This project simulates the investigation of a Linux application outage. The objective was to analyze application logs, reconstruct the event timeline, and document findings using an evidence-based troubleshooting approach.
Status: ✅ Complete
- Linux log analysis
- Evidence-based troubleshooting
- Root cause investigation
- Linux file navigation
- Technical documentation
- Git and GitHub workflow
- Ubuntu 26.04 LTS (WSL2)
- Bash
- Git
- GitHub
- Visual Studio Code
This project simulates investigating why a Linux application unexpectedly stopped responding. The goal was to analyze application logs, reconstruct the event timeline, and document findings based only on the available evidence.
Rather than assuming a root cause, the investigation focused on identifying what could be confirmed from the logs and documenting what additional evidence would be required to continue the investigation.
During this investigation, I:
- Reviewed application logs using standard Linux command-line tools.
- Reconstructed the outage timeline from available log entries.
- Identified critical error messages and system events.
- Distinguished confirmed evidence from assumptions.
- Documented findings and recommended next investigative steps.
ls
cat logs/server.log
grep -i error logs/server.logAI was used to assist with technical research, improve documentation clarity, and explore potential troubleshooting approaches.
All commands, investigation steps, findings, and conclusions were manually reviewed, validated against the available evidence, and verified before being included in this project.
The investigation was verified by reviewing the application log and confirming that the documented timeline matched the recorded system events.
| Time | Event |
|---|---|
| 9:15 AM | Application started |
| 9:15 AM | Connected to AWS |
| 9:16 AM | Database connection established |
| 9:16 AM | Database connection lost |
| 9:16 AM | Automatic reconnect attempted |
| 9:16 AM | Reconnect failed |
| 9:16 AM | Application shut down |
The available evidence indicates that the outage followed a database connectivity failure. Although the application attempted to reconnect automatically, the reconnect failed and the application shut down.
The available logs do not identify why the database connection was lost. Determining the root cause would require additional evidence such as database logs, network diagnostics, or recent configuration changes.
The investigation followed an evidence-based approach throughout.
- Verified log entries before documenting findings.
- Distinguished confirmed evidence from assumptions.
- Correlated the event timeline with the application logs.
- Documented only conclusions supported by the available evidence.
- Identified additional information required before determining the root cause.
This project reinforced that effective troubleshooting begins with evidence rather than assumptions. Rather than guessing at a root cause, I documented only what the logs confirmed and identified the additional information required to complete the investigation.
The investigation also strengthened my understanding of structured troubleshooting, log analysis, and the importance of clearly communicating what is known, what remains unknown, and what evidence is needed to continue an investigation.
- Investigate database server logs.
- Correlate application and system logs.
- Analyze network connectivity during the outage.
- Recreate the investigation on an AWS EC2 Linux instance.
- Expand the investigation using CloudWatch logs and monitoring.