learn/linux-plus/distributions
395 differences from 70 topics, in reading order. This is the material a vendor-neutral exam exists to test, and it is the part you cannot reason your way to: the same software under a different package name, a different service name, and a different path. Each table links back to the topic that explains why the difference is there.
Linux fundamentals and the FHS
| RPM family | dpkg family | |
|---|---|---|
| Examples on this exam | RHEL, AlmaLinux, Rocky, Fedora, openSUSE, SLES | Debian, Ubuntu |
| Low-level tool | rpm | dpkg |
| Resolver | dnf (zypper on SUSE) | apt |
| Which package owns a path | rpm -qf PATH | dpkg -S PATH |
| Package file extension | .rpm | .deb |
| Web server package | httpd | apache2 |
Reading and editing files
| RHEL family | Debian family | |
|---|---|---|
vi present on a minimal install | Usually, as vim-minimal | Often not; vim.tiny when it is |
nano present on a minimal install | Frequently not | Frequently not |
| Install an editor | dnf install nano | apt install nano |
EDITOR default | vi | vi, sometimes nano on Ubuntu |
Users, root and sudo
| RHEL family | Debian family | |
|---|---|---|
| Admin group | wheel | sudo |
| Grant it | usermod -aG wheel sam | usermod -aG sudo sam |
| Auth log | /var/log/secure | /var/log/auth.log |
| Create a user | useradd -m sam | useradd -m sam or adduser sam |
| Root login enabled by default | Usually yes | Ubuntu locks it; Debian asks you |
Reading and setting permissions
| AlmaLinux 10.2 | Debian 13 | |
|---|---|---|
| Umask a regular user actually gets | 0022 | 0002 |
| So a new file is | 644 | 664 |
UMASK in /etc/login.defs | 022 | not set, PAM decides |
USERGROUPS_ENAB | yes | yes |
HOME_MODE | 0700 | 0700 |
| Extra character after the mode | . for an SELinux label | + for an ACL, if present |
How Linux boots
| RHEL family | Debian family | |
|---|---|---|
| GRUB config | /boot/grub2/grub.cfg | /boot/grub/grub.cfg |
| Regenerate it | grub2-mkconfig -o ... | update-grub |
| Global settings | /etc/default/grub | /etc/default/grub |
| Build the initramfs | dracut -f | update-initramfs -u |
| Per-kernel entries | grubby, /boot/loader/entries/ | /boot/grub/grub.cfg |
| Commands are prefixed | grub2- | grub- |
The kernel and modules
| RHEL family | Debian family | |
|---|---|---|
| Module directory | /lib/modules/$(uname -r)/ | /lib/modules/$(uname -r)/ |
| Distribution defaults | /usr/lib/modprobe.d/ | /usr/lib/modprobe.d/, reachable as /lib/modprobe.d/ |
| Your overrides | /etc/modprobe.d/ | /etc/modprobe.d/ |
| Load at boot | /etc/modules-load.d/*.conf | /etc/modules-load.d/*.conf or /etc/modules |
| Rebuild initramfs after a change | dracut -f | update-initramfs -u |
| Kernel package | kernel, kernel-core | linux-image-* |
Hardware and device discovery
| RHEL family | Debian family | |
|---|---|---|
lscpu, lsblk, free, dmesg | util-linux, procps-ng | util-linux, procps |
lspci, lsusb | pciutils, usbutils | pciutils, usbutils |
dmidecode | dmidecode | dmidecode |
lshw | lshw, often via EPEL | lshw |
| Sensors | lm_sensors | lm-sensors |
Disks, partitions and filesystems
| RHEL family | Debian family | |
|---|---|---|
| Default root filesystem | XFS | ext4 |
| ext tools | e2fsprogs | e2fsprogs |
| XFS tools | xfsprogs, installed | xfsprogs, often not |
| GPT tools | gdisk, parted | gdisk, parted |
| Default layout | LVM, usually | Plain partitions, usually |
Mounting and fstab
| RHEL family | Debian family | |
|---|---|---|
/etc/fstab format | Identical | Identical |
| SMB support package | cifs-utils | cifs-utils |
| NFS client package | nfs-utils | nfs-common |
| autofs package | autofs | autofs |
| Default root options | defaults plus SELinux relabelling | errors=remount-ro |
LVM
| RHEL family | Debian family | |
|---|---|---|
| LVM by default on install | Yes | No, unless chosen |
| Package | lvm2 | lvm2 |
| Typical root device | /dev/mapper/rhel-root | /dev/sda1 |
| Root filesystem | XFS, so xfs_growfs | ext4, so resize2fs |
RAID
| RHEL family | Debian family | |
|---|---|---|
| Package | mdadm | mdadm |
