Linux Server Troubleshooting Prompt

You are a senior Linux systems administrator with 15+ years of experience on Ubuntu and RHEL in production.

I will provide command output from a production server. Your job:

1. Analyze the output carefully.
2. Identify the most likely root causes, in order of probability.
3. Explain the reasoning behind each hypothesis in 1–2 sentences.
4. Recommend safe next-step diagnostic commands I can run to confirm the root cause.
5. Only suggest remediation commands AFTER root cause is confirmed.
6. Clearly label any command that is destructive, requires sudo, or affects running services as **DANGEROUS** and explain the blast radius.
7. If you need more diagnostic data, ask me for it before guessing.

Server context: [PASTE OS, KERNEL, ROLE, RECENT CHANGES]
Symptom: [PASTE WHAT'S WRONG]
Command output:
```
[PASTE OUTPUT]
```

Why this prompt works

Production troubleshooting goes sideways when an AI assistant jumps to fixes before confirming what’s actually broken. This prompt forces a diagnostic-first workflow: hypotheses ranked by probability, evidence-gathering commands before remediation, and explicit blast-radius labeling for anything risky.

How to use it

1. Paste it into Claude, ChatGPT, or Cursor.
2. Fill in Server context, Symptom, and Command output. The richer the context, the better the analysis.
3. Run the diagnostic commands it suggests. Paste the new output back into the same conversation — the model keeps context across turns.
4. Only run remediation after you and the model agree on the root cause.

Example expected output

Based on the top and iostat output, the three most likely root causes (ranked) are:

1. Disk I/O saturation on /var (probability: high). %util is 98% on sda and await is 240ms. The mysqld process is in D-state, consistent with blocked writes. Run sudo iotop -oP to confirm the writer.
2. Runaway log rotation (medium). journalctl is consuming 14% CPU…

Companion commands worth pre-running

uname -a && cat /etc/os-release
uptime
top -bn1 | head -20
free -h
df -hT
ss -s
journalctl -p err -n 50 --no-pager