💬 Prompt Cheat Sheet for Sysadmins

Prompt Cheat Sheet for Sysadmins

Ready-to-paste prompts for everyday operations work: reading logs, explaining errors, reviewing configs, writing scripts
and one-liners, security checks, incident write-ups and documentation. Replace the [BRACKETS] with your details.
They work with any capable AI (Claude, ChatGPT, Gemini, Perplexity, or a local model through Ollama).
The more context you give, the better the answer you get.

Remove secrets and personal data first. Never paste passwords, API keys, private keys, tokens or customer data into a hosted AI.
sed -E 's/(password|passwd|secret|token|apikey|api_key)[=: ]+[^ ]+/\1=REDACTED/Ig' file.log      # hide credentials
sed -E 's/[0-9]{1,3}(\.[0-9]{1,3}){3}/x.x.x.x/g' file.log                                         # hide IP addresses
sed -E 's/[[:alnum:]._%+-]+@[[:alnum:].-]+\.[a-z]{2,}/user@example.com/g' file.log                # hide email addresses
Read the result before you paste it. For sensitive material, use a local model (Ollama) so nothing leaves your machine.

1. Role        "You are a senior Linux sysadmin."
2. Context     OS and version, what the system does, what changed, what you already tried
3. The data    The real error, log lines or config (redacted), not a description of it
4. The task    Exactly what you want: diagnose, explain, review, write, compare
5. The format  "Numbered steps", "a table", "commands first, then a short explanation", "do not rewrite my file, list changes"
Optional extras: constraints ("no reboot", "no downtime", "only tools in a default install"), audience ("explain to a junior admin"),
and safety ("warn me about anything destructive and give me a rollback").

A good "system prompt" to start every session
You are a careful senior Linux systems administrator and site reliability engineer.
Rules: (1) Ask me for missing details before guessing. (2) Put the exact commands first, then a short explanation.
(3) Mark any command that changes or deletes data with WARNING and give a way to test it or roll it back.
(4) Prefer standard tools that ship with the OS. (5) If you are not sure a flag or option exists, say so and tell me how to
check with --help or man. (6) State your confidence and what could make you wrong. Environment: [distribution and version, shell].

"Here are log lines from [service] on [OS]. Summarize what happened in order, identify the first error (the likely root cause),
separate symptoms from causes, and list the three most likely explanations with the command to confirm each. [PASTE LOG]"
"Group these log lines by type, count each, and show the top 5 error messages. Ignore routine noise such as health checks. [PASTE LOG]"
"Read this auth.log excerpt. Are there signs of brute-force attempts, unusual logins or privilege escalation? List the suspicious lines and why. [PASTE]"
"Explain this nginx (or Apache) error log entry in plain English and tell me how to fix it: [PASTE]"
"Turn these journalctl lines into a timeline with timestamps, and mark where the service started failing. [PASTE]"
"What is the difference between these two log excerpts (working and failing)? List each meaningful change. [PASTE A] [PASTE B]"
"Write a grep/awk/sed pipeline to extract [the thing] from logs that look like this: [SAMPLE LINES]. Explain each part and show the expected output."
"Suggest what to monitor and which alert thresholds to set, based on these logs. [PASTE]"

"I get this error: [PASTE ERROR]. Environment: [OS, version, what I ran]. List likely causes from most to least common, and for each give
one command to check and one to fix. Ask me questions if you need more information."
"This service will not start. Here is systemctl status and journalctl -u [name] -n 50: [PASTE]. What is wrong and what should I try first?"
"Give me a step-by-step troubleshooting checklist for '[symptom]' on [system]. Order the steps from quickest and safest to slowest and most invasive."
"It worked yesterday and stopped today. Here is what changed: [LIST]. What is the most likely link between the change and the failure?"
"Explain this error like I am new to it, then give the fix: [PASTE ERROR]"
"Give me a decision tree for diagnosing high load average on Linux, with the commands to run at each step."
"What are 5 possible reasons for [problem] that I have NOT thought of, given that I already checked [LIST]?"

"Review this [nginx / sshd_config / postfix main.cf / haproxy] configuration for mistakes, security problems and performance issues.
List each finding with the line, why it matters, and the fix. Do not rewrite the whole file. [PASTE CONFIG]"
"Write a minimal [service] configuration for: [requirements]. Explain every directive and how to test it (for example nginx -t) before reloading."
"Explain what each line of this config does: [PASTE]"
"Harden this sshd_config for a server that only needs key-based login from [network]. Show a diff and explain the risk of each change."
"Write a systemd unit file for [program] that runs as user [x], restarts on failure, waits for the network and has basic sandboxing. Explain each option."
"Create a logrotate configuration for [path] that keeps 14 days, compresses, and reloads [service]. How do I test it?"
"Write a cron entry (and a systemd timer alternative) to run [job] every [schedule]. Include logging and locking to prevent overlap."
"Compare these two configs and list every difference that could change behavior. [PASTE A] [PASTE B]"
"Convert this Apache config to nginx, and point out anything that does not translate exactly. [PASTE]"

