Log Triage: Why Does the Service Keep Crashing?
MediumRHCSA Prep15-25 minThe payments service keeps crashing (flapping). Its log and the system log were exported to /root/case/logs/. Triage them read-only and record three findings — this is log analysis, the counterpart to setting up the logging pipeline.
(1) The TCP port payments can't bind (every start fails with the same error) → /root/case/answers/port.txt.
(2) The process actually holding that port — the real cause. Correlate by the port in the system log, not by whichever daemon is noisiest → /root/case/answers/holder.txt.
(3) The timestamp of the first failure — the leading timestamp of the first FATAL line in payments.log, copied exactly as it appears there → /root/case/answers/first_fail.txt.
The busiest process in syslog is a red herring on a different port. See /root/case/brief.txt.
- Read logs to find the concrete failure (error, port) behind a flapping service
- Correlate across two logs by a shared identifier (the port), not by noise
- Pin the start of an incident from its first log entry
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.