Linux Incident Response: What to Capture Before Restarting
A service is down. Someone suggests restarting it. That may restore service, but it can also erase clues about why it failed. In the first few minutes, collect a small, safe evidence snapshot before c

