Use openssl s_client to test SNI, chain, and protocol explicitly
Openssl s_client opens a TLS connection and prints handshake evidence, but verification requires the correct hostname, trust store, return code, and application protocol context.
Configure pam_faillock without locking out every administrator
Pam_faillock records failed authentication events and PAM stack placement determines preauth, authfail, account enforcement, reset, and local-user behavior.
Run pg_dump in production with consistency, load, and restore proof
Pg_dump takes a consistent database snapshot without blocking ordinary readers and writers, but it adds read load and does not include cluster-wide roles or physical recovery state.
Read pg_stat_activity without confusing idle sessions with blockers
Pg_stat_activity exposes one row per server process with transaction, query, wait, and client state; state and wait_event must be interpreted together.
Use pg_stat_statements to rank cumulative PostgreSQL query cost
Pg_stat_statements groups normalized statements and accumulates planning and execution statistics; totals reflect the collection window, not one trace.
Run PostgreSQL ANALYZE when estimates are wrong, not as a ritual
ANALYZE samples table data and updates planner statistics; column distribution, correlation, and statistics targets shape estimates without changing query semantics.
pg_cancel_backend vs pg_terminate_backend: choose the smaller interruption
Pg_cancel_backend requests cancellation of the current query while preserving the session; pg_terminate_backend ends the session and rolls back its open transaction.
Choose PostgreSQL sslmode without disabling identity verification
Sslmode controls whether libpq attempts encryption and whether it validates the server certificate chain and hostname; require does not provide the same identity check as verify-full.
Run EXPLAIN ANALYZE in production without surprising writes or load
EXPLAIN shows the planner estimate, while ANALYZE executes the statement and records actual timing and row counts; executing a write statement still writes unless contained and rolled back.
Build a PostgreSQL lock tree from blockers to waiting sessions
Pg_locks shows held and awaited lockable objects while pg_blocking_pids connects a waiting backend to direct blockers, including parallel-query relationships.
Monitor PostgreSQL replication slots before WAL fills the disk
A replication slot retains WAL or row-change information until its consumer confirms progress; inactive or lagging slots can therefore pin storage indefinitely.
Choose a Prometheus alert for duration from failure tolerance
The for clause keeps a continuously true alert pending before firing; keep_firing_for can retain firing state briefly after the expression clears.
Use Prometheus blackbox exporter to test the user-visible path
The blackbox exporter probes a target from the exporter's network and exposes probe metrics; relabeling passes the target while the exporter itself remains the scrape endpoint.
Set a Prometheus cardinality budget before adding labels
Cardinality is the number of distinct active label sets; multiplying unbounded dimensions increases memory, storage, query, and remote-write cost.
Calculate latency with histogram_quantile without averaging percentiles
Histogram_quantile estimates a quantile from histogram buckets; classic buckets must be aggregated with le preserved, while native histograms use histogram samples directly.
Use Prometheus recording rules for stable, expensive shared queries
Recording rules evaluate expressions on a schedule and store results as new series, reducing repeated dashboard cost while adding lag, storage, and naming responsibility.
Test Prometheus alerting rules with promtool before loading them
Promtool unit tests define synthetic input series and expected alerts or expressions over evaluation times, making edge cases reviewable without touching production.
Handle Prometheus missing metrics without converting absence into zero
Prometheus marks vanished series stale after scrape or discovery changes, and many expressions return no vector rather than numeric zero when a label set is absent.
Debug Prometheus target relabeling before samples disappear
Relabel_configs transforms discovered target labels before scraping, while metric_relabel_configs changes samples after scrape and before ingestion.
PromQL rate vs irate: choose by alerting and graph resolution
Rate estimates average per-second counter increase across a range and handles resets, while irate uses the last two samples and is more sensitive to short-term variation.
Create a Redis ACL user with command and key restrictions
Redis ACL rules combine authentication, command categories, key patterns, channel patterns, and enabled state for each user.
Choose a Redis AOF fsync policy from the actual loss budget
AOF records write commands and appendfsync controls how Redis requests durability, trading write latency against the amount of acknowledged data at risk.
Set Redis client output-buffer limits without disconnect storms
Redis tracks pending output per client class and disconnects a client when configured hard or sustained soft limits are exceeded.
Interpret Redis LATENCY DOCTOR with operating-system evidence
The latency monitor samples configured event classes inside Redis, while LATENCY DOCTOR summarizes detected spikes and suggested causes.