Chapter four

Network management
Network management can be defined as monitoring, testing, configuring , and troubleshooting network
components to meet set of requirements.

Key Functions of Network Management

 Fault Management: Detects and resolves outages or connectivity issues using
alarms/logs.
 Configuration Management: Tracks and manages changes to devices like
routers/switches.
 Performance Management: Monitors bandwidth, latency, and traffic to avoid
bottlenecks.
 Security Management: Protects against unauthorized access with firewalls, IDS, and
encryption.
 Accounting Management: Allocates resources and tracks usage for billing or cost
control.

Importance
 Ensures uptime and reliability.
 Optimizes resource use.
 Enhances security against cyber threats.
 Reduces downtime with proactive monitoring.
 Supports scalability as networks grow.

Types of Networks
 LAN: Local, small-area networks.
 MAN: City-wide communication infrastructure.
 WAN: Connects multiple LANs across large distances.

OSI Model (7 Layers) -----conceptual/theoretical

1. Physical → Wires, signals, hardware.
2. Data Link → MAC addresses, Ethernet, error detection.
3. Network → IP addresses, routing.
4. Transport → Reliable delivery (TCP/UDP).
5. Session → Manages conversations between apps.
6. Presentation → Data translation, encryption, compression.
7. Application → User-facing apps (web, email, file transfer).
TCP/IP Model (4 Layers)-----practical/real-world toolkit
1. Network Access → Physical + Data Link combined (hardware addressing, error control).
2. Internet → Logical addressing (IP), routing across networks.
3. Transport → Flow control, error control, acknowledgments (TCP/UDP).
4. Application → User applications + APIs (web, email, FTP, troubleshooting tools).

Why Use Linux as a Router?

 normally, computers in different subnets need a router to communicate.

 A router provides IP forwarding plus extra features (firewall, packet filtering, VoIP).
 Hardware routers can be expensive, but Linux offers a zero-cost solution if you only
need IP forwarding
 You can enable or disable IP forwarding in two ways temporary and permanent.

All running kernel processes/settings are represented in the /proc directory.

The file /proc/sys/net/ipv4/ip_forward controls whether IP forwarding is enabled.

 cat /proc/sys/net/ipv4/ip_forward-----check current state.

 echo 1 > /proc/sys/net/ipv4/ip_forward---enable temporarily (until reboot).
sysctl -w net.ipv4.ip_forward=1
 echo 0 > /proc/sys/net/ipv4/ip_forward-- disable temporarily.
 sysctl -w net.ipv4.ip_forward=0

temporary — they reset after a reboot.

For permanent enabling, you must edit /etc/[Link] and set:

 net.ipv4.ip_forward=1
then apply with ---sudo sysctl –p

echo or sysctl for quick, temporary changes;

use [Link] for permanent configuration.

What DNS Does

 DNS maps domain names (like [Link]) to IP addresses.
 It uses a hierarchical namespace separated by dots (.).
 This saves us from memorizing long IP numbers.
 Computers running DNS are called name servers.
Configuring a DNS Server (BIND)

sudo apt update

sudo apt install bind9

sudo apt install dnsutils----for testing and troubleshooting

Configuring a Web Server (Apache)

Apache is a widely used web server for hosting websites.

What DNS Does

 DNS is essentially the phonebook of the Internet. Instead of remembering long strings
of numbers (IP addresses), you just type a human-friendly name like [Link].

What DHCP Does

 DHCP automatically assigns IP addresses to devices (hosts) on a network.

 Instead of manually configuring each device, DHCP handles it dynamically, saving time
and reducing errors.
 All types of hardware can be used as a DHCP server, including a Cisco router.

How DHCP Works (The DORA Process)

DHCP uses a four-step exchange often remembered as DORA:

1. Discover – The client broadcasts a request asking for an IP.

2. Offer – The DHCP server replies with an available IP and configuration details.
3. Request – The client asks to use the offered IP.
4. Acknowledge – The server confirms and leases the IP to the client.

