Every shell-scripting tutorial recommends find ... -exec cmd {} \; for “do this command on every matching file.” It’s the classic, obvious pattern. It’s also dramatically slower than the alternatives once your file count goes past a few hundred — …
The first time I set up a cron job with MAILTO=me@example.com, I assumed it would just work. It didn’t. The output ended up in /var/spool/mail/root, which I never checked, because my Oracle box couldn’t deliver outbound email — …
You have a private server in a VPC that’s only reachable through a bastion host. The “obvious” way to SSH there is the wrong way: copy your private key onto the bastion, then SSH from bastion to the private box. …
I joined a new client’s box one morning to set up SSO via SSSD. By the afternoon, no one — including me, including root — could SSH in. The PAM stack had been rearranged subtly in /etc/pam.d/common-auth, and a …
I once had a cron job that was supposed to send a “good morning” digest at 7 AM. It went out at 12:30 AM for two weeks before anyone complained. The server was in UTC. The cron line said 0 …
Open VS Code on a large monorepo and three or four tabs in. Save a file. Save another. Watch the file save spinner stick around for half a second longer than it should. Open the integrated terminal and type git …
journald has three different ways to cap disk usage. They overlap. They interact. The man page lists all of them with equal weight, which makes it tempting to set all three at once and assume the strictest one wins. That’s …
Last quarter I had a long-running bash daemon that needed to start as root (to bind a privileged port and read a key file in /etc) and then immediately drop to an unprivileged user before doing anything else. The …
Last spring I was cleaning out an old VPS and found three crontab entries pointing at scripts that didn’t exist anymore. Two had been deleted during a refactor in 2022; one was a project I’d rm -rf‘d a year …
Open /var/log/auth.log on a public-facing server and you’ll see thousands of lines per day — failed logins, accepted logins, sudo events, cron registrations. The signal you usually care about (who’s brute-forcing me, from where, against which users?) is buried in …