"Write a bash script that [task]. Requirements: set -Eeuo pipefail, quote all variables, a --dry-run option, usage text, clear errors and logging.
First give a numbered plan and wait for my go-ahead." (See the AI-Assisted Shell Scripting guide for the full workflow.)
"Write a one-liner using [awk/sed/find/jq] to [task]. Input looks like: [SAMPLE]. Show the expected output and explain each part."
"Explain this command in detail, flag by flag, and warn me about anything dangerous: [PASTE COMMAND]"
"Rewrite this one-liner as a readable, commented script: [PASTE]"
"Find bugs and unsafe patterns in this script. List problems with line numbers. Do not rewrite it. [PASTE SCRIPT]"
"Write a regular expression that matches [description]. Give 5 strings that should match and 5 that should not, and explain the pattern."
"Give me the find command to locate [files] older than [n] days and larger than [size], and the safe way to delete them (print first)."
"Convert this Bash script to Python (or fish), keeping the behavior the same, and point out differences. [PASTE]"

"Review this list of listening ports (ss -tulpn output) and installed services. Which are unnecessary for a [role] server, and how do I close them? [PASTE]"
"Check this sudoers file for risky rules and privilege-escalation paths. [PASTE]"
"Create a hardening checklist for a fresh [Ubuntu 24.04] server that will run [role]. Group it by priority, with the commands to apply and verify each item."
"Review this firewall ruleset (ufw status verbose or nft list ruleset). What is exposed that should not be? Is anything missing? [PASTE]"
"Here is the output of an nmap scan of my own server. Which findings matter most and what should I do about each? [PASTE]"
"Explain this CVE and tell me whether it affects [package and version]. What is the mitigation if I cannot patch today? [CVE ID]" (then verify at the vendor's advisory)
"List the file permission and ownership problems in this output. [PASTE ls -la or find output]"
"Write a short incident checklist for a suspected compromised Linux server: what to check, what to preserve, and what NOT to do."
"Help me write a password and SSH-key policy for a team of [n] admins."

"Explain this tcpdump output. What is the conversation, is the TCP handshake completing, and where does it fail? [PASTE]"
"Here are ip addr, ip route and resolv.conf for a server that cannot reach the internet. What is wrong? [PASTE]"
"Interpret this traceroute or mtr output. Where is the delay or loss, and is it likely on my side or the provider's? [PASTE]"
"Write ufw (or nftables) rules that allow [ports] from [subnets] and deny everything else. Explain how to apply them without locking myself out."
"Explain the difference between DNAT, SNAT and masquerade with a simple example for my setup: [describe]."
"Give me a step-by-step plan to tell 'connection timed out' from 'connection refused' when connecting to [host:port]."
"Design a subnet plan for [n] servers across [n] VLANs using 10.0.0.0/16. Show a table."

"Interpret this output from top, vmstat, iostat and free -h. What is the bottleneck (CPU, memory, disk or network) and what should I check next? [PASTE]"
"This server's load average is [x] on [n] cores. Here are the process list and iostat: [PASTE]. What is the likely cause?"
"Suggest sysctl and kernel settings to tune for [workload: web server, database, file server]. Explain each and the risk of changing it."
"Estimate how much RAM and CPU I need for [workload] with [number] users. State your assumptions."
"Here is my slow-query log excerpt. Which queries should I optimize first, and how? [PASTE]"
"Explain this EXPLAIN (or EXPLAIN ANALYZE) output. What is slow, and which index would help? [PASTE QUERY AND PLAN]"

"Explain this lsblk, df -h and mount output, and find out why the disk shows full when du disagrees. [PASTE]"
"Design a backup plan for [system] with an RPO of [x] and an RTO of [y]. Include the tools, schedule, retention, and how to test restores."
"Review this backup script for problems: missing verification, no error handling, retention bugs, credentials in the script. [PASTE]"
"Give me the exact steps to grow an LVM volume and its filesystem online, with a check after every step."
"Write a MySQL (or PostgreSQL) backup and restore procedure with cron, compression, retention and a restore test. Explain each command."
"Explain this replication error and how to fix it safely without losing data: [PASTE SHOW REPLICA STATUS output]"

"Here are kubectl describe pod and the last logs. Why is this pod in [CrashLoopBackOff / Pending / ImagePullBackOff]? Give the fix. [PASTE]"
"Review this Dockerfile for size, security and caching problems. List changes in priority order. [PASTE]"
"Review this Kubernetes manifest for missing requests and limits, probes, security context and other best-practice issues. [PASTE]"
"Explain this terraform plan in plain English. Which resources will be destroyed or replaced, and what is the risk? [PASTE]"
"Review this Ansible playbook for idempotency problems, missing handlers and unsafe shell commands. [PASTE]"
"Write a Helm values.yaml override for [chart] with [requirements], and explain each setting."
"Turn these manual steps into an Ansible playbook: [LIST STEPS]"

