Notes

Monitoring

Logs are only useful when the signal is small. We keep a one-line-per-run health log, a digest every hour, and a separate alert file that stays empty on a good day. If an alert repeats itself, the rule is wrong, not the system.

Backups

Each night: archive, checksum, off-site copy, restore test on a spare machine. The restore test is the only part that matters; without it the rest is paperwork. Keep the recovery note inside the archive so it travels with the data.

TLS and names

A certificate is a promise that the name you typed belongs to the host that answers. When a host moves, every name in the SAN list has to move with it — otherwise renewal fails quietly, two months later.

Networking

Two rules save most of the debugging time: check the path before blaming the application, and record packets before changing configuration. A blocked address looks exactly like a broken client until you look at what actually arrives.