Chapter 2

When a system misbehaves, the difference between hours and minutes is knowing which tool to reach for and what its output actually means. This chapter comes early because everything after it—filesystems local and networked, datacenter networks, resilient design—is easier to reason about once you can watch a running system instead of guessing at it. Treat it as the instrument shelf for the rest of the book, and come back to it whenever a later chapter needs a tool you haven't used.

This chapter teaches the tools themselves—their mental models, essential flags, and how to read their output; the domain chapters apply them to specific problems. We trace system calls with strace, read the kernel's live state from /proc, profile with perf, program the kernel's own tracing machinery with eBPF/bpftrace, build reproducible debugging environments with Nixpkgs/NixOS, and finish with Wireshark—watching the traffic between hosts, the view that Network & Distributed Filesystems reaches for first and Datacenter & Network Fundamentals builds on.

# Chapter Sections