"Turn these rough notes into a clear runbook with: purpose, prerequisites, numbered steps with commands, verification, rollback and contacts. [NOTES]"
"Write a change request for [change]: summary, reason, risk, impact, test plan, rollback plan and maintenance window. Keep it to one page."
"Write a blameless post-incident review from this timeline: summary, impact, timeline, root cause, contributing factors, what went well,
what did not, and action items with owners. [TIMELINE]"
"Write a status page update for an ongoing incident. Facts: [x]. Tone: calm, clear, no jargon, no blame. Give an initial, an update and a resolved version."
"Write a short email to non-technical staff explaining that [service] will be down on [date] for [reason], what the impact is, and what they need to do."
"Summarize this alert storm into the three probable root causes and the order to investigate them. [PASTE ALERTS]"
"Write a README for this script or repo: what it does, install, usage examples and troubleshooting. [PASTE]"
"Create a handover note for the next on-call engineer: current state, open issues, risky things and links. [NOTES]"

"Explain [topic: iptables, LVM, systemd, DNS, TLS] to a beginner with a real-world analogy, then give me a hands-on lab I can run in a VM."
"Quiz me on [topic] with 10 questions of increasing difficulty. Ask one at a time and explain my mistakes."
"Compare [tool A] and [tool B] for [my situation]. Use a table with strengths, weaknesses, learning curve, and when to choose each."
"Create a 4-week study plan for [certification: RHCSA, LFCS, CKA], with free resources and weekly labs."
"Explain this man page section in simple terms and give me 5 practical examples: [PASTE]"
"What are the top 10 commands I should master for [role], and one practical exercise for each?"

"Explain that more simply."                           "Show me only the commands, nothing else."
"What could go wrong with that? How do I roll back?"  "What did you assume? Which assumptions should I verify?"
"Give me a safer or read-only way to check that first."   "Put that into a table."
"How confident are you? What would change your answer?"   "List the man pages or docs I can verify this in."
"That did not work. Here is the output: [PASTE]. What now?"   "Give me the shorter version."
"Turn that into a checklist I can print."             "Give me a second, different approach and compare the two."

- Paste the real error or output, not your summary of it, and redact secrets first
- Name the exact OS, version, tool version and shell. Advice for Ubuntu 24.04 may fail on RHEL 9 or Alpine
- Say what you already tried, so it does not suggest the same things again
- Ask it to ask you questions when details are missing
- Ask for the check command before the fix command, and a rollback with every change
- One problem per conversation, so the context stays clean. Start fresh when the topic changes
- Split big tasks: plan first, then go step by step
- Verify with man pages, --help and official docs before you run anything that changes a system
- Test in a lab or container first. Never paste "fix" commands into production without understanding them

Hosted assistants (Claude, ChatGPT, Gemini)   Reasoning, drafting, code and long documents. Do not paste secrets
Perplexity                                     Current facts with sources: new CVEs, release notes, "what changed in version X"
Local model (Ollama)                           Private logs and configs, offline use, no per-question cost. Smaller, so verify more
Claude Code in the terminal                    Working directly on your scripts and repos, with permission prompts and git diff review
Man pages, official docs, --help               The source of truth. Use AI to explain them, not to replace them

- A flag, option, module or config key you cannot find in the docs (it may be invented)
- A command with rm -rf, dd, mkfs, chmod -R 777 or curl | sh that it did not warn about
- Very confident wording with no way to verify it, or details that do not match your version
- Advice that ignores what you told it (wrong OS, wrong package manager, needs a reboot when you said no downtime)
- "Just disable the firewall / SELinux / AppArmor / authentication" as a fix. That is a cry for help, not a solution
- Numbers, versions or dates you cannot confirm. Ask for the source

    Give context, data and a format. Those three things do most of the work.

    Redact secrets and private data before you paste. When in doubt, use a local model.

    Ask for a plan, the check command, the fix and the rollback, in that order.

    Treat every command as a suggestion until you have read it and verified the flags in the man page.

    Test on a lab machine, container or snapshot before you touch production.

    Use follow-up prompts to challenge the answer: "What could go wrong?" and "What did you assume?"

    Save the prompts that work for you as a personal library, in a file or shell snippets, and improve them over time.

    Use AI to speed up documentation and communication too: runbooks, change requests and post-incident reviews.

    Cross-check important facts, such as security advisories and version numbers, with the vendor's official pages.

    You are the engineer on call. The AI is an assistant, and the decision and the responsibility stay with you.