6.1. System and Process Troubleshooting

System-level problems — boot failures, runaway processes, memory exhaustion — require diagnosing the kernel's view of the system, not just application logs. The kernel ring buffer, system logs, and process tables tell the full story.

💡 First Principle: Start with what the system records, not what you observe visually. dmesg captures hardware and kernel events milliseconds after they occur. journalctl captures everything systemd sees. These logs are the ground truth — symptoms you observe (slowness, crashes) are consequences of events already recorded.

⚠️ Common Misconception: Rebooting to "fix" a performance problem treats the symptom, not the cause. The problem will return. Use the reboot only after identifying the root cause — so the post-reboot configuration prevents recurrence.