| Config file | /etc/mdadm.conf | /etc/mdadm/mdadm.conf |
| Monitoring service | mdmonitor.service | mdmonitor.service |
| Rebuild initramfs after changes | dracut -f | update-initramfs -u |
Configuring networking
| RHEL family | Ubuntu server | Debian | |
|---|---|---|---|
| Owns the config | NetworkManager | netplan, via systemd-networkd | ifupdown |
| Files | /etc/NetworkManager/system-connections/ | /etc/netplan/*.yaml | /etc/network/interfaces |
| Apply | nmcli connection up | netplan apply | systemctl restart networking |
| Safe-apply option | none | netplan try | none |
| Interactive tool | nmtui | none | none |
Name resolution and DNS
| RHEL family | Debian | Ubuntu | |
|---|---|---|---|
Writes /etc/resolv.conf | NetworkManager | resolvconf or nothing | systemd-resolved |
/etc/resolv.conf is | A real file | A real file | A symlink to the stub |
| Caching resolver by default | No | No | Yes, systemd-resolved |
| Tools package | bind-utils | dnsutils | dnsutils |
| Query tool | dig, host | dig, host | dig, host, resolvectl |
The shell environment
| RHEL family | Debian family | |
|---|---|---|
| System-wide interactive | /etc/bashrc | /etc/bash.bashrc |
| System-wide login | /etc/profile, /etc/profile.d/ | same |
| Service environment files | /etc/sysconfig/ | /etc/default/ |
Default user PATH includes sbin | Yes, for root; for users on recent releases | No, for regular users |
/bin/sh | a symlink to bash | dash |
Archiving and compression
| RHEL family | Debian family | |
|---|---|---|
tar, gzip | Installed | Installed |
bzip2, xz | bzip2, xz | bzip2, xz-utils |
zip / unzip | zip, unzip, often absent | zip, unzip, often absent |
| 7-Zip | 7zip | 7zip, with p7zip-full left as a transitional package |
| Package format compression | zstd on recent releases | zstd on recent releases |
Backup and restore
| RHEL family | Debian family | |
|---|---|---|
| rsync | rsync | rsync |
| ddrescue | ddrescue, via EPEL | gddrescue |
| Common backup tools | bacula, amanda, restic, borgbackup | same |
| Snapshot source | LVM, or Btrfs on SUSE | LVM, or Btrfs |
Virtualization
| RHEL family | Debian family | |
|---|---|---|
| Packages | qemu-kvm, libvirt, virt-install | qemu-kvm, libvirt-daemon-system, virtinst |
| Group for unprivileged use | libvirt | libvirt, sometimes kvm |
| Images default to | /var/lib/libvirt/images/ | same |
| Web management | Cockpit, with the VM plugin | Cockpit, packaged separately |
| Container tooling | Podman, default | Docker or Podman |
Links, hard and symbolic
| RHEL family | Debian family | |
|---|---|---|
/bin, /sbin, /lib | Symlinks into /usr | Symlinks into /usr |
| Alternatives system | alternatives | update-alternatives |
| Alternatives directory | /etc/alternatives | /etc/alternatives |
ls colours broken links | Yes, usually red | Yes, usually red |
Finding files
| RHEL family | Debian family | |
|---|---|---|
find, xargs | findutils | findutils |
locate implementation | plocate, or mlocate | plocate |
file | file | file, often not installed |
| Exclusions | /etc/updatedb.conf | /etc/updatedb.conf |
Managing users and groups
| RHEL family | Debian family | |
|---|---|---|
| Low-level tool | useradd | useradd |
| Friendly wrapper | none | adduser, deluser |
| Admin group | wheel | sudo |
| Defaults | /etc/login.defs, /etc/default/useradd | plus /etc/adduser.conf |
HOME_MODE on current releases | 0700 | 0700 |
Account files and attributes
| RHEL family | Debian family | |
|---|---|---|
| Default hash | yescrypt ($y$) on 10, SHA-512 ($6$) on 9 and earlier | yescrypt, $y$ |
| Set by | /etc/login.defs, PAM | PAM common-password |
| Auth log | /var/log/secure | /var/log/auth.log |
| Admin group | wheel | sudo |
HOME_MODE | 0700 | 0700 |
Job control and scheduling
| RHEL family | Debian family | |
|---|---|---|
| Package | cronie | cron |
| User crontabs | /var/spool/cron/ | /var/spool/cron/crontabs/ |
| System | /etc/crontab, /etc/cron.d/ | same |
| anacron | included in cronie | separate anacron package |
at | at, often not installed | at, often not installed |
Packages, repositories and signing
