https://joshuarosato.com/notes/ Short notes and things learned along the way. en-gb Fri, 02 Oct 2026 00:00:00 GMT https://joshuarosato.com/notes/grep-bracket-trick/ https://joshuarosato.com/notes/grep-bracket-trick/ ps aux | grep nginx always lists the grep nginx process too, which is why | grep -v grep is so common. Wrap one character of the pattern in brackets instead: The regex [n]ginx still matches nginx, but grep's own command line now contains… Fri, 02 Oct 2026 00:00:00 GMT linuxbash https://joshuarosato.com/notes/ldd-runs-the-binary/ https://joshuarosato.com/notes/ldd-runs-the-binary/ ldd is not a parser. It is a shell script that asks the dynamic loader to trace itself — normally by running the loader with --list, and in some versions and some situations by setting LD_TRACE_LOADED_OBJECTS=1 and executing the file… Fri, 02 Oct 2026 00:00:00 GMT linuxsecuritydebugging https://joshuarosato.com/notes/memory-high-vs-memory-max/ https://joshuarosato.com/notes/memory-high-vs-memory-max/ A container that runs out of memory did not run out of machine memory — it hit a limit recorded under /sys/fs/cgroup, which is why free -h inside the container shows the host's total and tells you nothing. The cgroup files are the only… Thu, 01 Oct 2026 00:00:00 GMT linuxsystemdperformancecontainers https://joshuarosato.com/notes/core-dumps-free-until-needed/ https://joshuarosato.com/notes/core-dumps-free-until-needed/ The kernel refuses to write core dumps by default (RLIMIT_CORE starts at 0), which is why production crashes usually leave nothing behind. systemd raises that limit for everything it starts and registers itself as the kernel's… Wed, 30 Sep 2026 00:00:00 GMT linuxsystemddebugging https://joshuarosato.com/notes/pkexec-privileged-ai-agents/ https://joshuarosato.com/notes/pkexec-privileged-ai-agents/ AI coding agents usually run unprivileged and stall when they need root — installing a package, writing under /etc, restarting a service. Instead of running the whole agent as root, tell it to escalate per command with pkexec: pkexec goes… Wed, 30 Sep 2026 00:00:00 GMT linuxaisecurity https://joshuarosato.com/notes/tcp-port-find-kill-process/ https://joshuarosato.com/notes/tcp-port-find-kill-process/ When a port is already in use, find who owns it before reaching for a reboot: ss -ltnp shows the PID in the users:(...) column (use sudo to see other users' processes); lsof -i :8080 lists the open sockets; fuser 8080/tcp prints just the… Wed, 30 Sep 2026 00:00:00 GMT linuxnetworkingdebugging https://joshuarosato.com/notes/perf-counts-and-samples/ https://joshuarosato.com/notes/perf-counts-and-samples/ perf has two modes and they answer different questions. Decide which one you are asking before you collect anything. Count when the question is how much: cycles, instructions, cache misses, context switches, page faults over a window long… Sun, 27 Sep 2026 00:00:00 GMT linuxperformanceobservabilitydebugging https://joshuarosato.com/notes/deleted-files-still-using-disk/ https://joshuarosato.com/notes/deleted-files-still-using-disk/ When df says a filesystem is full but du can't find the space, a process is usually holding a deleted file open. The blocks aren't freed until the last file descriptor closes. +L1 lists open files with a link count below one, which means… Fri, 25 Sep 2026 00:00:00 GMT linuxdebugging https://joshuarosato.com/notes/verify-installed-files/ https://joshuarosato.com/notes/verify-installed-files/ Every package manager already stores checksums for the files it installed, which turns "has anything been modified since installation?" into one command instead of a filesystem-wide hunt: All three speak the same output dialect: a field of… Tue, 22 Sep 2026 00:00:00 GMT linuxsecurity https://joshuarosato.com/notes/monotonic-vs-realtime-clocks/ https://joshuarosato.com/notes/monotonic-vs-realtime-clocks/ Linux has several clocks, and mixing them up is a reliable way to ship a bug that only appears in production. CLOCK_REALTIME is the wall clock: NTP, settimeofday and leap seconds move it forwards or backwards. CLOCK_MONOTONIC counts from… Fri, 18 Sep 2026 00:00:00 GMT linuxdebugging https://joshuarosato.com/notes/systemd-analyze-critical-chain/ https://joshuarosato.com/notes/systemd-analyze-critical-chain/ systemd-analyze blame sorts units by how long they took to start, but units start in parallel, so the slowest one often isn't what delayed boot. This shows the chain of units that actually gated default.target. The time after @ is when a… Mon, 14 Sep 2026 00:00:00 GMT systemdperformance https://joshuarosato.com/notes/bash-quote-expansion/ https://joshuarosato.com/notes/bash-quote-expansion/ Bash 4.4 added the @Q parameter transformation, which quotes a value so it can be pasted back into a shell unchanged: Handy in logs: echo "running: ${cmd[*]@Q}" shows exactly which arguments a command received. Thu, 03 Sep 2026 00:00:00 GMT bash