Free tool

Linux Resilience Audit

A free, read-only script that checks a Linux server for the failure modes that most often take self-hosted sites and services down quietly, and gives a one-line fix for each finding.

• Read-only. It changes nothing, writes no files and makes no network connections.
• One file of plain Bash, about 300 lines. Read it before you run it.
• Open source under the MIT license, on GitHub.
• Tested before release on three real Linux servers and by an offline test suite.

Run it

curl -fsSLO https://raw.githubusercontent.com/guaridadeleones/recovernode-pub/main/resilience-audit/rn-resilience-audit.sh
less rn-resilience-audit.sh     # read it first
sudo bash rn-resilience-audit.sh

Without sudo, the checks that need root (certificates, the firewall and the kernel log) are reported as skipped. The exit code is 0 when everything passes, 1 for warnings and 2 for failures.

What it checks

• TLS: Let's Encrypt certificates used by a running nginx, Apache or HAProxy that expire within 21 days (warning) or 7 days (failure); no active renewal timer; renewals without a reload hook.
• Docker: Container ports published on all interfaces that bypass UFW unless filtered in DOCKER-USER; containers with no restart policy; Docker not enabled at boot.
• Disk: Filesystems at or above 80% or 90% space or inode use.
• Logs: Active log files over 100 MB or 1 GB that no logrotate rule covers; logrotate not scheduled.
• Memory: Kernel out-of-memory kills in the last 7 days.
• Services: Failed systemd services, services restarted automatically 3 or more times, and services that restart on failure with the start limit disabled.
• Reboot: A pending reboot after updates; firewall rules loaded but not restored at boot.
• DNS and time: Only one upstream DNS resolver; clock not NTP-synchronised.
• Watchdog: A hardware watchdog that is present but not used by systemd.

It does not check security hardening, backups, application health, or anything outside the machine it runs on.

Why these checks

These are the problems that tend to stay invisible until a site goes down: a renewal job that stopped months ago, a log that fills the disk, a container that never came back after a reboot. Each finding links to the matching guide, for example SSL certificate monitoring and systemd service monitoring. For problems outside the server itself, such as DNS delegation or stale DNS caches, see the case study on outages where every local check passed.