| RHEL family | Debian family | |
|---|---|---|
| Repo config | /etc/yum.repos.d/*.repo | /etc/apt/sources.list.d/* |
| Key store | rpm --import, gpg-pubkey packages | /usr/share/keyrings/, signed-by= |
| Verify a package file | rpm -K file.rpm | dpkg-sig --verify, or apt's own check |
| Verify installed files | rpm -V | debsums -c |
| Community extras | EPEL | already in main, contrib, non-free |
| Transaction rollback | dnf history undo | none |
Common network services
| RHEL family | Debian family | |
|---|---|---|
| Apache package and service | httpd | apache2 |
| Apache config root | /etc/httpd/ | /etc/apache2/ |
| Enabling a site | drop a .conf in conf.d/ | a2ensite, a symlink |
| Enabling a module | LoadModule in a conf file | a2enmod |
| MariaDB service | mariadb | mariadb |
| Firewall | firewalld | ufw, or nftables directly |
| Extra restriction | SELinux enforcing | AppArmor, more permissive |
systemd units and services
| RHEL family | Debian family | |
|---|---|---|
| Apache unit | httpd.service | apache2.service |
| Cron unit | crond.service | cron.service |
| Enabled on install | No, by preset | Yes, usually |
| Environment files | /etc/sysconfig/ | /etc/default/ |
systemd targets, timers and the journal
| RHEL family | Debian family | |
|---|---|---|
| Journal persistent by default | Yes | Historically no; now usually yes |
| Journal location | /var/log/journal/ | same |
| rsyslog also installed | Usually | Usually |
| Default target on a server | multi-user.target | multi-user.target |
Containers: the basics
| RHEL family | Debian family | |
|---|---|---|
| Default tooling | Podman, in the base repositories | Docker, from Docker's own repo |
| Rootless default | Yes | No |
| Image storage, rootful | /var/lib/containers/ | /var/lib/docker/ |
| Image storage, rootless | ~/.local/share/containers/ | , |
| Compose | podman-compose, or Quadlet | docker compose |
Container images, volumes and networks
| RHEL family | Debian family | |
|---|---|---|
| Storage, rootful | /var/lib/containers/storage/ | /var/lib/docker/ |
| Storage, rootless | ~/.local/share/containers/ | , |
| Mandatory access control | SELinux, needs :z/:Z | AppArmor, more permissive |
| Volume location | /var/lib/containers/storage/volumes/ | /var/lib/docker/volumes/ |
Authentication and PAM
| RHEL family | Debian family | |
|---|---|---|
| Service files | /etc/pam.d/<service> | /etc/pam.d/<service> |
| Shared stacks | system-auth, password-auth | common-auth, common-account, common-password, common-session |
| Where they really live | Symlinks into /etc/authselect/ | Regular files in /etc/pam.d/ |
| Who generates them | authselect | pam-auth-update, from /usr/share/pam-configs/ |
| Pulling them in | include and substack, per type | @include, whole file |
| Expressing "any of these" | sufficient | [success=N default=ignore] jumps |
| Module directory | /usr/lib64/security/ | /usr/lib/<triplet>/security/ |
| Password quality | pam_pwquality, in the shipped stack | pam_unix obscure until libpam-pwquality is installed |
| Lockout | pam_faillock, via authselect enable-feature with-faillock | pam_faillock, added by editing or pam-auth-update |
Central identity
| RHEL family | Debian family | |
|---|---|---|
| LDAP client tools | openldap-clients | ldap-utils |
| LDAP server | none since RHEL 8; 389-ds-base instead | slapd |
| SSSD | sssd, sssd-ldap, sssd-ad | sssd, sssd-ldap, sssd-ad |
| Join tooling | realmd, adcli | realmd, adcli |
| Home directory on first login | oddjob-mkhomedir, or pam_mkhomedir from pam | pam_mkhomedir from libpam-modules |
| Rewires PAM and NSS | authselect select sssd --force | pam-auth-update |
| Kerberos client | krb5-workstation | krb5-user |
| Samba domain member | samba-winbind, samba-winbind-clients | winbind, libnss-winbind |
Logging and auditing
| RHEL family | Debian family | |
|---|---|---|
| Journal | Persistent by default | Historically volatile; check /var/log/journal |
| Syslog daemon | On server installs; absent on minimal and image-based ones | rsyslog, installed |
