Linux core operations pack

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install linux-core --hash sha256:ccd93acbab4e65362e70f700412d1544b81de485983a98b905ec053765143cf2

• linux.arp_neighbors exec low

  ARP / IPv6 neighbor table

  `ip neigh show` — every known L2 neighbor with state (REACHABLE, STALE, FAILED). Useful for diagnosing intermittent L2 reachability problems. Read-only.

  View source on GitHub
• linux.cpu_info exec low

  CPU topology and features

  `lscpu` output — sockets, cores per socket, threads per core, architecture, microarchitecture, MHz, cache sizes, vulnerabilities (Spectre/Meltdown mitigation state). Use to confirm a host's CPU matches what the workload assumes. Read-only.

  View source on GitHub
• linux.cron_recent exec low

  Recent cron job execution log

  Show last N journalctl entries matching CRON. Lets operators see "did the backup job fire last night?" without grepping syslog. Read-only.

  View source on GitHub
• linux.crontab_all exec low

  All user crontabs + system cron dirs

  Dumps every per-user crontab AND the system cron dirs (/etc/crontab, /etc/cron.d/, /etc/cron.{hourly,daily,weekly,monthly}/). Use to answer "what's scheduled on this host?" Read-only. Cron command lines routinely carry inline credentials (a `curl` bearer token, a `mysql -p<pw>`), so this can surface secrets. The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret whose name and value match no rule.

  View source on GitHub
• linux.disk_smart exec low

  SMART health for one disk

  Runs `smartctl -H -A` against a block device. Returns the overall PASS/FAIL plus the attribute table (reallocated sectors, pending, uncorrectable, temperature). Read-only on the disk; needs the `smartmontools` package and CAP_SYS_RAWIO (root) to access device registers. For a disk behind a RAID controller (Dell PERC, HP SmartArray), pass `device_type` (e.g. `megaraid,0`) — the bare block device isn't reachable through the controller without it.

  View source on GitHub
• linux.disk_usage exec low

  Filesystem disk usage

  Reports filesystem usage for the supplied paths using df. Read-only. Use this to assess disk pressure before recommending cleanup, repair, compaction tuning, or adding disk. If a filesystem is >85% full, surface it but do not silently delete or truncate data — that's a separate, approval-gated action.

  View source on GitHub
• linux.failed_logins exec medium

  Recent failed login attempts

  Recent failed authentication attempts from the systemd journal — sshd's "Failed password" / "Invalid user" plus pam_unix "authentication failure" from su/sudo/login. High-signal for "is this host being brute-forced?" Read-only, but flagged medium-risk: the source IPs and usernames are sensitive PII. A healthy host with no failed auth returns nothing (the journal query exits 1 on no match, which is treated as success).

  View source on GitHub
• linux.grep_log exec low

  Grep a log file

  Greps an extended regex (POSIX -E) against a log file under /var/log. Read-only. Returns matching lines with line numbers (-n) up to max_lines. Use to find recent occurrences of a specific identifier (request ID, user ID, IP) or to spot error patterns without dumping the whole file. Output is run through the runner's redactor before it leaves the host. On journald-only hosts (no rsyslog) the system log isn't a file under /var/log — use linux.journalctl for syslog/messages; this reads on-disk files (app, nginx, …).

  View source on GitHub
• linux.hardware_summary exec low

  Hardware + BIOS summary via dmidecode

  `dmidecode` system + bios + chassis sections. Vendor, model, serial, BIOS version, manufacturing date. Required root (read-only on SMBIOS). Useful when correlating hardware-class to OS-class incidents. dmidecode reads SMBIOS — absent on containers and many cloud VMs, where this fails command-not-found; expect it on bare metal or VMs with SMBIOS passthrough.

  View source on GitHub
• linux.inode_usage exec low

  Inode usage per filesystem

  Shows inode usage per filesystem (`df -i`). A "disk full" report that doesn't match `df -h` is almost always inode exhaustion — this surfaces it directly. Read-only.

  View source on GitHub
• linux.journalctl exec medium

  Recent systemd journal entries

  Reads recent systemd journal entries for a named unit, filtered by priority and a time window. Use to triage service errors. Logs may reveal sensitive identifiers, IPs, hostnames, or PII; treat output as confidential. Do not echo verbatim to end users without consideration.

  View source on GitHub
• linux.journalctl_grep exec medium

  Grep recent systemd journal entries

  Like linux.journalctl, but filters entries to those matching a regex (via journalctl --grep). Read-only. Use when you already know the rough identifier or substring you're looking for (request ID, hostname, IP, error string) and don't want to download a large unfiltered journal slice. Output is run through the runner's redactor before leaving the host.

  View source on GitHub
• linux.kernel_modules exec low

  Loaded kernel modules sorted by size

  `lsmod` sorted by size, top 30. Useful to spot unexpected modules loaded on a production host (rootkits, debug tooling, vendor drivers). Read-only.

  View source on GitHub
• linux.last_logins exec low

  Recent successful logins

  Show last N successful logins from /var/log/wtmp via `last`. Shows user, terminal, source IP, duration. Read-only.

  View source on GitHub
• linux.lvm_status exec low

  LVM volume / group / PV summary

  Runs `lvs && vgs && pvs` for a one-shot LVM topology snapshot. Logical volumes, volume groups, physical volumes — sizes, free space, attributes. Read-only. Needs LVM tools installed.

