An LVM snapshot is neither a copy nor a reflink: it is a fixed-size copy-on-write exception store attached to an origin logical volume. lvcreate -s -L 5G -n snap vg/data allocates 5 GiB from the volume group, and the device-mapper snapshot target records the original contents of each origin chunk the first time it is written. Creation is instant whatever the origin’s size, because nothing is copied. ...
A listening TCP socket has two queues, not one, and the sysctl this article is named after governs the queue that almost never drops anything. The backlog passed to listen(2) is the accept queue, holding connections that finished the handshake and await the application; the SYN queue holds half-open requests. Confusing them produces the wrong fix. ...
A disk that spikes with no obvious writer is hard to chase; iotop maps throughput straight back to the task doing the damage. System-wide tools show the symptom — high await, saturated utilization — but never the suspect: fifty processes share the disk and the average blames all of them equally. The question that ends the investigation is always per-process — who, how much, since when — and iotop answers exactly that, live, from kernel counters no application can hide from. ...
A Linux network namespace separates networking resources such as interfaces, routes, neighbor tables, socket ports, and packet-filter rules. It shares the kernel with other namespaces; it is not a separate operating system. A process normally inherits its parent’s network namespace, and tools can execute a process in another one. The resulting isolation covers networking resources, not every aspect of process identity or filesystem access. ...
Strace observes system calls and signals at the boundary between a selected Linux process and the kernel. It can reveal attempted paths, arguments, return values, and errors without rebuilding the program. That evidence is useful when application logs omit an operation, but it does not expose every user-space decision or automatically identify which failed call caused the application’s final outcome. ...
Cron accepts schedules from more than one kind of table. A user crontab belongs to one account, while system tables can name the account for each entry. Copying a line between them without adjusting its fields changes what cron interprets as the command. Identify the table format before debugging an apparently correct five-field calendar expression. ...
A shell variable holds a string, but an unquoted expansion can turn that string into several command arguments. In Bash, word splitting examines expansion results using IFS as the delimiter set. This is why a pathname that works when typed with quotes can fail after being stored in a variable. Debug the arguments the receiving command actually gets, including empty ones, before blaming the filesystem. ...
Databases and high-throughput servers often win, but they pay by needing contiguous memory and a pool sized in advance, so the trade is architectural, not free. Why 4 KB hurts On most architectures a standard page is 4 KiB, and the TLB can hold only a limited number of translations. A database or high-throughput server that touches gigabytes typically walks a working set of millions of pages, so it keeps missing the TLB, the hardware then has to walk the page table to find each mapping. The cost is not the page itself but the constant page-table walks, and at million-page working sets the misses outrun how fast the TLB can be refilled. Bigger pages mean each entry covers more memory, so the same working set needs far fewer entries, which is exactly the relief a memory-heavy workload feels. ...