Fedora Linux triage
Diagnose a Fedora problem report, transform release and constraint details into a Fedora-appropriate triage plan, and return copy-paste-ready remediation, validation, and rollback commands.
When to invoke
- "Triage this Fedora service failure."
- "Fix a Fedora dnf package problem."
- "Why is SELinux blocking this on Fedora?"
- "Debug Fedora firewalld or networking."
- "Give me Fedora remediation commands with rollback."
Request facts to capture
Preserve these original inputs when they are supplied by the caller: ${input:FedoraRelease}, ${input:ProblemSummary}, and ${input:Constraints}. If they are absent, collect equivalent facts before changing the system.
| Fact |
How to collect |
Why it matters |
| Release |
cat /etc/fedora-release; cat /etc/os-release; rpm -E %fedora |
Fedora changes quickly; release age affects repositories and upgrade path. |
| Package history |
dnf history list; dnf history info last; `rpm -qa --last |
head` |
| Failing unit |
systemctl status <unit> --no-pager; journalctl -u <unit> -b --no-pager |
Shows service exit code, dependency failure, port conflict, or policy denial. |
| Security state |
getenforce; ausearch -m AVC,USER_AVC -ts recent |
SELinux denials are common and should be fixed narrowly. |
| Firewall state |
firewall-cmd --state; firewall-cmd --list-all; firewall-cmd --get-active-zones |
firewalld runtime/permanent mismatches are common. |
| Constraints |
no reboot, no upgrade, production host, offline host |
Determines whether to restart, reboot, downgrade, or only gather evidence. |
A step-by-step triage plan should still stay conservative and reversible.
Triage command map
| Symptom |
First commands |
Evidence to read |
| Service failed |
systemctl status <unit> --no-pager; journalctl -u <unit> -b --no-pager |
Exit status, config parse failure, denied resource, missing dependency. |
| DNF issue |
dnf check; dnf repolist; dnf history list; dnf repoquery --unsatisfied |
Broken deps, disabled repos, third-party repo drift. |
| SELinux denial |
getenforce; ausearch -m AVC,USER_AVC -ts recent; sealert -a /var/log/audit/audit.log if available |
Denied class, source context, target path, suggested boolean or labeling fix. |
| firewalld block |
firewall-cmd --list-all; ss -tulpn; external connection test |
Service listening versus firewall exposure. |
| Boot/kernel issue |
journalctl -b -p warning --no-pager; uname -r; rpm -q kernel-core |
Kernel mismatch, initramfs, driver, failed mount. |
| Release upgrade residue |
dnf system-upgrade log --number=-1; dnf distro-sync planning |
Incomplete upgrade or package set drift. |
Remediation patterns
| Problem |
Preferred fix |
Avoid |
| Failed service after config change |
Run daemon config validation, then systemctl restart <unit> and inspect status. |
Restarting repeatedly without reading journal evidence. |
| Package drift |
Use dnf distro-sync after reviewing the transaction; use dnf history undo <ID> for specific reversible changes. |
Mixing incompatible third-party repos without pinning or review. |
| SELinux label issue |
restorecon -Rv <path> or correct file context with semanage fcontext then restorecon. |
Permanent setenforce 0. |
| SELinux boolean needed |
`getsebool -a |
grep thensetsebool -P on` only when it matches the service design. |
| firewalld rule missing |
Test with runtime firewall-cmd --add-service=<service>, validate, then apply --permanent and --reload. |
Editing nftables/iptables behind firewalld. |
| Kernel update pending |
Validate installed kernels and reboot into the target kernel when constraints allow. |
Troubleshooting drivers against an old running kernel after updating packages. |
Safety rules
- Prefer read-only evidence before package, firewall, SELinux, or boot changes.
- Treat SELinux as part of the diagnosis, not an obstacle to disable; fix labels, booleans, or narrow policy.
- Call out reboot requirements for kernel, glibc, systemd, firmware, and driver updates.
- Include rollback through
dnf history undo, config backup restore, firewalld runtime removal, or SELinux context reversal where possible.
