clauses control whether data is rebuilt and which concurrent operations are allowed, but support depends on the exact alteration.
Trace active MySQL sessions without relying on a truncated process list
SHOW PROCESSLIST gives a current session view while Performance Schema tables expose richer statements, waits, threads, and history when enabled.
Measure MySQL replication lag using position and worker evidence
Replication delay can arise in receiving, relay logging, scheduling, applying, or waiting; one seconds-behind value cannot identify the stage.
Require encrypted MySQL transport without stranding clients
Require_secure_transport rejects insecure TCP connections while local socket behavior and certificate identity verification remain client-side and configuration-dependent.
Verify a MySQL restore with data and application invariants
A restore test proves that backup bytes can reconstruct a candidate database, but correctness also needs schema, row, constraint, routine, permission, and application checks.
Create a transactionally consistent mysqldump for InnoDB
Single-transaction establishes a consistent read for transactional tables while concurrent DDL and nontransactional engines require separate controls.
Back up and validate an nftables ruleset before firewall changes
Nft list ruleset emits the active rules in restorable syntax, but runtime-generated state and surrounding network dependencies still need separate evidence.
Set NGINX upload limits across every request layer
Client_max_body_size rejects oversized request bodies at NGINX, but application, framework, upstream proxy, and storage limits can reject at different sizes.
Understand NGINX location priority before adding another regex
NGINX first finds the longest prefix location and then evaluates regular expressions under documented rules, with exact and nested matches changing the search path.
Enable NGINX proxy cache only for responses with a safe identity key
Proxy_cache stores eligible upstream responses under a cache key; method, host, URI, arguments, authorization, cookies, and vary behavior determine whether two requests may share content.
Set NGINX proxy timeouts from phase-specific latency evidence
Proxy_connect_timeout covers upstream connection establishment while proxy_send_timeout and proxy_read_timeout apply between successive I/O operations, not one universal request deadline.
Add NGINX rate limiting without punishing every user behind one proxy
Limit_req tracks request rate by a chosen key in shared memory and applies burst and delay behavior; the key determines who shares a bucket.
Configure NGINX real client IP without trusting spoofed headers
The real IP module replaces the peer address only when the connection came from a trusted proxy range and the configured header contains the expected chain.
Log NGINX request and upstream timing without high-cardinality chaos
$request_time measures the full request while upstream timing variables expose connection, header, and response phases for one or more upstream attempts.
Test and reload NGINX without replacing healthy workers blindly
Nginx -t parses the complete active configuration, and a reload asks the master to start new workers before gracefully retiring the old generation.
Proxy WebSockets through NGINX with explicit upgrade handling
WebSocket upgrade is hop-by-hop, so NGINX must pass Upgrade and an appropriate Connection value while preserving long-lived connection behavior.