1---2name: centos-linux-triage-23description: Diagnose and remediate CentOS Linux incidents with RHEL-compatible systemd, journal, dnf/yum, SELinux, firewalld, and rollback practices. Use when the user asks to triage CentOS service failures, package issues, boot problems, networking/firewall symptoms, or security-policy denials.4---56# CentOS Linux triage78Diagnose a CentOS problem report, transform release and constraint details into a safe RHEL-compatible triage plan, and return copy-paste-ready remediation, validation, and rollback commands.910## When to invoke1112- "Triage this CentOS service failure."13- "Fix a CentOS package or dnf/yum issue."14- "Why is this CentOS host blocked by SELinux or firewalld?"15- "Give me CentOS remediation commands with rollback."16- "Debug this CentOS Stream or legacy CentOS problem."1718## Request facts to capture1920Preserve these original inputs when they are supplied by the caller: `${input:CentOSVersion}`, `${input:ProblemSummary}`, and `${input:Constraints}`. If any are absent, infer only safe defaults and mark unknowns explicitly.2122| Fact | How to collect | Why it matters |23| --- | --- | --- |24| Release line | `cat /etc/centos-release`, `cat /etc/os-release`, `rpm -E %rhel` | CentOS Stream, CentOS Linux 7, and RHEL-compatible rebuilds differ in package sources and support posture. |25| Runtime context | `systemd-detect-virt`, `hostnamectl`, `uname -r` | Containers, VMs, and bare metal expose different service, kernel, and boot behavior. |26| Failing unit | `systemctl status <unit> --no-pager`, `systemctl is-enabled <unit>` | Separates disabled, failed, masked, missing, and dependency-blocked units. |27| Recent changes | `dnf history info last` or `yum history info last`, `rpm -qa --last | head` | Package updates and removals are common root causes. |28| Constraints | maintenance window, no reboot, no package install, production host | Determines whether to restart, reboot, downgrade, or only gather evidence. |2930## Triage command map3132| Symptom | First commands | Evidence to read |33| --- | --- | --- |34| Service failed | `systemctl status <unit> --no-pager`; `journalctl -u <unit> -b --no-pager` | Exit code, failed dependency, denied path, missing config, port conflict. |35| Boot or kernel issue | `journalctl -b -p warning --no-pager`; `grubby --default-kernel`; `uname -r` | Kernel mismatch, initramfs failure, failed mount, emergency target cause. |36| Package conflict | `dnf check`; `dnf repolist`; `dnf history list`; use `yum` on legacy hosts | Broken dependencies, disabled repos, modular stream conflicts, incomplete transactions. |37| Disk pressure | `df -h`; `du -xh /var | sort -h | tail`; `journalctl --disk-usage` | Full `/`, `/var`, logs, cache, or application data. |38| Network path | `ip addr`; `ip route`; `ss -tulpn`; `resolvectl status` or `/etc/resolv.conf` | Addressing, routing, DNS, listener, local firewall. |39| SELinux denial | `getenforce`; `ausearch -m AVC,USER_AVC -ts recent`; `sealert -a /var/log/audit/audit.log` | Whether denial is real, recent, and tied to the failing service. |40| firewalld block | `firewall-cmd --state`; `firewall-cmd --list-all`; `firewall-cmd --get-active-zones` | Active zone, allowed service/port, runtime versus permanent mismatch. |4142## Remediation patterns4344| Problem | Preferred fix | Avoid |45| --- | --- | --- |46| Failed service after config edit | Validate config with the daemon-specific checker, then `systemctl restart <unit>` and `systemctl status <unit> --no-pager`. | Blind restart loops without reading `journalctl`. |47| Missing package | `dnf install <package>` or `yum install <package>` after checking enabled repos. | Curl-piping random RPM installers on production hosts. |48| Broken transaction | `dnf history undo <ID>` when safe, or `dnf distro-sync` for repository drift. | Deleting RPM database files. |49| SELinux denial | Restore labels with `restorecon -Rv <path>`, set documented booleans with `setsebool -P <boolean> on`, or create a narrow policy module only after review. | `setenforce 0` as a permanent fix. |50| firewalld port missing | `firewall-cmd --add-service=<service>` for runtime test, then `--permanent` and `--reload` after validation. | Editing iptables rules behind firewalld. |51| Log growth | `journalctl --vacuum-time=7d` or service-specific retention settings. | Removing live log files without restarting/reopening the writer. |5253## Safety rules5455- Verify every destructive command with a read-only command first: check before changing packages, firewall, SELinux policy, filesystems, or boot entries.56- Prefer reversible changes: runtime `firewall-cmd` before `--permanent`, config backups before edits, `dnf history undo` for package rollback.57- Include a no-reboot path when constraints prohibit reboot, but state when kernel, glibc, or SELinux policy changes require one for full validation.58- Use `dnf` for CentOS Stream and modern CentOS; use `yum` where the host is legacy and `dnf` is unavailable.5960## Output template6162````markdown63## CentOS triage result6465**Status:** diagnosed | remediated | blocked66**Host/release:** `<CentOS release or unknown>`67**Problem:** `<ProblemSummary>`68**Constraints:** `<Constraints or none stated>`6970### Summary71<one-paragraph diagnosis and risk statement>7273### Triage Steps741. `<read-only command>` — <evidence expected>752. `<read-only command>` — <evidence expected>7677### Remediation Commands78```bash79# backup or precheck80<command>81# change82<command>83```8485### Validation86```bash87<command proving the fix>88```8990### Rollback/Cleanup91- **Rollback/Cleanup**92```bash93<command to undo or clean up>94```95````9697## Quality gate9899- [ ] `${input:CentOSVersion}`, `${input:ProblemSummary}`, and `${input:Constraints}` were used or marked unknown.100- [ ] Release and environment assumptions were confirmed before remediation.101- [ ] Triage used `systemctl`, `journalctl`, `dnf`/`yum`, and relevant logs where applicable.102- [ ] SELinux and `firewalld` were considered when symptoms involve access, ports, or policy.103- [ ] Every major change includes validation and rollback or cleanup commands.104- [ ] Commands are copy-paste-ready and avoid destructive action without a precheck.
paulasilvatech