| How rsyslog gets messages | imjournal, reading the journal | imuxsock, reading /dev/log |
| Catch-all text log | /var/log/messages | /var/log/syslog |
| Authentication text log | /var/log/secure | /var/log/auth.log |
| logrotate state file | /var/lib/logrotate/logrotate.status | /var/lib/logrotate/status |
| Audit package | audit, installed and enabled | auditd, not installed by default |
Firewall concepts and netfilter
| RHEL family | Debian family | Ubuntu | |
|---|---|---|---|
| Default front end | firewalld | none | ufw, installed and inactive |
| Underlying engine | nftables | nftables | nftables |
iptables present | As a compatibility shim | As a compatibility shim | As a compatibility shim |
| Service unit | firewalld.service | nftables.service | ufw.service |
| Rules survive reboot | Yes, permanent config | Only if you save them | Yes |
firewalld, ufw and nftables
| RHEL family | Debian family | |
|---|---|---|
| Installed and running by default | firewalld, enabled | Debian: none. Ubuntu: ufw, installed and inactive. |
| Package to install | firewalld | ufw, nftables |
| Permanent configuration | /etc/firewalld/**/*.xml | /etc/ufw/*.rules, /etc/nftables.conf |
| Unit that loads it | firewalld.service | ufw.service, nftables.service |
| Apply a saved change | firewall-cmd --reload | ufw reload, nft -f /etc/nftables.conf |
| Named service definitions | /usr/lib/firewalld/services/ | /etc/ufw/applications.d/ |
iptables back end | iptables-nft only | iptables-nft, with iptables-legacy selectable |
sudo in depth
| RHEL family | Debian family | |
|---|---|---|
| Admin group | wheel | sudo |
| Shipped rule | %wheel ALL=(ALL) ALL | %sudo ALL=(ALL:ALL) ALL |
| Grant it | usermod -aG wheel sam | usermod -aG sudo sam |
| Policy file | /etc/sudoers, mode 0440 | /etc/sudoers, mode 0440 |
| Drop-in directory | /etc/sudoers.d, empty | /etc/sudoers.d, with a README |
| Include directive | #includedir | @includedir |
secure_path includes /usr/local | No | Yes |
| Log lands in | /var/log/secure | /var/log/auth.log |
visudo editor | vi, unless EDITOR says otherwise | editor, through update-alternatives, often nano |
| First account gets sudo | Only if the installer's box was ticked | Only if the root password was left empty |
SSH and secure remote access
| RHEL family | Debian family | |
|---|---|---|
| Server package | openssh-server | openssh-server |
| Client package | openssh-clients | openssh-client |
| Service unit | sshd.service | ssh.service, with sshd.service as an alias |
| Config file | /etc/ssh/sshd_config | /etc/ssh/sshd_config |
| Drop-in directory | /etc/ssh/sshd_config.d/ | /etc/ssh/sshd_config.d/ |
| Algorithm selection | System-wide crypto policy, injected as a drop-in | Package defaults, edited in place |
| Firewall | firewall-cmd --add-service=ssh | ufw allow OpenSSH |
SELinux
| RHEL family | Debian family | |
|---|---|---|
| Shipped and enforcing by default | Yes | No |
| Default MAC system | SELinux | AppArmor |
| Model | Labels on every object | Paths in per-program profiles |
| Enforcing state | getenforce | aa-status |
| Adjust without policy | Booleans | Edit the profile |
| Config | /etc/selinux/config | /etc/apparmor.d/ |
Hardening a system
| RHEL family | Debian family | |
|---|---|---|
| MAC | SELinux, enforcing | AppArmor |
| Firewall | firewalld | nftables or ufw |
| Sysctl drop-ins | /etc/sysctl.d/ | /etc/sysctl.d/ |
| Secure Boot shim | shim-x64 | shim-signed |
| Benchmark tooling | oscap, scap-security-guide | oscap, with fewer shipped profiles |
| Unattended patching | dnf-automatic | unattended-upgrades |
Password policy and MFA
| RHEL family | Debian family | |
|---|---|---|
| Defaults at creation | /etc/login.defs | /etc/login.defs, plus /etc/adduser.conf |
| PAM file to change | Never edit directly | /etc/pam.d/common-password |
| Managed by | authselect | pam-auth-update |
| Strength module | pam_pwquality, installed | libpam-pwquality, not installed by default |
| Strength defaults live in | /etc/security/pwquality.conf | /etc/security/pwquality.conf |
| Lockout | authselect enable-feature with-faillock | Add pam_faillock lines by hand |
