Debian Linux triage
Diagnose a Debian problem report, transform release and constraint details into a conservative apt/dpkg triage plan, and return copy-paste-ready remediation, validation, and rollback commands.
When to invoke
- "Triage this Debian service failure."
- "Fix a Debian apt or dpkg problem."
- "Why is AppArmor blocking this process on Debian?"
- "Debug networking or firewall behavior on Debian."
- "Give me Debian remediation commands with rollback."
Request facts to capture
Preserve these original inputs when they are supplied by the caller: ${input:DebianRelease}, ${input:ProblemSummary}, and ${input:Constraints}. Ask concise follow-ups only when the missing fact changes the safety of the fix.
| Fact |
How to collect |
Why it matters |
| Release |
cat /etc/debian_version; cat /etc/os-release; lsb_release -a 2>/dev/null |
Stable, testing, and oldstable differ in repositories and support. |
| Package state |
apt-cache policy <package>; `dpkg -l |
grep '^..r'; sudo dpkg --audit` |
| Failing unit |
systemctl status <unit> --no-pager; journalctl -u <unit> -b --no-pager |
Distinguishes service, dependency, config, and permission failures. |
| Security profile |
aa-status; journalctl -k -g DENIED --no-pager |
AppArmor denials can look like application bugs. |
| Firewall |
nft list ruleset; ufw status verbose when UFW is installed |
Debian hosts may use nftables directly or UFW as a frontend. |
| Constraints |
no reboot, pinned packages, production host, no network |
Determines whether to restart, reinstall, unhold, or only gather evidence. |
A step-by-step triage plan should still stay conservative and reversible.
Triage command map
| Symptom |
First commands |
Evidence to read |
| Service failed |
systemctl status <unit> --no-pager; journalctl -u <unit> -b --no-pager |
Exit code, config parse error, dependency, denied file or port. |
| Apt failure |
sudo apt update; sudo apt -f install; sudo dpkg --configure -a after reading the error |
Repository mismatch, held package, interrupted configure step. |
| Package ownership |
dpkg -S <path>; dpkg -L <package> |
Confirms which package owns or should provide a file. |
| Boot issue |
journalctl -b -p warning --no-pager; systemctl --failed; findmnt --verify |
Failed mounts, missing firmware, unit ordering. |
| Network path |
ip addr; ip route; resolvectl status; ss -tulpn |
Addressing, routing, resolver, listener. |
| AppArmor denial |
aa-status; `journalctl -k --since -1h |
grep -i apparmor` |
Remediation patterns
| Problem |
Preferred fix |
Avoid |
| Interrupted package configuration |
sudo dpkg --configure -a, then sudo apt -f install if dependencies remain broken. |
Removing /var/lib/dpkg/ metadata. |
| Wrong or missing package |
sudo apt install --reinstall <package> after checking apt-cache policy. |
Installing random .deb files without source and dependency review. |
| Held package blocks upgrade |
apt-mark showhold; unhold only the intended package with sudo apt-mark unhold <package>. |
Blanket unhold of all packages. |
| AppArmor false block |
Switch a specific profile to complain mode for diagnosis with aa-complain <profile>, then update policy or restore enforce mode. |
Disabling AppArmor globally as a permanent fix. |
| Firewall missing port |
Add a narrow UFW/nftables rule and verify with ss -tulpn plus an external connection test. |
Opening broad port ranges without a service reason. |
| Service config error |
Run the daemon's config test before restart, then systemctl restart <unit>. |
Editing and restarting without syntax validation. |
Safety rules
- Prefer
apt for interactive remediation and apt-get for scripts; use dpkg only for package database operations that apt cannot complete.
- Check
/etc/apt/sources.list and /etc/apt/sources.list.d/*.list before changing repository-related failures.
- Include reboot guidance when kernel, libc, systemd, firmware, or low-level security components changed.
- Keep rollback realistic: package reinstall, config backup restore,
apt-mark hold, or service restart; do not promise impossible downgrades without available repositories.
