Incident guide · Databases
PostgreSQL, MySQL, and Redis diagnostics cheat sheet
Confirm database reachability, versions, recovery state, sessions, connections, memory, and bounded latency samples.50explained commands6practical sections100%concrete examples
09
PostgreSQL and MySQL
Check readiness and summarize server and session state.
Check whether PostgreSQL accepts connectionspg_isready -h <host> -p 5432 -d <database>Read-only
Show PostgreSQL server version and recovery statepsql -d <database> -Atc "select version(), pg_is_in_recovery();"Read-only
Summarize PostgreSQL sessions by statepsql -d <database> -c "select state, count(*) from pg_stat_activity group by state order by state;"Read-only
Check whether MySQL respondsmysqladmin -h <host> pingRead-only
Show MySQL server version and uptimemysql -h <host> -NBe "select @@version, @@hostname, uptime from performance_schema.global_status where variable_name='Uptime';"Read-only
Show MySQL thread and connection countersmysql -h <host> -e "show global status where Variable_name in ('Threads_connected','Threads_running','Max_used_connections');"Read-only
Rotate a MySQL user to a server-generated random passwordmysql -u <administrative-mysql-user> -p -e "ALTER USER '<mysql-user>'@'<account-host>' IDENTIFIED BY RANDOM PASSWORD;"danger
Create a compressed transaction-consistent MySQL database backupmysqldump --single-transaction --quick --routines --triggers --events --hex-blob -u <administrative-mysql-user> -p <database> | gzip -1 > <compressed-backup-file>caution
Restore a compressed SQL backup into a MySQL databasegzip -dc <compressed-backup-file> | mysql --binary-mode=1 -u <administrative-mysql-user> -p <database>danger
03
Redis
Confirm availability, memory state, and intrinsic latency.
Check whether Redis respondsredis-cli -h <host> -p 6379 PINGRead-only
Show compact Redis server and memory stateredis-cli -h <host> --no-auth-warning INFO server memory | rg '^(redis_version|uptime_in_seconds|used_memory_human|maxmemory_human):'Read-only
Run a bounded Redis intrinsic latency sampletimeout 5 redis-cli -h <host> --intrinsic-latency 2Read-only
15
Connectivity and DNS
Separate name resolution, routing, listener, TCP, and application response failures.
Resolve a hostname to its IP addressdig +short <domain>Read-only
Check whether a TCP port accepts connectionsnc -vz <host> <port>Read-only
List listening Linux sockets with process detailsss -lntupRead-only
Resolve the exact Linux route, source address, and next hop to a hostip route get <host>Read-only
Run a report-mode path quality test with loss and latency statisticsmtr --report --report-cycles <count> --wide <host>Read-only
List listening TCP ports and their processeslsof -iTCP -sTCP:LISTEN -n -PRead-only
Fetch only the HTTP response headerscurl -I <url>Read-only
Print your current public IP addresscurl -s https://api.ipify.orgRead-only
Send four ICMP probes to a hostping -c 4 <host>Read-only
Trace the network path to a hosttraceroute <host>Read-only
Show Linux network interfaces and addressesip -brief addressRead-only
Measure HTTP response timingcurl -o /dev/null -s -w 'dns=%{time_namelookup}s connect=%{time_connect}s total=%{time_total}s\n' <url>Read-only
Look up DNS records for a hosthost <domain>Read-only
Show the default network routeip route show defaultRead-only
Count established TCP connectionsss -H state established | wc -lRead-only
08
TLS and access evidence
Inspect certificate, negotiated protocol, firewall, and remote-access evidence around a database endpoint.
Inspect a remote TLS certificateopenssl s_client -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesRead-only
Calculate how many days remain on a remote TLS certificateend=$(openssl s_client -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2); echo "notAfter=$end"; echo "daysRemaining=$(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 ))"Read-only
Show the negotiated TLS protocol, cipher, and peer certificateopenssl s_client -brief -connect <host>:<port> -servername <host> </dev/null 2>&1 | rg 'Protocol|Ciphersuite|Peer certificate|Verification'Read-only
List the complete nftables rulesetnft list rulesetRead-only
Calculate the SHA-256 checksum of a filesha256sum <file>Read-only
Add executable permission to a filechmod +x <file>caution
Generate a cryptographically random Base64 passwordopenssl rand -base64 <count>Read-only
Print subjects, issuers, and validity dates for a TLS chainopenssl s_client -showcerts -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl crl2pkcs7 -nocrl -certfile /dev/stdin | openssl pkcs7 -print_certs -nooutRead-only
10
Service and log correlation
Inspect service failures and bounded logs before restarting a database.
List failed systemd servicessystemctl --failedRead-only
Show priority errors from the current bootjournalctl -p err -bRead-only
Read one service log for the last hour with precise timestampsjournalctl -u <service> --since '1 hour ago' -o short-iso-precise --no-pagerRead-only
Print status details for every failed systemd unitsystemctl --failed --no-legend | awk '{print $1}' | xargs -r systemctl status --no-pager --lines=<lines>Read-only
Show the latest kernel messagesdmesg | tail -30caution
Find every log file below the current directoryfind . -type f -name '*.log' -printRead-only
Detect services and versions on selected TCP portsnmap -sV --version-light -p <ports> <host>caution
Show what depends on a systemd servicesystemctl list-dependencies --reverse --all <service>Read-only
Show kernel and service warnings from the current bootjournalctl -b -p warning..alert --no-pager -o short-isoRead-only
Review successful and failed sudo activity for todayjournalctl _COMM=sudo --since today -o short-iso --no-pagercaution
05
Host resource pressure
Check CPU, memory, I/O, filesystems, and open deleted files that can make a healthy database appear unavailable.