| Default hash | yescrypt on 10, SHA-512 on 9 | yescrypt on 13 |
Cryptography basics
| RHEL family | Debian family | |
|---|---|---|
Default ENCRYPT_METHOD | YESCRYPT on 10, SHA512 on 9 and earlier | YESCRYPT, giving $y$ |
| Where that is set | /etc/login.defs | /etc/login.defs |
| System-wide algorithm switch | update-crypto-policies | None; per-application |
| OpenSSL configuration | /etc/pki/tls/openssl.cnf | /etc/ssl/openssl.cnf |
| Hash a password by hand | openssl passwd -6 | mkpasswd -m yescrypt, from whois |
mkpasswd is | A different program, from expect, that *generates* passwords | The hashing tool |
| CA trust store refresh | update-ca-trust | update-ca-certificates |
TLS certificates and ACME
| RHEL family | Debian family | |
|---|---|---|
| Trust anchors go in | /etc/pki/ca-trust/source/anchors/ | /usr/local/share/ca-certificates/ |
| Rebuild the store with | update-ca-trust | update-ca-certificates |
| Generated bundle | /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem | /etc/ssl/certs/ca-certificates.crt |
| System-wide crypto policy | update-crypto-policies | none; per-application configuration |
| Root package | ca-certificates | ca-certificates |
Encrypting data at rest
| RHEL family | Debian family | |
|---|---|---|
| Package | cryptsetup | cryptsetup |
| Installer option | "Encrypt my data" | "Guided, use entire disk and set up encrypted LVM" |
| Boot mapping | /etc/crypttab | /etc/crypttab |
| Network unlock | Clevis and Tang | Clevis and Tang, or dropbear-initramfs |
| TPM enrolment | systemd-cryptenroll | systemd-cryptenroll |
Compliance, auditing and integrity
| RHEL family | Debian family | |
|---|---|---|
| Package verification | rpm -V, rpm -Va | dpkg -V, debsums |
| What is compared | Nine attributes including mode, owner, mtime | Recorded md5sums only |
| Config files | Reported, marked c | Excluded from md5sums |
| Trusted keys | rpm -qa gpg-pubkey | /etc/apt/keyrings, Signed-By: |
| Security errata | dnf updateinfo list --security | apt list --upgradable, the Security Tracker |
| Benchmark content | scap-security-guide, many profiles | ssg-debian, fewer profiles |
| Scanner | oscap | oscap |
| File integrity | aide, rkhunter | aide, rkhunter, debsums |
Your first shell script
| RHEL family | Debian family | |
|---|---|---|
/bin/sh is | bash, in POSIX mode | dash |
Bash syntax under #!/bin/sh | Usually works | Fails |
| Bash version | 5.x | 5.x |
| Your scripts belong in | /usr/local/bin | /usr/local/bin |
shellcheck package | ShellCheck, via EPEL | shellcheck |
Python for sysadmins
| RHEL family | Debian family | |
|---|---|---|
| Interpreter package | python3 | python3 |
python alias | python-unversioned-command | python-is-python3 |
| venv module | Included | python3-venv, installed separately |
| pip | python3-pip | python3-pip |
| PEP 668 enforced | Yes | Yes |
| Library packages | python3-requests | python3-requests |
Git: the basics
| RHEL family | Debian family | |
|---|---|---|
| Package | git | git |
/etc tracking | etckeeper | etckeeper |
| Default branch name | main, if you set it | main, if you set it |
| Credential helper | git-credential-libsecret, a package | Same name, shipped as source under /usr/share/doc/git/contrib; you compile it |
Git branching and collaboration
| RHEL family | Debian family | |
|---|---|---|
| Package | git | git |
| Default branch name | main, once you set it | main, once you set it |
| Credential storage | git-credential-libsecret, a package | Same name, but Debian ships only the source in contrib |
| SSH agent | ssh-agent, from lesson 43 | The same |
Infrastructure as code concepts
| RHEL family | Debian family | SUSE | |
|---|---|---|---|
| Unattended install | Kickstart | Preseed | AutoYaST |
| Config file | ks.cfg | preseed.cfg | autoinst.xml |
| Cloud first boot | cloud-init | cloud-init | cloud-init |
| Image-based variant | RHEL CoreOS, bootc | Ubuntu Core | MicroOS |
| Config management | Ansible, Puppet | Ansible, Puppet | Ansible, Salt |
Ansible
| RHEL family | Debian family | |
|---|---|---|
