You are on call. An alert comes in: the site answers 502. The team has a runbook for this alert — a short instruction with commands. Its first steps: make sure the site really does not work, and look at what changed on the machine in the last hour.
Take the runbook's first steps
An alert came in: the site answers 502. By the runbook, first make sure the site really answers 502, then look at the journal of sudo commands and site checks for the last hour.
First, predict
The alert came just now. What will the journal show before the FIRING line?
Now start the exercise, run the command and compare your prediction with the output.
lab-app is active, and the site answers 502. What in the journal is connected with the outage?
-
lab-sitecheck started before the change and stayed silent until then: the site answered 200. FIRING appeared only after lab-app was restarted.
-
active means the lab-app process runs, but says nothing about where it waits for requests. A second before FIRING deploy changed the port and restarted the service.
-
Your command is logged after FIRING: the outage began before you opened the journal.
The site began to answer 502 a second after the port change and the lab-app restart.