CLI Best Practices

A condensed summary of the 25 most important Linux CLI practices for PostgreSQL 18.4 DBA and platform teams - shared portable content; script common health checks.

Prefer SIGTERM over SIGKILL on postmaster: Read postmaster.pid; allow checkpoint to complete (Linux CLI for DBAs Basics).
Run Postgres under systemd or k8s, not naked postgres &: Survives SSH disconnect; restart policy defined.
Persist ops sessions with tmux: Long iostat and log tails survive disconnect.
df -h and df -i on PGDATA first: Disk and inode exhaustion both stop writes.
du -sh pg_wal when disk climbing: WAL archive or replication slot issue before blaming data growth.
Check dmesg for OOM killer: Correlate timestamp with Postgres worker exit code 137.
vmstat 1 5 before tuning memory GUCs: Swap si/so means host RAM problem, not only work_mem.
iostat -xz 1 5 before index debates: Saturated %util needs IO capacity or fewer reads.
pidstat -r on hot pg_stat_activity.pid: Proves sort/hash RSS on specific backend.
Script incident bundle with timestamp: df, free, vmstat, activity CSV, locks CSV in tarball.
set -euo pipefail in all bash scripts: Fail fast; undefined vars error.
psql -v ON_ERROR_STOP=1 in automation: SQL failure stops script, not continues silently.
Read-only DATABASE_URL for triage scripts: Scribe role without write accidents.
journalctl -u postgresql on VMs: Error lines last 30 minutes in SEV1 timeline.
kubectl logs / exec in k8s: Same SQL bundle inside pod network namespace.
ss -tnp for connection storms: Compare to max_connections and pooler limits.
Never rm WAL files manually: Fix archiver or slot; manual delete breaks replication and PITR.
Scope find and grep to PGDATA or log dir: Do not scan / from postgres user.
Commit bin/pg-health.sh to platform repo: Same smoke locally, staging cron, post-deploy hook.
curl only for HTTP healthchecks, not SQL: Use psql for database truth.
macOS vs Linux sed -i differences: Document in CONTRIBUTING or use portable scripts in CI.
Bastion hosts hold break-glass creds: Not on application developer laptops for prod.
Pair juniors on first incident bundle run: Prevents accidental kill -9 reflex.
Attach CLI bundle to post-mortem ticket: Reproducible timeline for auditors.
Quarterly drill: run bundle against staging during fake SEV2: Proves scripts still work after OS upgrade.

FAQs

Install htop on database pods?

Debug sidecar or bastion only. Production minimal images use ps and top -b -n 1 one-shot.

How much CLI skill do app devs need?

Day one: psql, EXPLAIN. Week one: incident bundle script. Deep iostat/systemd is DBA-partnered (Onboarding Basics).

CLI vs SQL views during incident?

Both. Host metrics explain why Postgres waits; pg_stat_activity shows who. Never one without the other.

Linux CLI for DBAs Basics - first-hour triage
IO & Memory Tools - iostat, vmstat, pidstat
Incident Triage Skill - decision tree
Incident Basics - roles and comms

Stack versions: This page was written for PostgreSQL 18.4 on Linux (systemd and Kubernetes deployments).

CLI Best Practices

A condensed summary of the 25 most important Linux CLI practices for PostgreSQL 18.4 DBA and platform teams - shared portable content; script common health checks.

Prefer SIGTERM over SIGKILL on postmaster: Read postmaster.pid; allow checkpoint to complete (Linux CLI for DBAs Basics).

Run Postgres under systemd or k8s, not naked postgres &: Survives SSH disconnect; restart policy defined.

Persist ops sessions with tmux: Long iostat and log tails survive disconnect.

df -h and df -i on PGDATA first: Disk and inode exhaustion both stop writes.

du -sh pg_wal when disk climbing: WAL archive or replication slot issue before blaming data growth.

Check dmesg for OOM killer: Correlate timestamp with Postgres worker exit code 137.

vmstat 1 5 before tuning memory GUCs: Swap si/so means host RAM problem, not only work_mem.

iostat -xz 1 5 before index debates: Saturated %util needs IO capacity or fewer reads.

pidstat -r on hot pg_stat_activity.pid: Proves sort/hash RSS on specific backend.

Script incident bundle with timestamp: df, free, vmstat, activity CSV, locks CSV in tarball.

set -euo pipefail in all bash scripts: Fail fast; undefined vars error.

psql -v ON_ERROR_STOP=1 in automation: SQL failure stops script, not continues silently.

Read-only DATABASE_URL for triage scripts: Scribe role without write accidents.

journalctl -u postgresql on VMs: Error lines last 30 minutes in SEV1 timeline.

kubectl logs / exec in k8s: Same SQL bundle inside pod network namespace.

ss -tnp for connection storms: Compare to max_connections and pooler limits.

Never rm WAL files manually: Fix archiver or slot; manual delete breaks replication and PITR.

Scope find and grep to PGDATA or log dir: Do not scan / from postgres user.

Commit bin/pg-health.sh to platform repo: Same smoke locally, staging cron, post-deploy hook.

curl only for HTTP healthchecks, not SQL: Use psql for database truth.

macOS vs Linux sed -i differences: Document in CONTRIBUTING or use portable scripts in CI.

Bastion hosts hold break-glass creds: Not on application developer laptops for prod.

Pair juniors on first incident bundle run: Prevents accidental kill -9 reflex.

Attach CLI bundle to post-mortem ticket: Reproducible timeline for auditors.

Quarterly drill: run bundle against staging during fake SEV2: Proves scripts still work after OS upgrade.

FAQs

Install htop on database pods?

Debug sidecar or bastion only. Production minimal images use ps and top -b -n 1 one-shot.

How much CLI skill do app devs need?

Day one: psql, EXPLAIN. Week one: incident bundle script. Deep iostat/systemd is DBA-partnered (Onboarding Basics).

CLI vs SQL views during incident?

Both. Host metrics explain why Postgres waits; pg_stat_activity shows who. Never one without the other.

CLI Best Practices

FAQs

Related

Search Documentation

CLI Best Practices

FAQs

Related