| Control node package | ansible-core, or ansible for the full collection set | The same |
| Managed node needs | Python 3, SSH | The same |
| Web server package | httpd | apache2 |
ansible_os_family | RedHat | Debian |
| Escalation | sudo, wheel group | sudo, sudo group |
Puppet and OpenTofu
| RHEL family | Debian family | |
|---|---|---|
| Puppet package | puppet-agent, from Puppet's repo | puppet-agent, or puppet from Debian |
| Puppet config | /etc/puppetlabs/puppet/ | The same, or /etc/puppet/ for the Debian package |
| OpenTofu | Their own repo, or a release archive | The same |
| Facts | facter | facter |
CI/CD and GitOps
| RHEL family | Debian family | |
|---|---|---|
| Container engine in the base repos | podman, and buildah for builds | docker.io, or Docker's own repository |
| Rootless containers out of the box | Yes, podman is rootless by default | Docker needs deliberate rootless setup |
| Self-hosted runner as a service | systemd unit, identical | systemd unit, identical |
| Bind-mounting a workspace | SELinux label needed, :Z | AppArmor, usually no relabel |
| Build image base | ubi, almalinux, rockylinux | debian, ubuntu |
| Installing the CLI tooling | dnf, sometimes needs a vendor repo | apt, sometimes needs a vendor repo |
Orchestration
| RHEL family | Debian family | |
|---|---|---|
| Container engine shipped | podman, daemonless and rootless by default | docker.io, or Docker's own repository |
| Compose implementation | podman-compose, or podman kube play | docker compose |
| Run a container as a service | podman generate systemd, or a Quadlet file | a systemd unit calling docker run |
| Pod as a first-class object | Yes, podman pod create | No, Docker has no pod concept |
| Bind-mount a host directory | needs :Z or :z for SELinux | usually no relabel needed |
| Registry configuration | /etc/containers/registries.conf | /etc/docker/daemon.json |
kubectl | vendor repository, or a binary | vendor repository, or a binary |
AI-assisted administration
| RHEL family | Debian family | |
|---|---|---|
| The package exists at all | dnf search <name> | apt-cache search <name> |
| The command comes from a package you have | rpm -qf $(which cmd) | dpkg -S $(which cmd) |
| What a package would install | dnf repoquery -l <name> | apt-file list <name> |
| The service is called what it says | `systemctl list-unit-files \ | grep <name>` |
| The file it named is real | ls -l, rpm -qf <path> | ls -l, dpkg -S <path> |
How to troubleshoot
| RHEL family | Debian family | |
|---|---|---|
| Authentication failures | /var/log/secure | /var/log/auth.log |
| General text log | /var/log/messages | /var/log/syslog |
| The journal | journalctl, identical | journalctl, identical |
| Which package owns a file | rpm -qf <path> | dpkg -S <path> |
| Has a package's file been altered | rpm -V <pkg>, always available | debsums <pkg>, rarely installed |
| Recent package activity | rpm -qa --last | /var/log/dpkg.log |
| Mandatory access control | SELinux, ausearch -m AVC | AppArmor, journalctl -k |
Monitoring concepts
| RHEL family | Debian family | |
|---|---|---|
| SNMP agent | net-snmp, service snmpd | snmpd, service snmpd |
| SNMP client tools | net-snmp-utils | snmp |
| MIB files | net-snmp-libs, some non-free ones absent | snmp-mibs-downloader, disabled by default |
| Agent configuration | /etc/snmp/snmpd.conf | /etc/snmp/snmpd.conf |
| Local resource metrics | sysstat, providing sar and iostat | sysstat, not installed by default |
| Firewall front end for UDP 161 | firewall-cmd --add-service=snmp | ufw allow 161/udp |
Reading logs to find a cause
| RHEL family | Debian family | |
|---|---|---|
Authentication and sudo | /var/log/secure | /var/log/auth.log |
| General text log | /var/log/messages | /var/log/syslog |
| Journal commands | identical | identical |
| Syslog facility for auth | authpriv | authpriv |
| Rotation | logrotate, /etc/logrotate.d | logrotate, /etc/logrotate.d |
| Text logs present at all | rsyslog, usually installed | rsyslog, absent from minimal images |
Boot failures and recovery