Output template
## Fedora triage result
**Status:** diagnosed | remediated | blocked
**Release:** `<FedoraRelease or collected release>`
**Problem:** `<ProblemSummary>`
**Constraints:** `<Constraints or none stated>`
### Summary
<one-paragraph diagnosis and risk statement>
### Triage Steps
1. `<read-only command>` — <evidence expected>
2. `<read-only command>` — <evidence expected>
### Remediation Commands
```bash
# backup or precheck
<command>
# change
<command>
```
### Validation
```bash
<command proving the fix>
```
### Rollback/Cleanup
- **Rollback/Cleanup**
```bash
<command to undo or clean up>
```
Quality gate
1---2name: fedora-linux-triage-33description: Diagnose and remediate Fedora Linux incidents with dnf, systemd, journal analysis, SELinux, firewalld, release-upgrade awareness, and rollback practices. Use when the user asks to triage Fedora service failures, package issues, boot problems, network/firewall symptoms, or SELinux denials.4---56<!-- Generated from harness/github-copilot/plugins/linux-operations/skills/fedora-linux-triage/SKILL.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->78# Fedora Linux triage910Diagnose a Fedora problem report, transform release and constraint details into a Fedora-appropriate triage plan, and return copy-paste-ready remediation, validation, and rollback commands.1112## When to invoke1314- "Triage this Fedora service failure."15- "Fix a Fedora dnf package problem."16- "Why is SELinux blocking this on Fedora?"17- "Debug Fedora firewalld or networking."18- "Give me Fedora remediation commands with rollback."1920## Request facts to capture2122Preserve these original inputs when they are supplied by the caller: `${input:FedoraRelease}`, `${input:ProblemSummary}`, and `${input:Constraints}`. If they are absent, collect equivalent facts before changing the system.2324| Fact | How to collect | Why it matters |25| --- | --- | --- |26| Release | `cat /etc/fedora-release`; `cat /etc/os-release`; `rpm -E %fedora` | Fedora changes quickly; release age affects repositories and upgrade path. |27| Package history | `dnf history list`; `dnf history info last`; `rpm -qa --last | head` | Recent upgrades, removals, and repo changes explain many failures. |28| Failing unit | `systemctl status <unit> --no-pager`; `journalctl -u <unit> -b --no-pager` | Shows service exit code, dependency failure, port conflict, or policy denial. |29| Security state | `getenforce`; `ausearch -m AVC,USER_AVC -ts recent` | SELinux denials are common and should be fixed narrowly. |30| Firewall state | `firewall-cmd --state`; `firewall-cmd --list-all`; `firewall-cmd --get-active-zones` | firewalld runtime/permanent mismatches are common. |31| Constraints | no reboot, no upgrade, production host, offline host | Determines whether to restart, reboot, downgrade, or only gather evidence. |3233A step-by-step triage plan should still stay conservative and reversible.3435## Triage command map3637| Symptom | First commands | Evidence to read |38| --- | --- | --- |39| Service failed | `systemctl status <unit> --no-pager`; `journalctl -u <unit> -b --no-pager` | Exit status, config parse failure, denied resource, missing dependency. |40| DNF issue | `dnf check`; `dnf repolist`; `dnf history list`; `dnf repoquery --unsatisfied` | Broken deps, disabled repos, third-party repo drift. |41| SELinux denial | `getenforce`; `ausearch -m AVC,USER_AVC -ts recent`; `sealert -a /var/log/audit/audit.log` if available | Denied class, source context, target path, suggested boolean or labeling fix. |42| firewalld block | `firewall-cmd --list-all`; `ss -tulpn`; external connection test | Service listening versus firewall exposure. |43| Boot/kernel issue | `journalctl -b -p warning --no-pager`; `uname -r`; `rpm -q kernel-core` | Kernel mismatch, initramfs, driver, failed mount. |44| Release upgrade residue | `dnf system-upgrade log --number=-1`; `dnf distro-sync` planning | Incomplete upgrade or package set drift. |4546## Remediation patterns4748| Problem | Preferred fix | Avoid |49| --- | --- | --- |50| Failed service after config change | Run daemon config validation, then `systemctl restart <unit>` and inspect status. | Restarting repeatedly without reading journal evidence. |51| Package drift | Use `dnf distro-sync` after reviewing the transaction; use `dnf history undo <ID>` for specific reversible changes. | Mixing incompatible third-party repos without pinning or review. |52| SELinux label issue | `restorecon -Rv <path>` or correct file context with `semanage fcontext` then `restorecon`. | Permanent `setenforce 0`. |53| SELinux boolean needed | `getsebool -a | grep <topic>` then `setsebool -P <boolean> on` only when it matches the service design. | Generating broad local policy before checking booleans and labels. |54| firewalld rule missing | Test with runtime `firewall-cmd --add-service=<service>`, validate, then apply `--permanent` and `--reload`. | Editing nftables/iptables behind firewalld. |55| Kernel update pending | Validate installed kernels and reboot into the target kernel when constraints allow. | Troubleshooting drivers against an old running kernel after updating packages. |5657## Safety rules5859- Prefer read-only evidence before package, firewall, SELinux, or boot changes.60- Treat SELinux as part of the diagnosis, not an obstacle to disable; fix labels, booleans, or narrow policy.61- Call out reboot requirements for kernel, glibc, systemd, firmware, and driver updates.62- Include rollback through `dnf history undo`, config backup restore, firewalld runtime removal, or SELinux context reversal where possible.6364## Output template6566````markdown67## Fedora triage result6869**Status:** diagnosed | remediated | blocked70**Release:** `<FedoraRelease or collected release>`71**Problem:** `<ProblemSummary>`72**Constraints:** `<Constraints or none stated>`7374### Summary75<one-paragraph diagnosis and risk statement>7677### Triage Steps781. `<read-only command>` — <evidence expected>792. `<read-only command>` — <evidence expected>8081### Remediation Commands82```bash83# backup or precheck84<command>85# change86<command>87```8889### Validation90```bash91<command proving the fix>92```9394### Rollback/Cleanup95- **Rollback/Cleanup**96```bash97<command to undo or clean up>98```99````100101## Quality gate102103- [ ] `${input:FedoraRelease}`, `${input:ProblemSummary}`, and `${input:Constraints}` were used or marked unknown.104- [ ] Release and environment assumptions were confirmed before remediation.105- [ ] Triage used `systemctl`, `journalctl`, and `dnf` where applicable.106- [ ] SELinux and `firewalld` were considered when symptoms involve access, ports, or policy.107- [ ] Every major change includes validation and rollback or cleanup commands.108- [ ] Commands are copy-paste-ready and avoid destructive action without a precheck.
paulasilvatech