Skip to content
Clairos Learn

Troubleshooting · Lesson 21 of 26 · 8 minutes

Incident resource spike

Build a resource snapshot before blaming a process.

Mastery 0/3Run itExplain itApply it
learner@clairosSimulated Linux lab
learner@clairos:~ $
↑ history · Tab complete · Ctrl+C cancel · Esc, Tab to leaveExit 0

Understand the pattern

Junior operators build confidence by gathering evidence before changing systems.

uptime
Read simulated runtime and load information.

Load average is not a direct CPU percentage.

top
Inspect a single training snapshot of process and resource activity.

This lab does not run a continuously refreshing process monitor.

free
Inspect simulated memory totals and availability.

Allocated, cached, available, and free memory are not interchangeable measures.

Worked example and expected result
$ uptime
 10:26:04 up 12 days,  4:18,  1 learner,  load average: 0.04, 0.03, 0.01

Exit status: 0. The command completed successfully in the training fixture.

$ top
top - 10:26:04 up 12 days, 1 learner, load average: 0.04, 0.03, 0.01
PID USER      %CPU %MEM COMMAND
42  www-data   0.2  1.1 nginx
77  root       0.1  0.8 sshd
126 root       0.0  0.3 cron

Exit status: 0. The command completed successfully in the training fixture.

$ free -h
               total        used        free      shared  buff/cache   available
Mem:           3.8Gi       820Mi       2.1Gi        18Mi       900Mi       2.8Gi
Swap:             0B          0B          0B

Exit status: 0. The command completed successfully in the training fixture.

Try a variation

Repeat this workflow in the sandbox with a different scratch filename. Keep the system fixtures unchanged and compare the observed output with your expectation before moving on.

Explain it

In “Incident resource spike”, which interpretation is safe?

Apply it elsewhere

Before adapting the top workflow from “Incident resource spike” to another server, what should you do?

Keep the momentum.

Complete the lab, then explain and apply the pattern.

Next: Incident rollback evidenceTry an incident drill

Anonymous lesson and mastery progress lasts for this session. Sign in to keep synced lesson XP between sessions; mastery stays device-local. No speed bonus, lost lives, or hint penalties.

Keep learning

  1. 01Incident nginx config mismatchCompare active config and expected config examples.Practice
  2. 02Incident rollback evidenceCapture rollback evidence before writing a note.Practice
  3. 03Incident evidence bundleCollect service, log, and network evidence in one drill.Practice