Best SSH client for Mac: what actually matters in 2026
Judge key storage, host organization, SFTP, terminal quality, auditability, and whether AI actions are isolated from the terminal.
Certbot renewal failed: diagnose it before the certificate expires
Test the stored renewal configuration, port reachability, DNS, and webroot instead of issuing a fresh certificate repeatedly.
Cron job not running? Check environment, path, and mail
Check environment, path, and mail is easier when you treat it as an evidence problem instead of a command-memory test.
Docker Compose in production: where the simple story ends
Compose can be production-worthy on one host when backups, health checks, resource limits, secrets, and rollback are explicit.
Docker container stuck restarting: read the real failure
Disable guesswork: capture exit code, logs, mounts, environment, and health-check state before replacing the container.
Docker is eating the disk: inspect before you prune
Prune stopped containers and dangling images deliberately; volumes and database layers require separate ownership checks.
journalctl for incidents: filters that cut through the noise
Start with unit, boot, severity, and time boundaries; export the relevant window before rotation removes it.
Linux CPU at 100%: identify process, thread, and cause
Separate demand, busy loops, lock contention, steal time, and runaway children before restarting the loudest process.
Linux memory pressure: free, cache, swap, and OOM explained
Low free memory is normal when cache is reclaimable; sustained swap-in, OOM kills, and rising anonymous RSS are the stronger signals.
Linux load average is not CPU usage
Pair it with CPU, I/O latency, and D-state processes before concluding the box needs more cores.
Too many open files: find the leak before raising limits
Determine whether descriptors are sockets, files, pipes, or duplicate handles; a larger ceiling only lengthens the leak's fuse.
Nginx 502 Bad Gateway: find the broken hop
A 502 usually means nginx is alive and the upstream is not reachable; prove socket, port, protocol, and health independently.
Fix an nginx HTTPS redirect loop without disabling TLS
Trace who terminates TLS and what scheme the application believes; do not stack unconditional redirects at every layer.
Postgres filled the disk: protect the database before cleanup
Find replication slots, archives, logs, table growth, and available recovery space first.
A practical Postgres slow-query investigation
Measure waits and plans before adding indexes; a fast-looking index can make writes worse and still miss the actual predicate.
Postgres too many connections: stop raising max_connections
Identify pool ownership, leaked idle sessions, and concurrency spikes before increasing a setting that consumes memory per backend.
Redis maxmemory reached: eviction, leaks, and dangerous fixes
Know whether Redis is a cache or a durable queue before enabling eviction; the same policy can be safe for one and data loss for the other.
How to rotate SSH keys without locking out the team
Add and test the new key before removing the old one, and keep an independent recovery path open.
Rsync to production without deleting the wrong files
Always dry-run destructive synchronization and keep source and destination trailing slashes intentional.
SFTP vs SCP vs rsync: choose the right file-transfer tool
Use SFTP for browsing, SCP for simple copies, and rsync for repeatable trees and resumable synchronization.
ssh-agent explained: identities, forwarding, and the footguns
Use time-limited identities and avoid agent forwarding to hosts you do not fully trust.
SSH config file guide: aliases, jump hosts, keys, and safe defaults
Start with aliases and explicit identities, then add jump hosts and keep broad wildcard rules conservative.
SSH connection refused: a layer-by-layer diagnosis
The task is separating DNS, routing, firewall, and daemon failures.
SSH jump hosts without copying private keys to the bastion
ProxyJump keeps authentication on the client and avoids turning the bastion into a key warehouse.