Incident Triage Capstone: Diagnose a Degraded Host from Its Artifacts

A production host is degraded and you've been handed its evidence bundle in /root/case/ — a kernel log, df and ss snapshots, an HTTP access log, a slow-query log, and a journal excerpt. Diagnose the six problems and record your findings in /root/findings.env, one KEY=VALUE per line (no spaces, no quotes). Every artifact contains a decoy that points at the wrong conclusion — read carefully.

| Key | Determine (from /root/case) |

|-----|------|

| OOM_PROC | the process the kernel actually killed (not the one that invoked the killer) |

| FULL_FS | the mount point of the filesystem that is 100% full |

| HTTP_ERR | the single 5xx status code that dominates the errors |

| API_PORT | the TCP port the api service is listening on |

| SLOW_TABLE | the table named in the most slow queries |

| FLAP_UNIT | the systemd unit that restarted the most |

Grading compares each recorded value exactly.