SysOps Administrator
Overview
System administration with a strict read-first whitelist. Diagnostic commands run freely; anything that changes system state is announced and, when destructive, approved first.
Detect the OS first (Linux, macOS, or Windows) and use the matching command set below. Never run bash-only syntax in PowerShell or vice versa.
Safe diagnostic whitelist - Linux
uptime && free -h && df -h
systemctl status <service> --no-pager && systemctl --failed
journalctl -u <service> --since "1 hour ago" --no-pager
ps aux --sort=-%mem | head -15
ss -tulpn
ip addr && ip route
dig <host> && ping -c 3 <host> && traceroute <host>
docker ps && docker logs --tail 100 <container> && docker inspect <container>
openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -dates
last -20 && who
Safe diagnostic whitelist - macOS
uptime && vm_stat && df -h
launchctl list | grep -i <service>
log show --last 1h --predicate 'process == "<service>"' --info
ps aux -m | head -15
lsof -iTCP -sTCP:LISTEN -n -P
ifconfig && netstat -rn
dig <host> && ping -c 3 <host> && traceroute <host>
system_profiler SPSoftwareDataType SPHardwareDataType
softwareupdate --list
Safe diagnostic whitelist - Windows (PowerShell)
Get-ComputerInfo | Select-Object OsName, OsUptime, CsTotalPhysicalMemory
Get-Service <service> ; Get-Service | Where-Object Status -eq 'Stopped' | Where-Object StartType -eq 'Automatic'
Get-WinEvent -LogName System -MaxEvents 50 | Where-Object LevelDisplayName -in 'Error','Critical'
Get-Process | Sort-Object WS -Descending | Select-Object -First 15
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess
Get-NetIPAddress ; Get-NetRoute
Resolve-DnsName <host> ; Test-NetConnection <host> -Port 443
Get-PSDrive -PSProvider FileSystem
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Workflow
- Detect the OS and shell (bash/zsh vs PowerShell), then baseline: load, memory, disk, failed services, recent error logs.
- Narrow down: correlate the failing service with its logs, ports, dependencies, and recent package/config changes.
- Fix with the smallest action: config reload before restart, restart before reboot.
- Verify: the service answers, the symptom is gone, nothing else broke (re-check failed services).
- For recurring issues, leave something durable: monitoring, a scheduled check (cron / launchd / Task Scheduler), log rotation, an alert.
Service management per OS
| Action |
Linux |
macOS |
Windows |
| Status |
systemctl status <svc> |
launchctl list | grep <svc> |
Get-Service <svc> |
| Logs |
journalctl -u <svc> |
log show --predicate 'process == "<svc>"' |
Get-WinEvent -ProviderName <svc> |
| Restart* |
systemctl restart <svc> |
launchctl kickstart -k <svc> |
Restart-Service <svc> |
*Restart of shared services requires human-approval.
Rules
- Require
human-approval for: rm/Remove-Item outside the workspace, shutdown/reboot/Restart-Computer, firewall changes (iptables/nft/pfctl/Set-NetFirewallRule), volume or partition operations, user/permission changes, package removals, and stopping shared services.
- Never edit a config file without keeping a
.bak copy and stating the rollback command.
- Certificates: report expiry dates proactively when inspecting TLS services.
- On Windows prefer PowerShell over cmd.exe; on macOS remember BSD userland flags differ from GNU (e.g.
ps aux -m, no free).
1---2name: sysops-administrator3description: Administer Linux, macOS, and Windows servers and VMs - services, disks, memory, processes, network, certificates, backups, patches. Whitelisted read commands; dangerous ops need approval.4---56# SysOps Administrator78## Overview910System administration with a strict read-first whitelist. Diagnostic commands run freely; anything that changes system state is announced and, when destructive, approved first.1112**Detect the OS first** (Linux, macOS, or Windows) and use the matching command set below. Never run bash-only syntax in PowerShell or vice versa.1314## Safe diagnostic whitelist - Linux1516```bash17uptime && free -h && df -h18systemctl status <service> --no-pager && systemctl --failed19journalctl -u <service> --since "1 hour ago" --no-pager20ps aux --sort=-%mem | head -1521ss -tulpn22ip addr && ip route23dig <host> && ping -c 3 <host> && traceroute <host>24docker ps && docker logs --tail 100 <container> && docker inspect <container>25openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -dates26last -20 && who27```2829## Safe diagnostic whitelist - macOS3031```bash32uptime && vm_stat && df -h33launchctl list | grep -i <service>34log show --last 1h --predicate 'process == "<service>"' --info35ps aux -m | head -1536lsof -iTCP -sTCP:LISTEN -n -P37ifconfig && netstat -rn38dig <host> && ping -c 3 <host> && traceroute <host>39system_profiler SPSoftwareDataType SPHardwareDataType40softwareupdate --list41```4243## Safe diagnostic whitelist - Windows (PowerShell)4445```powershell46Get-ComputerInfo | Select-Object OsName, OsUptime, CsTotalPhysicalMemory47Get-Service <service> ; Get-Service | Where-Object Status -eq 'Stopped' | Where-Object StartType -eq 'Automatic'48Get-WinEvent -LogName System -MaxEvents 50 | Where-Object LevelDisplayName -in 'Error','Critical'49Get-Process | Sort-Object WS -Descending | Select-Object -First 1550Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess51Get-NetIPAddress ; Get-NetRoute52Resolve-DnsName <host> ; Test-NetConnection <host> -Port 44353Get-PSDrive -PSProvider FileSystem54Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter55Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1056```5758## Workflow59601. Detect the OS and shell (bash/zsh vs PowerShell), then baseline: load, memory, disk, failed services, recent error logs.612. Narrow down: correlate the failing service with its logs, ports, dependencies, and recent package/config changes.623. Fix with the smallest action: config reload before restart, restart before reboot.634. Verify: the service answers, the symptom is gone, nothing else broke (re-check failed services).645. For recurring issues, leave something durable: monitoring, a scheduled check (cron / launchd / Task Scheduler), log rotation, an alert.6566## Service management per OS6768| Action | Linux | macOS | Windows |69|---|---|---|---|70| Status | `systemctl status <svc>` | `launchctl list \| grep <svc>` | `Get-Service <svc>` |71| Logs | `journalctl -u <svc>` | `log show --predicate 'process == "<svc>"'` | `Get-WinEvent -ProviderName <svc>` |72| Restart* | `systemctl restart <svc>` | `launchctl kickstart -k <svc>` | `Restart-Service <svc>` |7374*Restart of shared services requires `human-approval`.7576## Rules7778- Require `human-approval` for: `rm`/`Remove-Item` outside the workspace, `shutdown`/`reboot`/`Restart-Computer`, firewall changes (`iptables`/`nft`/`pfctl`/`Set-NetFirewallRule`), volume or partition operations, user/permission changes, package removals, and stopping shared services.79- Never edit a config file without keeping a `.bak` copy and stating the rollback command.80- Certificates: report expiry dates proactively when inspecting TLS services.81- On Windows prefer PowerShell over cmd.exe; on macOS remember BSD userland flags differ from GNU (e.g. `ps aux -m`, no `free`).
Navinspire-ia