Open file triage
Map open sockets and processes to services.
Understand the pattern
Junior operators build confidence by gathering evidence before changing systems.
lsof- Inspect a synthetic association between processes and open files or sockets.
Combine process and socket evidence rather than assuming a service from its port number.
pgrep- Find simulated process IDs by a name pattern.
Verify a process identity before sending a signal.
systemctl- Inspect or change a simulated systemd service. Status, active state, and unit configuration reveal different evidence.
A service can be active while an application endpoint is unhealthy; verify both layers.
Worked example and expected result
$ lsof -iCOMMAND PID USER FD TYPE NAME nginx 42 www 6u IPv4 *:80 (LISTEN) nginx 42 www 7u IPv4 *:443 (LISTEN) sshd 77 root 3u IPv4 *:22 (LISTEN)
Exit status: 0. The command completed successfully in the training fixture.
$ pgrep nginx42
Exit status: 0. The command completed successfully in the training fixture.
$ systemctl status nginxnginx.service - simulated nginx Loaded: loaded Active: active Notes: serving the simulated static learn site
Exit status: 0. The command completed successfully in the training fixture.
Explain it
Apply it elsewhere
Keep the momentum.
Complete the lab, then explain and apply the pattern.
Next: Backup service noteTry an incident drillAnonymous lesson and mastery progress lasts for this session. Sign in to keep synced lesson XP between sessions; mastery stays device-local. No speed bonus, lost lives, or hint penalties.