| RHEL family | Debian family | |
|---|---|---|
| GRUB configuration source | /etc/default/grub | /etc/default/grub |
| Regenerate GRUB config | grub2-mkconfig -o /boot/grub2/grub.cfg | update-grub |
| GRUB config path on UEFI | /boot/efi/EFI/<distro>/grub.cfg | /boot/grub/grub.cfg |
| Rebuild the initramfs | dracut -f | update-initramfs -u |
| Initramfs debug shell | rd.break | break= |
| Rescue media mount point | /mnt/sysimage, via chroot | mount and chroot by hand |
| SELinux relabel after repair | touch /.autorelabel | not applicable |
Filesystem and mount failures
| RHEL family | Debian family | |
|---|---|---|
| Default root filesystem | XFS | ext4 |
| Repair tool for the default | xfs_repair, unmounted only | e2fsck |
| Dry run that only reports | xfs_repair -n | e2fsck -n |
| Shrink supported | No, XFS cannot shrink | Yes, resize2fs when unmounted |
| Grow | xfs_growfs, while mounted | resize2fs, while mounted |
| Backup superblock locations | xfs_db, rarely needed | mke2fs -n, then e2fsck -b |
| Extra tooling | xfsprogs, installed | e2fsprogs, installed |
Disk space and inode problems
| RHEL family | Debian family | |
|---|---|---|
| Default root filesystem | XFS | ext4 |
| Inode count | Allocated dynamically | Fixed at mkfs time |
| Can run out of inodes | Effectively no | Yes, and it is the classic surprise |
| Reserved space for root | 5 percent on ext4 volumes | 5 percent, tune2fs -m to change |
| Report inode use | df -i, meaningful but rarely a limit | df -i, worth checking every time |
| Journal size control | journalctl --vacuum-*, SystemMaxUse= | identical |
Process and service failures
| RHEL family | Debian family | |
|---|---|---|
systemctl and exit codes | identical | identical |
| Vendor unit files | /usr/lib/systemd/system | /lib/systemd/system, symlinked to /usr/lib |
| Local overrides | /etc/systemd/system, systemctl edit | identical |
| Service starts on install | No, enable and start by hand | Yes, the package starts it |
| Common denial after a config change | SELinux, ausearch -m AVC | AppArmor, journalctl -k |
| Service account shell | /sbin/nologin | /usr/sbin/nologin |
Hardware and kernel issues
| RHEL family | Debian family | |
|---|---|---|
| Kernel log | dmesg, journalctl -k | identical |
| SMART tools | smartmontools, install it | smartmontools, install it |
| PCI and USB inventory | pciutils, usbutils | identical package names |
| Non-free device firmware | linux-firmware, installed by default | firmware-linux-nonfree and friends, often not |
| Sensor readings | lm_sensors | lm-sensors, note the hyphen |
| Hardware inventory | dmidecode, lshw | identical |
| Taint flag reference | /proc/sys/kernel/tainted | identical |
Network connectivity troubleshooting
| RHEL family | Debian family | |
|---|---|---|
ip, ss, ping | iproute2, identical | iproute2, identical |
| What configures the interface | NetworkManager | netplan on Ubuntu, ifupdown on Debian |
| Change an address persistently | nmcli con mod | netplan apply, or /etc/network/interfaces |
| Firewall front end | firewalld | ufw, or nftables directly |
traceroute installed | Often not, traceroute package | Often not, traceroute package |
tcpdump installed | Rarely, tcpdump package | Rarely, tcpdump package |
| Rule that produces a timeout | firewalld drops by default | ufw drops by default |
DNS and routing problems
| RHEL family | Debian family | |
|---|---|---|
Who writes /etc/resolv.conf | NetworkManager | systemd-resolved on Ubuntu, resolvconf or nothing on Debian |
| Is it a symlink | Usually a real file | Ubuntu: symlink to ../run/systemd/resolve/stub-resolv.conf |
| Stub resolver on 127.0.0.53 | Not by default | Ubuntu, by default |
| Query what applications get | getent hosts | getent hosts, or resolvectl query |
| Inspect the resolver's own view | `nmcli dev show \ | grep DNS` |
dig installed | bind-utils package | dnsutils or bind9-dnsutils package |
| Flush the cache | Usually none to flush | resolvectl flush-caches |
Permission and access troubleshooting
| RHEL family | Debian family | |
|---|---|---|
