grubby --default-kernelShows which kernel will boot next, before you reboot. Check it after every kernel install, not after the reboot that went wrong.
Field notes from 30+ years running Unix and Linux in production — from VAX/VMS and Solaris to RHEL fleets and cloud, where downtime was never an option. Written for senior engineers who run production systems. More about unixshadow →
Test everything in dev or a lab first. These are field notes from my systems, not a runbook for yours — you’re responsible for what you run on your own.
systemctl, loginctl, journalctl, hostnamectl, timedatectl, localectl, systemd-analyze, resolvectl, networkctl, coredumpctl, busctl — the whole *ctl family, in proportion to how much you will actually use each one.
What happens between typing sudo and getting a root shell: the setuid bit, PAM authentication, sudoers parsing, and why sudo -l matters.
OpenAI ran an autonomous pipeline over 7% of the Linux kernel and found 948 distinct privilege escalation flaws, each with a working exploit, for $1.2M in API credits.
A patching process that survives audit: rings that earn production, fixed windows, one Ansible playbook for a mixed fleet, pins with an owner and an expiry date, and a record that proves it happened.
Ubuntu LTS patching runs on apt and unattended-upgrades with no security-only flag, plus Canonical Livepatch for Critical and High kernel CVEs — and the current LTS is 26.04, not the next one.
Oracle Linux patches like RHEL until you hit the two things that make it different: the Unbreakable Enterprise Kernel and Ksplice live patching for the kernel and user space.