Posted on
• Artificial Intelligence

Artificial Intelligence Linux Troubleshooting Guide

Author
  • User
    linuxbash
    Posts by this author
    Posts by this author

Artificial Intelligence Linux Troubleshooting Guide

If you’ve ever burned an afternoon tailing logs and juggling five terminals just to find a single failing dependency, you know the pain: Linux troubleshooting is powerful—but noisy. What if you could turn that noise into fast, actionable insight? This guide shows how to pair classic Bash and Linux tools with a local AI model to summarize, prioritize, and suggest next steps—without sending your data to the cloud.

Value in 30 seconds:

  • Get repeatable snapshots of system state you can share or diff.

  • Let AI summarize mountains of logs and metrics into likely causes and fixes.

  • Keep everything local and private with a lightweight, on-device model.

Why AI belongs in your Linux toolbox

  • Speed: AI can digest 1,000+ lines of logs faster than any human, surfacing patterns and outliers first.

  • Breadth: It connects dots across kernel messages, IO waits, and failing services—so you don’t miss the forest for the trees.

  • Guidance: It proposes next commands and config checks, turning “Where do I start?” into a focused checklist.

  • Privacy: With a local model (e.g., Ollama), you keep sensitive logs on your machine.

Note: AI is a helper, not an oracle. Always validate with man pages and measurements.

Install the tools

We’ll use standard Linux tools for data collection and Ollama for a local LLM. Run the commands for your distro.

Debian/Ubuntu (apt):

sudo apt update
sudo apt install -y jq ripgrep sysstat strace lsof bpftrace tcpdump curl
# Optional but recommended for eBPF:
sudo apt install -y linux-headers-$(uname -r)
# Enable sysstat collection (for sar/iostat history)
sudo systemctl enable --now sysstat
# Install Ollama (local LLM runtime) and pull a model
curl -fsSL https://ollama.com/install.sh | sh
ollama pull llama3:latest

Fedora/RHEL/CentOS Stream (dnf):

sudo dnf install -y jq ripgrep sysstat strace lsof bpftrace tcpdump curl kernel-devel
sudo systemctl enable --now sysstat
curl -fsSL https://ollama.com/install.sh | sh
ollama pull llama3:latest

openSUSE (zypper):

sudo zypper refresh
sudo zypper install -y jq ripgrep sysstat strace lsof bpftrace tcpdump curl kernel-default-devel
sudo systemctl enable --now sysstat
curl -fsSL https://ollama.com/install.sh | sh
ollama pull llama3:latest

Tip: If bpftrace complains about headers, reboot into the latest kernel and ensure headers/devel are installed.

1) Capture a repeatable “AI-ready” snapshot

Before you ask an AI to help, collect consistent, high-signal data. This snapshot script gathers CPU, memory, disk, network, processes, and recent high-priority logs into one file.

cat > ~/ai-snapshot.sh <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
OUT="/tmp/ai-snapshot-$(hostname)-$(date +%F_%H%M%S).txt"

{
  echo "=== META ==="
  echo "Host: $(hostname -f 2>/dev/null || hostname)"
  echo "Kernel: $(uname -a)"
  echo "Uptime: $(uptime -p)"
  echo

  echo "=== TOP PROCESSES (CPU) ==="
  ps aux --sort=-%cpu | head -n 20
  echo

  echo "=== TOP PROCESSES (MEM) ==="
  ps aux --sort=-%mem | head -n 20
  echo

  echo "=== MEMORY ==="
  free -h
  echo
  vmstat 1 5
  echo

  echo "=== DISK (IOSTAT) ==="
  iostat -xz 2 3
  echo

  echo "=== FILE DESCRIPTORS / HOT FILES ==="
  lsof -n | head -n 50
  echo

  echo "=== NETWORK SOCKET SUMMARY ==="
  ss -s || true
  echo

  echo "=== RECENT CRITICAL LOGS (last 2h) ==="
  journalctl -p err..alert -S -2h --no-pager || true
  echo

  echo "=== KERNEL RING BUFFER (last 200) ==="
  dmesg | tail -n 200 || true
  echo
} > "$OUT"

echo "Wrote $OUT"
EOF

chmod +x ~/ai-snapshot.sh

Run it:

~/ai-snapshot.sh

Now you have a single artifact to scan or feed into a model.

2) Summarize logs and errors with a local LLM

Use Ollama to turn long logs into causes, fixes, and next steps. The trick: include clear instructions before the data and enforce a concise, actionable structure.

Example: Summarize recent critical logs

PROMPT='You are a Linux SRE. From the logs below, extract:

- Top 3 recurring errors and affected services

- Likely root causes (with reasoning)

- Concrete fixes (exact files/commands)

- 3 next diagnostic commands
Be concise but specific.'

{ printf "%s\n\n==== LOGS BEGIN ====\n" "$PROMPT"; journalctl -p err..alert -S -2h --no-pager; } \
  | ollama run llama3:latest

Example: Explain a failing service start

PROMPT='Analyze why this systemd unit fails to start. List root cause hypotheses, the most probable one, and exact remediation steps.'
{ printf "%s\n\n==== UNIT LOGS ====\n" "$PROMPT"; journalctl -u nginx --no-pager -n 500; } \
  | ollama run llama3:latest

Keep data local. You control what you pipe in.

