This sheet is designed for the first few minutes of an incident. Capture output before making disruptive changes.
System state
date
uptime
who
systemctl --failed
CPU and memory
vmstat 1 5
free -h
ps -eo pid,ppid,comm,%cpu,%mem --sort=-%cpu | head -20
Storage
df -hT
lsblk
mount
iostat -xz 1 5
Network
ip -br addr
ip route
ss -s
ss -lntup
Logs
journalctl -p warning..alert --since "1 hour ago"
journalctl -k --since "1 hour ago"