OS-level issues on Linux, macOS, Windows; drivers, permissions, shells.
When a server is slow and the dashboard is vague, a dozen standard commands narrow the problem to CPU, memory, disk, network or a single process in about five minutes. This is the order we run them in and how we read each output.
Our nightly report export ran perfectly when we typed it, and failed every night as a systemd service with node: command not found. Services get no login shell, no .bashrc and a working directory of /. Here is how we made the unit self-contained.
A worker image built fine but every container exited at once with "no such file or directory" for a file that clearly existed. A Windows checkout had turned the shebang into /bin/bash with a carriage return. We fixed it with .gitattributes and a CI check.
Every engineer who downloaded our internal deploy helper got a "damaged" dialog. The app was fine; a CI step modified the bundle after signing and Gatekeeper checked the quarantined copy. We now sign, notarize and staple in the right order.
Our thumbnail service hit Errno 24 at about 1,000 concurrent connections even though ulimit -n showed 65535. systemd services never read limits.conf. We set LimitNOFILE in a drop-in and fixed a client leak that was eating descriptors.
Our single-host production server stopped accepting writes at 03:12 with no space left on device. Docker had quietly filled the disk with a 31 GB container log, old images and build cache. Here is how we found each piece and stopped it from coming back.
A practitioner's summary of CrowdStrike's official root cause analysis for the July 19, 2024 Windows crashes: a 21-field template read with 20 inputs, an out-of-bounds read in a kernel driver, and fleets stuck in boot loops. What the RCA says, and what we changed in our own releases.