3) Quantify resource bottlenecks (CPU, memory, disk) and let AI rank them

Measure first, then ask AI to interpret thresholds and patterns.

Disk saturation example:

iostat -xz 2 3 | tee /tmp/iostat.txt

Ask for interpretation:

PROMPT='From the iostat output, identify devices with queueing/saturation (util>70%, await>30ms, svctm rising). Explain likely root causes and propose 3 fixes (e.g., fs tuning, scheduler, moving workload).'
{ printf "%s\n\n==== IOSTAT ====\n" "$PROMPT"; cat /tmp/iostat.txt; } \
  | ollama run llama3:latest

CPU contention example:

sar -P ALL 2 5 | tee /tmp/sar_cpu.txt

PROMPT='From SAR CPU, detect steal%, iowait%, and per-core hotspots. Recommend next steps and exact commands to find top offenders.'
{ printf "%s\n\n==== SAR CPU ====\n" "$PROMPT"; cat /tmp/sar_cpu.txt; } \
  | ollama run llama3:latest

Memory pressure quick check:

vmstat 1 5 | tee /tmp/vmstat.txt

PROMPT='Interpret vmstat: are we swapping, thrashing, or blocked on IO? Provide fixes and validation commands.'
{ printf "%s\n\n==== VMSTAT ====\n" "$PROMPT"; cat /tmp/vmstat.txt; } \
  | ollama run llama3:latest

4) Network triage in minutes

Catch symptoms quickly (timeouts, retransmits, handshake failures) and let AI highlight patterns and endpoints.

Capture a small, safe sample (exclude SSH to avoid clutter):

sudo tcpdump -i any -nn -s 0 -c 200 tcp and not port 22 -tttt -vv | tee /tmp/tcpdump.txt

Summarize:

PROMPT='From the tcpdump lines, identify: retransmissions, RST storms, SYN backlog issues, MTU/fragmentation hints, and top talkers. Suggest exact validation commands (ss, sysctl checks) and likely fixes.'
{ printf "%s\n\n==== TCPDUMP ====\n" "$PROMPT"; cat /tmp/tcpdump.txt; } \
  | ollama run llama3:latest

Bonus: If a process hangs on network IO, attach strace briefly:

sudo strace -tt -f -o /tmp/strace.log -s 200 -p <PID> -e trace=network -f -qq -r -T

Then:

PROMPT='Explain the probable cause of network stalls from this strace (DNS? connect timeout? TLS handshake?), and list mitigations.'
{ printf "%s\n\n==== STRACE ====\n" "$PROMPT"; head -n 800 /tmp/strace.log; } \
  | ollama run llama3:latest

5) Add a reusable Bash helper to “AI-annotate” any command

Drop these helpers into your shell to get instant explanations for any output.

cat >> ~/.bashrc <<'EOF'
# Default model (change if you like)
export AI_MODEL="${AI_MODEL:-llama3:latest}"

# Pipe data into: ai "your task description"
ai() {
  local prompt="${1:-Explain this like a Linux SRE and propose next 3 commands.}"
  if [ -t 0 ]; then
    echo "Usage: some_command | ai 'task description'" >&2
    return 2
  fi
  { printf "TASK:\n%s\n\nDATA:\n" "$prompt"; cat; } | ollama run "$AI_MODEL"
}

# Quick alias for "explain what I’m seeing and what to do next"
explain() {
  ai "Explain what this output indicates, likely root causes, and 3 concrete next diagnostic commands (with flags)."
}
EOF

# Reload your shell
source ~/.bashrc

Examples:

journalctl -u postgresql -n 500 --no-pager | explain
iostat -xz 2 3 | ai "Spot disk saturation and suggest fs/block-level tunings."
lsof -p $(pgrep -f myapp) | ai "What is this process waiting on? Any fd leaks?"

Real-world mini-scenario

Symptom: “API latency spikes every few minutes.”

  • Snapshot shows high iowait and journal errors about writeback.

  • iostat reveals nvme0n1 await>80ms and util ~95% during spikes.

  • AI summary suggests WAL/fsync amplification and recommends:

    • Move logs/WAL to different device or tmpfs for bursts.
    • Tune mount options (e.g., noatime) and elevator/scheduler.
    • Add/resize a write-back cache or adjust queue depths.

  • Validation commands proposed:

    • iostat -xz 1, lsblk -o NAME,SCHED, cat /sys/block/nvme0n1/queue/*, pidstat -dlru -p <pid> 1.

Within an hour you’ve got measurements, a ranked hypothesis, and concrete next steps.

Conclusion and next steps

AI won’t replace your Bash chops—it amplifies them. The win comes from:

  • Collecting the right signals fast.

  • Asking specific, structured questions.

  • Keeping the loop local, private, and repeatable.

Call to action:

  • Install the toolchain (sysstat, strace, lsof, bpftrace, tcpdump, Ollama).

  • Add the snapshot script and ai/explain helpers to your shell.

  • The next time something’s slow or failing, capture, summarize, act—then iterate.

Have a favorite prompt or one-liner that saved your weekend? Share it with your team and bake it into your snapshot flow.

Related posts