https://kabutoxyz.com/ Field notes on Linux, backups, containers and monitoring, written by an engineer who runs the systems described here. Commands are run before they are written down. en https://kabutoxyz.com/articles/file-descriptor-leak/ https://kabutoxyz.com/articles/file-descriptor-leak/ 2026-10-07T09:00:00+00:00 EMFILE arrives long before the crash. Reading the per-process limits and counting open descriptors shows which service is leaking and how fast. https://kabutoxyz.com/articles/ssh-host-key-fingerprints/ https://kabutoxyz.com/articles/ssh-host-key-fingerprints/ 2026-10-07T09:00:00+00:00 The fingerprint prompt is the one moment SSH authentication can be attacked. Knowing what is being compared turns it from a nuisance into a check. https://kabutoxyz.com/articles/systemd-restart-policy-crash-loop/ https://kabutoxyz.com/articles/systemd-restart-policy-crash-loop/ 2026-10-07T09:00:00+00:00 Restart=on-failure and StartLimitBurst decide whether a service recovers or dies. Read them from the running unit, not from the file you think is loaded. https://kabutoxyz.com/articles/rsync-backup-flags/ https://kabutoxyz.com/articles/rsync-backup-flags/ 2026-10-07T09:00:00+00:00 A trailing slash changes the entire result, and --delete makes a wrong path destructive. Test with --dry-run until the output matches intent. https://kabutoxyz.com/articles/disk-full-incident-order/ https://kabutoxyz.com/articles/disk-full-incident-order/ 2026-10-06T09:00:00+00:00 Space is used, not created. Work from df to du to inodes to open files and the cause is found in minutes instead of an hour. https://kabutoxyz.com/articles/test-remote-port-reachability/ https://kabutoxyz.com/articles/test-remote-port-reachability/ 2026-10-06T09:00:00+00:00 Connection refused, timed out and no route are three different problems. Tell them apart and the fault is localised in one command. https://kabutoxyz.com/articles/find-process-holding-port/ https://kabutoxyz.com/articles/find-process-holding-port/ 2026-10-05T09:00:00+00:00 Address already in use is a symptom, not a diagnosis. Here is how to find the real owner of a port and why it sometimes refuses to release. https://kabutoxyz.com/articles/honest-health-checks/ https://kabutoxyz.com/articles/honest-health-checks/ 2026-10-03T09:00:00+00:00 A check that returns 200 while the database is unreachable is worse than no check. Here is how to test the dependency, not the process. https://kabutoxyz.com/articles/container-volumes-data-survival/ https://kabutoxyz.com/articles/container-volumes-data-survival/ 2026-09-29T09:00:00+00:00 Rebuilding a container is routine until it takes the data with it. Here is which storage survives, which does not, and how to check first. https://kabutoxyz.com/articles/backup-restore-drill/ https://kabutoxyz.com/articles/backup-restore-drill/ 2026-09-24T09:00:00+00:00 Most backup failures are found during a restore, which is the worst possible time. A repeatable restore drill turns that into a non-event. https://kabutoxyz.com/articles/systemd-timer-calendar-expressions/ https://kabutoxyz.com/articles/systemd-timer-calendar-expressions/ 2026-09-18T09:00:00+00:00 OnCalendar looks like cron but is not cron. Two expression shapes look correct, parse without error, and run at the wrong time. https://kabutoxyz.com/articles/var-log-disk-growth/ https://kabutoxyz.com/articles/var-log-disk-growth/ 2026-09-12T09:00:00+00:00 A full root filesystem is usually logs, not data. Here is how to find the real culprit in three commands and cap it so it stays capped.