# Linux Patterns

> When to activate: Linux, systemd, cron, shell, process management, networking, performance tuning, security hardening, ufw, fail2ban

- Skill: `mattakushi432/linux-patterns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/linux-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/linux-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/linux-patterns

---

# Linux Patterns

## systemd Service Unit

```ini
[Unit]
Description=MyApp Service
After=network.target postgresql.service
Requires=postgresql.service

[Service]
Type=simple
User=myapp
Group=myapp
WorkingDirectory=/opt/myapp
ExecStart=/opt/myapp/bin/myapp --config /etc/myapp/config.yaml
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5s
StandardOutput=journal
StandardError=journal
SyslogIdentifier=myapp
Environment=LOG_LEVEL=info
EnvironmentFile=-/etc/myapp/env

# Security hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ReadOnlyPaths=/

[Install]
WantedBy=multi-user.target
```

```bash
systemctl daemon-reload
systemctl enable --now myapp
journalctl -u myapp -f --since "10 min ago"
```

## cron (with flock to prevent overlap)

```bash
# /etc/cron.d/myapp
# Run report every hour, skip if previous run still active
0 * * * * myapp /usr/bin/flock -n /tmp/myapp-report.lock /opt/myapp/bin/report.sh >> /var/log/myapp/report.log 2>&1
```

## Performance Diagnostics

```bash
# CPU — who's using it
top -b -n 1 -o %CPU | head -20
pidstat -u 1 5              # per-process CPU usage over 5s

# Memory
free -h
vmstat 1 5                  # memory, swap, I/O
cat /proc/meminfo | grep -E "MemAvailable|Cached|Buffers"

# Disk I/O
iostat -xz 1 5              # per-device utilization
iotop -o                    # which process is doing I/O

# Network
ss -tunapl                  # all TCP/UDP with process info
netstat -s | grep -E "failed|error|reset"
sar -n DEV 1 5              # per-interface throughput

# Load average context
uptime                      # 1/5/15 min load averages
nproc                       # number of CPU cores (load > nproc = overloaded)
```

## File Descriptor and Connection Limits

```bash
# Check current limits
ulimit -n
cat /proc/sys/fs/file-max

# Increase for a process (in systemd unit)
[Service]
LimitNOFILE=65536

# System-wide (sysctl)
sysctl -w fs.file-max=2097152
echo "fs.file-max = 2097152" >> /etc/sysctl.d/99-myapp.conf
sysctl -p /etc/sysctl.d/99-myapp.conf
```

## Security Hardening

```bash
# UFW firewall
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp comment 'SSH'
ufw allow 443/tcp comment 'HTTPS'
ufw enable

# fail2ban for SSH
apt install fail2ban
cat > /etc/fail2ban/jail.local << 'EOF'
[sshd]
enabled = true
port = 22
maxretry = 5
bantime = 3600
findtime = 600
EOF
systemctl enable --now fail2ban

# Disable root SSH login
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl reload sshd
```

## Log Rotation

```bash
# /etc/logrotate.d/myapp
/var/log/myapp/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        systemctl kill -s HUP myapp.service
    endscript
}
```

## Key Rules
- Use `journalctl` for systemd services — not raw log files
- `ss` replaces `netstat` on modern Linux (faster, same syntax)
- Always set resource limits in unit files: `LimitNOFILE`, `MemoryMax`
- `nohup` and `screen`/`tmux` for long-running manual tasks; prefer systemd for daemons
- Run `logwatch` or `lynis` weekly for security audit baseline