  View source on GitHub
• linux.mdadm_status exec low

  mdadm RAID array status

  Reads /proc/mdstat plus `mdadm --detail` for every active array. Surfaces array state, devices, sync progress, faults. Read-only. Returns "no arrays" cleanly when there's no mdadm RAID configured.

  View source on GitHub
• linux.memory exec low

  System memory snapshot

  Reports memory and swap usage via free -m. Read-only, single sample. Memory state fluctuates between consecutive calls; take two samples a few seconds apart before drawing conclusions about pressure.

  View source on GitHub
• linux.memory_detailed exec low

  Full /proc/meminfo

  Dump full /proc/meminfo. More detail than the `linux.memory` action — surfaces hugepages, slab, dirty/writeback, page tables, KSM, cgroup memcg. Read-only.

  View source on GitHub
• linux.mount_status exec low

  Mounted filesystems

  Lists every mounted filesystem with type, source device, mountpoint, and mount options. Read-only. Use to confirm a service has the right disk attached or to find a stuck/duplicate mount.

  View source on GitHub
• linux.network_interfaces exec low

  Network interfaces

  `ip -j addr show` JSON. Returns every interface with its addresses, state, MAC, MTU. Use to confirm an interface is up with the right IP. Read-only.

  View source on GitHub
• linux.network_routes exec low

  Routing table + policy rules

  `ip route show && ip rule show && ip -6 route show`. Use to debug "why does traffic go via X instead of Y?" — surfaces every route and policy-based routing rule. Read-only.

  View source on GitHub
• linux.os_release exec low

  Distro + kernel identity

  Returns /etc/os-release plus `uname -a`. Identifies the distribution, version, codename, and kernel. Use as a first sanity check before recommending distro-specific commands. Read-only.

  View source on GitHub
• linux.reboot_host exec critical

  Schedule a host reboot

  Schedules a reboot via `shutdown -r +1` — one-minute warning to give in-flight connections a chance to drain. Sends a wall message with the operator-supplied reason. Cannot be undone except by `shutdown -c` BEFORE the minute elapses; once the kernel begins shutdown the host is going down regardless.

  View source on GitHub
• linux.sudoers_dump exec medium

  sudoers configuration audit

  Dumps /etc/sudoers and the index of /etc/sudoers.d/. Use for an audit pass — "who can sudo to what?". Sensitive content; output goes through redaction. Read-only.

  View source on GitHub
• linux.systemctl_disable exec high

  Disable a systemd unit at boot

  `systemctl disable <unit>`. Removes the boot symlinks. Does NOT stop the unit now — pair with `linux.systemctl_stop` for that. Persistent change across reboots.

  View source on GitHub
• linux.systemctl_enable exec high

  Enable a systemd unit at boot

  `systemctl enable <unit>`. Creates the symlinks so the unit starts at boot. Does NOT start it now — pair with `linux.systemctl_start` for that. Persistent change across reboots.

  View source on GitHub
• linux.systemctl_reload exec high

  Reload a systemd unit's config

  `systemctl reload <unit>`. The unit re-reads its config without restarting (works only for units declaring an ExecReload). Use after editing nginx.conf / postgresql.conf / etc. The reload is graceful by definition — no requests dropped.

  View source on GitHub
• linux.systemctl_restart exec high

  Restart a systemd unit

  Restarts a named systemd unit. Clients will see an outage of seconds-to-minutes depending on the unit. Treat as a last-resort action: prefer diagnosis (logs, status, disk, memory) first. Never restart a database under load without confirming there is no in-flight repair, compaction, or similar background operation. WHICH units this runner may restart is an operator policy decision (high-risk → require_approval by default), not a fixed list; the unit is bounded to a valid systemd unit name so it can't carry shell metacharacters.

  View source on GitHub
• linux.systemctl_start exec high

  Start a systemd unit

  `systemctl start <unit>`. Brings a unit up. The unit name is pattern-restricted to safe systemd unit naming. Combine with `linux.systemctl_status` afterward to confirm the unit reached active state.

  View source on GitHub
• linux.systemctl_status exec low

  Systemd unit status

  Reports the current systemd unit status for a named service. Read-only. Use to confirm whether a service is active before recommending diagnostic or remediation actions.

  View source on GitHub
• linux.systemctl_stop exec high

  Stop a systemd unit

  `systemctl stop <unit>`. Brings a unit down. Sends SIGTERM, waits for TimeoutStopSec, then SIGKILL. In-flight requests on the service are dropped unless the unit handles graceful drain.

  View source on GitHub
• linux.tail_log exec low

  Tail a log file

  Reads the last N lines of a log file under /var/log. Read-only. Use to glance at the most recent activity for a service when triaging an alert, before deciding whether to grep deeper or pull more context. Output is run through the runner's redactor before it leaves the host. On journald-only hosts (no rsyslog) the system log isn't a file under /var/log — use linux.journalctl for syslog/messages; this reads on-disk files (app, nginx, …).

  View source on GitHub
• linux.uptime exec low

  System uptime and load average

  Reports system uptime and 1/5/15-minute load averages. Load averages are dimensionless and machine-dependent; compare against CPU count before interpreting them as "high".

  View source on GitHub
• linux.who_now exec low

  Currently logged-in users

  `who` + `w` — usernames, terminals, login times, source IPs, and what each session is currently running. Use to confirm whether a human is on the box during an incident. Read-only.

  View source on GitHub