A Linux server running a service suddenly becomes slow. How do you investigate?

What the interviewer wants to hear

• Use a method such as USE: utilization, saturation, errors per resource
• Check load average, CPU, memory and swap, disk I/O, network
• Use tools such as top, vmstat, iostat, ss, dmesg, journalctl
• Check recent changes and application logs
• Go deeper with perf or eBPF tools if needed

Model answer

I follow the USE method: for each resource I check utilization, saturation and errors. I start with uptime for load average, then top or htop to see CPU use and which processes are busy. vmstat 1 shows run queue length, swapping and I/O wait, and free shows memory pressure. iostat -x shows disk utilization and latency, and ss or sar show network connections and errors. dmesg and journalctl can reveal OOM kills, disk errors or throttling. I also check whether something changed recently, such as a deploy or a cron job. If the cause is still unclear, I use perf, flame graphs or eBPF tools like biolatency and offcputime to see where time is really going.

More medium Site Reliability Engineer questions

• How would you design alerting for a service so that on-call engineers are not flooded with noisy alerts?
• Walk me through how you would run and write a postmortem after a major outage.
• How should a client retry failed calls to another service safely?
• How do you do capacity planning for a growing service?
• A team is launching a new checkout API and asks you to help define its SLOs. How do you approach it?
• Your Prometheus servers are running out of memory because of too many time series. How do you find the cause and keep cardinality under control?
• A Deployment rollout is stuck because new pods are in CrashLoopBackOff. Walk me through how you would debug it.
• During a major incident, how do you handle communication with customers, support and leadership?
• A big marketing launch is in three weeks. How would you load test the service to know it will cope?