--- tags: - devops - l1 - flashcard-deck - legacy-systems --- [Portal](../../../../library/portal/index.md) | **Level:** [L1: Foundations](../../../../library/portal/levels.md) | **Topics:** [Legacy System Archaeology](../../../../library/portal/topics.md) | **Domain:** DevOps & Tooling id category difficulty tags question answer source_path legacy-systems/e376b4c7e545 legacy-systems easy legacy, archaeology, mindset What is the first rule of the archaeological approach when inheriting a legacy system? Observe what exists first — don't change anything yet. The previous team was not stupid; they were working with different constraints, solving different problems, under different time pressures, using the tools available at the time.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/223367d1af9e legacy-systems easy legacy, config, drift When Git says max_connections=100, the server says 500, and docs say 200, which is the real value? The server is real. Always. Git is what someone intended. The server is what's actually running. Common causes of drift include manual hotfixes during incidents, config management running a different branch, and environment variable overrides.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/0c2191a0b765 legacy-systems easy legacy, cron Why are cron jobs described as "the dark matter of infrastructure"? Cron jobs are the tribal knowledge of a system — nobody documents them, nobody remembers adding them, and they run silently until they break. They hold critical processes together and should be inventoried on day one when inheriting a system.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/50c876fabce3 legacy-systems medium legacy, survey, commands What commands should you run in the "First Day Survey" to understand an inherited system's purpose and network connections? For purpose: systemctl list-units --type=service --state=running. For network listeners: ss -tlnp (TCP) and ss -ulnp (UDP). For active connections: ss -tnp to see what's talking to what. Also check installed packages (rpm -qa or dpkg -l), cron jobs, and recently modified files in /etc.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/b632376f5986 legacy-systems medium legacy, config, reading What is the Config Reading Protocol for understanding configs you didn't write? Four steps: (1) Find the REAL config the process actually reads (check process cmdline, /proc/PID/cmdline). (2) Identify what was customized vs. default (rpm -V or dpkg -V). (3) Read for intent — comments are gold, look for TODO/HACK/FIXME and date-stamped comments. (4) Map config interdependencies — includes, environment variables, templates vs. rendered configs.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/56749f209fc3 legacy-systems medium legacy, dependencies, discovery Name four methods for tracing system dependencies when there is no documentation. (1) Network connections: ss -tnp shows TCP connections with process names. (2) DNS lookups: tcpdump port 53 reveals what hostnames the system resolves. (3) Filesystem reads: lsof -p PID shows open files, sockets, and libraries. (4) Environment variables: cat /proc/PID/environ reveals database URLs, API endpoints, and integration points.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/62a6b064211f legacy-systems medium legacy, tribal-knowledge What are three signs that critical knowledge is trapped as tribal knowledge rather than documented? (1) A README says "ask Dave about the deployment process" but Dave left 2 years ago. (2) A script references a path in a specific user's home directory as the canonical source. (3) "We always restart it on the first Monday of the month" but nobody knows why. Discovery technique: git log --all --format='%an' | sort | uniq -c | sort -rn to find who wrote the most code and whether they're still on the team.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/fb0d4e86fc78 legacy-systems hard legacy, systemd, dependencies How can you use systemd unit files to discover service dependencies and configuration sources? Run systemctl cat to see the full unit file. After=, Requires=, and Wants= directives reveal ordered dependencies. ExecStartPre= reveals setup steps that must run before the service. Environment= and EnvironmentFile= reveal configuration sources. You can also run systemd-analyze dot to generate a full dependency graph.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/1d57b6560c16 legacy-systems hard legacy, strace, config How do you use strace to find which config files a process actually reads at startup? Run strace -f -e openat to trace all file open calls. Filter out ENOENT (file not found) to see only files that were successfully opened. For a running process: strace -f -e openat -p PID. For nginx specifically: strace -f -e openat nginx -t 2>&1 | grep -v ENOENT. This reveals the real config files versus what you assume they are.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md legacy-systems/6640e9fa7a15 legacy-systems hard legacy, pitfalls, safety Why should you "disable before deleting" when decommissioning legacy components, and what is the recommended waiting period? If you don't understand what something does, you can't know it's unused. Disabling (rather than deleting) lets you observe whether anything breaks. Wait at least a month after disabling before deleting. Additionally, never change things before understanding them — observe for at least two weeks before making non-emergency changes to inherited systems.\n\nRemember: Modernization patterns: Strangler Fig (gradual), Big Bang (risky), Branch by Abstraction. training/library/topics/legacy-archaeology/primer.md --- ## Wiki Navigation ### Related Content - [Legacy System Archaeology](../../../../library/topics/legacy-archaeology/index.md) (Topic Pack, L1) — Legacy System Archaeology