Output template
## Debian triage result
**Status:** diagnosed | remediated | blocked
**Release:** `<DebianRelease or collected release>`
**Problem:** `<ProblemSummary>`
**Constraints:** `<Constraints or none stated>`
### Summary
<one-paragraph diagnosis and risk statement>
### Triage Steps
1. `<read-only command>` — <evidence expected>
2. `<read-only command>` — <evidence expected>
### Remediation Commands
```bash
# backup or precheck
<command>
# change
<command>
```
### Validation
```bash
<command proving the fix>
```
### Rollback/Cleanup
- **Rollback/Cleanup**
```bash
<command to undo or clean up>
```
Quality gate
1---2name: debian-linux-triage3description: Diagnose and remediate Debian Linux incidents with apt, dpkg, systemd, journal analysis, AppArmor-aware checks, firewall review, and rollback practices. Use when the user asks to triage Debian service failures, package issues, boot problems, network symptoms, or security-profile denials.4---56<!-- Generated from harness/github-copilot/skills/debian-linux-triage/SKILL.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->78# Debian Linux triage910Diagnose a Debian problem report, transform release and constraint details into a conservative apt/dpkg triage plan, and return copy-paste-ready remediation, validation, and rollback commands.1112## When to invoke1314- "Triage this Debian service failure."15- "Fix a Debian apt or dpkg problem."16- "Why is AppArmor blocking this process on Debian?"17- "Debug networking or firewall behavior on Debian."18- "Give me Debian remediation commands with rollback."1920## Request facts to capture2122Preserve these original inputs when they are supplied by the caller: `${input:DebianRelease}`, `${input:ProblemSummary}`, and `${input:Constraints}`. Ask concise follow-ups only when the missing fact changes the safety of the fix.2324| Fact | How to collect | Why it matters |25| --- | --- | --- |26| Release | `cat /etc/debian_version`; `cat /etc/os-release`; `lsb_release -a 2>/dev/null` | Stable, testing, and oldstable differ in repositories and support. |27| Package state | `apt-cache policy <package>`; `dpkg -l | grep '^..r'`; `sudo dpkg --audit` | Finds held, half-configured, removed-but-configured, and dependency-broken packages. |28| Failing unit | `systemctl status <unit> --no-pager`; `journalctl -u <unit> -b --no-pager` | Distinguishes service, dependency, config, and permission failures. |29| Security profile | `aa-status`; `journalctl -k -g DENIED --no-pager` | AppArmor denials can look like application bugs. |30| Firewall | `nft list ruleset`; `ufw status verbose` when UFW is installed | Debian hosts may use nftables directly or UFW as a frontend. |31| Constraints | no reboot, pinned packages, production host, no network | Determines whether to restart, reinstall, unhold, or only gather evidence. |3233A step-by-step triage plan should still stay conservative and reversible.3435## Triage command map3637| Symptom | First commands | Evidence to read |38| --- | --- | --- |39| Service failed | `systemctl status <unit> --no-pager`; `journalctl -u <unit> -b --no-pager` | Exit code, config parse error, dependency, denied file or port. |40| Apt failure | `sudo apt update`; `sudo apt -f install`; `sudo dpkg --configure -a` after reading the error | Repository mismatch, held package, interrupted configure step. |41| Package ownership | `dpkg -S <path>`; `dpkg -L <package>` | Confirms which package owns or should provide a file. |42| Boot issue | `journalctl -b -p warning --no-pager`; `systemctl --failed`; `findmnt --verify` | Failed mounts, missing firmware, unit ordering. |43| Network path | `ip addr`; `ip route`; `resolvectl status`; `ss -tulpn` | Addressing, routing, resolver, listener. |44| AppArmor denial | `aa-status`; `journalctl -k --since -1h | grep -i apparmor` | Profile enforce/complain mode and denied operation. |4546## Remediation patterns4748| Problem | Preferred fix | Avoid |49| --- | --- | --- |50| Interrupted package configuration | `sudo dpkg --configure -a`, then `sudo apt -f install` if dependencies remain broken. | Removing `/var/lib/dpkg/` metadata. |51| Wrong or missing package | `sudo apt install --reinstall <package>` after checking `apt-cache policy`. | Installing random `.deb` files without source and dependency review. |52| Held package blocks upgrade | `apt-mark showhold`; unhold only the intended package with `sudo apt-mark unhold <package>`. | Blanket unhold of all packages. |53| AppArmor false block | Switch a specific profile to complain mode for diagnosis with `aa-complain <profile>`, then update policy or restore enforce mode. | Disabling AppArmor globally as a permanent fix. |54| Firewall missing port | Add a narrow UFW/nftables rule and verify with `ss -tulpn` plus an external connection test. | Opening broad port ranges without a service reason. |55| Service config error | Run the daemon's config test before restart, then `systemctl restart <unit>`. | Editing and restarting without syntax validation. |5657## Safety rules5859- Prefer `apt` for interactive remediation and `apt-get` for scripts; use `dpkg` only for package database operations that apt cannot complete.60- Check `/etc/apt/sources.list` and `/etc/apt/sources.list.d/*.list` before changing repository-related failures.61- Include reboot guidance when kernel, libc, systemd, firmware, or low-level security components changed.62- Keep rollback realistic: package reinstall, config backup restore, `apt-mark hold`, or service restart; do not promise impossible downgrades without available repositories.6364## Output template6566````markdown67## Debian triage result6869**Status:** diagnosed | remediated | blocked70**Release:** `<DebianRelease or collected release>`71**Problem:** `<ProblemSummary>`72**Constraints:** `<Constraints or none stated>`7374### Summary75<one-paragraph diagnosis and risk statement>7677### Triage Steps781. `<read-only command>` — <evidence expected>792. `<read-only command>` — <evidence expected>8081### Remediation Commands82```bash83# backup or precheck84<command>85# change86<command>87```8889### Validation90```bash91<command proving the fix>92```9394### Rollback/Cleanup95- **Rollback/Cleanup**96```bash97<command to undo or clean up>98```99````100101## Quality gate102103- [ ] `${input:DebianRelease}`, `${input:ProblemSummary}`, and `${input:Constraints}` were used or marked unknown.104- [ ] Release and environment assumptions were confirmed before remediation.105- [ ] Triage used `systemctl`, `journalctl`, `apt`, and `dpkg` where applicable.106- [ ] AppArmor or firewall considerations were addressed when symptoms involve access, ports, or policy.107- [ ] Every major change includes validation and rollback or cleanup commands.108- [ ] Commands are copy-paste-ready and avoid destructive package database changes.
paulasilvatech