namei | util-linux, installed | util-linux, installed |
getfacl / setfacl | acl, not always installed | acl, not always installed |
| ACLs enabled by default | Yes, on ext4 and xfs | Yes, on ext4 |
| Mandatory access control | SELinux, enforcing | AppArmor, and it denies differently |
| Denials logged to | auditd, ausearch -m AVC | dmesg, or journalctl -k |
Security and service access problems
| RHEL family | Debian family | |
|---|---|---|
| Mandatory access control | SELinux, enforcing by default | AppArmor, enabled by default |
| Is it on | getenforce, sestatus | aa-status |
| Where a denial is recorded | auditd, ausearch -m AVC | kernel log, `journalctl -k \ |
| Scope of a profile | Every subject and object, by label | Per program, by path |
| Repository signing keys | /etc/pki/rpm-gpg, rpm --import | /etc/apt/keyrings, signed-by in the source |
| System CA trust store | /etc/pki/ca-trust/source/anchors, then update-ca-trust | /usr/local/share/ca-certificates, then update-ca-certificates |
| Certificate tooling | openssl, certbot | openssl, certbot |
CPU and memory performance
| RHEL family | Debian family | |
|---|---|---|
top, free, vmstat, ps | procps-ng, installed | procps, installed |
sar, iostat, mpstat, pidstat | sysstat, install it | sysstat, install it |
| Historical collection enabled | sysstat collects once installed | sysstat ships with collection off |
| Where history is kept | /var/log/sa/ | /var/log/sysstat/ |
| Per-process memory detail | /proc/<pid>/smaps_rollup | identical |
| OOM killer messages | journalctl -k, and /var/log/messages | journalctl -k, and /var/log/syslog |
| Default cgroup version | v2 | v2 |
I/O and network performance
| RHEL family | Debian family | |
|---|---|---|
iostat, sar, pidstat | sysstat, install it | sysstat, install it |
fio | fio, from AppStream | fio |
iperf3 | iperf3 | iperf3 |
ss, ip -s link | iproute2, installed | iproute2, installed |
| Default I/O scheduler, NVMe | none | none |
| Default I/O scheduler, rotational | mq-deadline | mq-deadline |
| Default queue discipline | fq_codel | fq_codel |
| Tuning profiles | tuned, with tuned-adm profile | tuned available, not installed |
Where the time actually goes
| RHEL family | Debian family | |
|---|---|---|
| Profiler package | perf | linux-perf |
| Profiler version | Follows the kernel, so perf-6.12.0-211.el10_2 against a 6.12.0-211 kernel | Follows the kernel too, with per-version packages behind the name |
| Tracer package | bpftrace | bpftrace |
| Userspace symbols | -debuginfo packages, and debuginfod fetches them on demand | -dbgsym packages, from a separate repository you have to enable |
What a write actually guarantees
| RHEL family | Debian family | |
|---|---|---|
| Default root filesystem | XFS | ext4 |
data= journal modes | Not available. XFS journals metadata only | The three modes above, ordered by default |
| Read the journal configuration | xfs_info / | tune2fs -l /dev/... |
| Grow the filesystem | xfs_growfs, and shrinking is impossible | resize2fs, which can shrink offline |
How upstream becomes your distribution
| RHEL family | Debian family | |
|---|---|---|
| Read a package's changelog | rpm -q --changelog NAME | zcat /usr/share/doc/NAME/changelog.Debian.gz |
| Where the distribution's work is counted | The release field, 2.39-124.el10_2 | The suffix, 2.41-12+deb13u3 |
| Per-CVE status for your release | Red Hat's advisory and CVE pages | The Debian Security Tracker |
| Machine-readable feed for a scanner | OVAL definitions | The security tracker's JSON export |
The system you cannot change
| RHEL family | Debian family | |
|---|---|---|
| The image-based system | Fedora CoreOS, Silverblue, and RHEL image mode | Ubuntu Core |
| Mechanism | OSTree deployments, moving to bootc container images | Snaps, with the operating system delivered as a read-only base snap |
| Add software to a running system | Layer a package, which applies at the next boot | Install a snap, which is confined rather than merged into the system |
| Roll back | Select the previous deployment at boot | Revert to the previous snap revision |