Linux debugging toolkit

Install

emisar pack install validates the pack and verifies its content hash before copying it into /etc/emisar/packs. The --hash below pins the install to the exact bytes on this page — a tampered copy is rejected. After install, reload the runner; it re-reads the catalog and advertises every action.

content hash: sha256:a1d3d6437de36b56b8f779b30bd2e7a0362a396f99661f2940cafb35cdbdb955

sudo emisar pack install debugging \
  --hash sha256:a1d3d6437de36b56b8f779b30bd2e7a0362a396f99661f2940cafb35cdbdb955 \
  --dest /etc/emisar/packs

# Reload so the runner re-reads the catalog:
sudo systemctl reload emisar

• debugging.disk_free exec low

  df + mounts

• debugging.dmesg_oom exec low

  OOM-kill events from dmesg

• debugging.dmesg_tail exec low

  Recent kernel messages

• debugging.drop_caches exec high

  echo <n> > /proc/sys/vm/drop_caches

• debugging.iostat exec low

  iostat per-device sample

• debugging.kernel_taint exec low

  Kernel taint state

• debugging.kill_pid exec high

  kill -<signal> <pid>

• debugging.loadavg exec low

  Load + memory + uptime snapshot

• debugging.lsof_port exec low

  Who owns a TCP port?

• debugging.mem_top exec low

  Top processes by RSS

• debugging.netstat_connections exec low

  Established connection summary

• debugging.netstat_listen exec low

  Listening sockets

• debugging.pid_cwd exec low

  Process cwd + exe

• debugging.pid_environ exec low

  Process environment

• debugging.pid_fds exec low

  Process open file descriptors

• debugging.pid_io exec low

  Process I/O accounting

• debugging.pid_limits exec low

  Resource limits applied to a PID

• debugging.pid_stack exec low

  Process kernel stack

• debugging.pid_status exec low

  Process /proc status block

• debugging.pid_threads exec low

  Per-thread stats for one PID

• debugging.ping_host exec low

  Ping a host

• debugging.processes_top exec low

  Top processes by CPU

• debugging.sar_recent exec low

  sar 3-sample CPU snapshot

• debugging.slabtop exec low

  Kernel slab cache top consumers

• debugging.socket_summary exec low

  Socket counts by family + state

• debugging.swap_status exec low

  Swap usage summary

• debugging.sysctl_set exec high

  sysctl -w <key>=<value>

• debugging.tcp_retrans_top exec low

  TCP connections with retransmits

• debugging.tcp_summary exec low

  TCP state counts

• debugging.top_open_files exec low

  Top processes by open-file count

• debugging.vmstat exec low

  vmstat sample