Card, PayPal or bank transfer · Morocco and worldwideتعلَّم · مارِس · أتقِن

Catalogue / DevOps

SRE and advanced troubleshooting: Linux performance, SLOs and incident management

Diagnose a slow or failing Linux server one resource at a time, trace processes down to the kernel, then drive reliability with SLOs, on-call, blameless postmortems and automation.

  • Intermediate to advanced
  • 12 lessons
  • 9 h 50 min

A MasterLinux course · Original text

What you will learn

  • Measure and cap toil, write an error budget policy and alert on burn rate
  • Apply the USE and RED methods and the first-60-seconds checklist to a slow server
  • Read load, steal time, cgroup throttling and a perf profile to find what is eating the CPU
  • Understand the page cache, swap, memory pressure (PSI) and the OOM killer's decisions
  • Measure disk latency with iostat, find the guilty process and choose the I/O scheduler
  • Diagnose the network with ss, nstat and sar - retransmissions, queues, CLOSE-WAIT, a full conntrack table
  • Trace a process with strace, ltrace and lsof, and discover eBPF with bpftrace
  • Tune kernel and process limits - ulimit, prlimit, fs.file-max, vm.max_map_count, TasksMax
  • Run an incident with clear roles, severity levels and controlled communication
  • Write blameless postmortems based on real public incidents, and turn runbooks into safe automation

Course content

12 lessons · 9 h 50 min
Section 1 — SRE culture2 lessons · 1 h 20 min
  1. The SRE job: toil, SLOs and error budget burn rate Preview40 min
  2. The USE and RED methods: the first 60 seconds of diagnosis 40 min
Section 2 — Linux performance4 lessons · 3 h
  1. CPU: load, steal time, cgroup throttling and profiling with perf 45 min
  2. Memory: page cache, swap, memory pressure and the OOM killer 45 min
  3. Disks: latency, queues, the guilty process and I/O schedulers 45 min
  4. Network: ss, retransmissions, listen queues and a full conntrack table 45 min
Section 3 — Tracing and the kernel2 lessons · 1 h 35 min
  1. Tracing a process: strace, ltrace, lsof, /proc and first steps with eBPF 50 min
  2. Kernel and process limits: ulimit, prlimit, fs.file-max, TasksMax and sysctl 45 min
Section 4 — Incidents and reliability4 lessons · 3 h 55 min
  1. On-call and incident management: severity, roles, communication and team health 45 min
  2. Blameless postmortems: contributing factors, useful actions and lessons from public incidents 50 min
  3. From runbooks to safe automation: dry run, lock, log and safeguards 50 min
  4. Final project: an end-to-end incident, from diagnosis to postmortem 1 h 30 min

Requirements

  • The “Fundamentals” course (included) or solid hands-on experience with the Linux command line
  • Able to administer a Debian, Ubuntu or Rocky server (packages, services, logs)
  • Recommended - the “Monitoring and observability” course (Prometheus, Grafana, alerts)

Who is this course for?

  • System administrators and operations engineers who want to become SREs
  • DevOps engineers who carry the pager and want to diagnose faster
  • Back-end developers who want to understand why their application is slow in production