Information DHCP Provides

Beyond just the IP address, DHCP can supply:

 Subnet mask (defines the network size)

 Default gateway (router for external communication)
 DNS servers (for name resolution)
 Domain name (network identity)
 WINS info (legacy Windows name resolution)
What ARP Does

 ARP is used to map an IP address to a hardware address (MAC address) on a local

network.
 It’s essential because while IP addresses identify devices logically, actual communication
on Ethernet or Wi-Fi requires the physical MAC address.

What RARP Does

 RARP is essentially the opposite of ARP.

 While ARP translates an IP address → MAC address, RARP translates a MAC
address → IP address. RARP resolves Ethernet addresses to IP addresses.
 It was designed for diskless workstations or devices that didn’t have permanent storage to
keep their IP configuration.

Network troubleshooting tools overview

Troubleshooting is a form of problem solving, often applied to repair failed products or processes.

But while every problem is different, a key step is collecting information.

There are 10 basic tools that can help you troubleshoot most networking issues. These are:

Ping

 Ping checks whether a specific IP address or hostname is reachable.

 It works by sending ICMP (Internet Control Message Protocol) echo request packets
to the destination and waiting for echo replies.
 If replies are received, it confirms connectivity; if not, it indicates a possible issue.

Tracert / Traceroute

 Shows the path packets take to reach a destination.

 Identifies where delays or failures occur along the route.
 Windows: tracert [IP address or domain]
 Unix/Linux/Mac: Use the traceroute command instead.

Ipconfig / Ifconfig

 Displays and manages IP configuration.

 Useful for checking IP address, subnet mask, gateway, and DNS settings.
 Window: ipconfig/all
 Unix/linux/Mac: ifconfig

Here’s a short and clear summary of Nslookup for your notes:

 Ns lookup (Name Server Lookup)

 A Windows command-line utility used to troubleshoot DNS issues.

 Functions:
o Forward lookup → Find IP address from domain name.
o Reverse lookup → Find domain name from IP address.
 How it works: Sends a DNS query to a DNS server and returns the resolved result.
 Modes:
o Interactive → multiple queries in one session.
o Non-interactive → single query.
 Syntax: nslookup [domain or IP]
 Practical use:
o If nslookup fails → DNS problem.
o Can query specific DNS servers to test configuration.

Netstat (Network Statistics)

 A command-line utility that shows TCP/IP statistics and active connections.

 Uses:
o Check listening ports on a host.
o See which remote hosts are connected.
o Identify services tied to active ports.
 Key Functions:
o Show active TCP connections and states (ESTABLISHED, LISTENING).
o Display listening ports and related applications.
o Provide interface statistics (packets sent/received, errors).
o Show routing table info.
 Common Options:
o netstat -a → all connections.
o netstat -at → TCP only.
o netstat -au → UDP only.
o netstat -s → protocol statistics.
o netstat -r → routing table.
o netstat -i → interface stats.
o netstat -p → show PID/program name(linux)

Here’s a structured breakdown of lanscan so you can study it more effectively:

What lanscan Does

  Displays LAN device configuration and status.
 Shows details for each LAN device with software support.

Information Displayed

 Hardware Path → physical location of the device.

 Active Station Address → also called Physical Address (MAC address).
 Card Instance Number → unique identifier for the card.
 Hardware State → whether the device is active or inactive.
 Network Interface NamePPA → interface name + Physical Point of Attachment (PPA).
 Network Management ID → identifier for network management.
 MAC Type → type of MAC layer supported.

Command-Line Options
lanscan has several flags to customize output:

Option Output

-a Station addresses only (no headings).

-i Interface names only (no headings).

-l Info about PPAs acquired by APA (no headings).

-m MAC types only (no headings).

-n Network Management IDs only (no headings).

-p PPA numbers only (no headings).

-q Same as -p, but also shows LAN interfaces in link aggregates.

-v Verbose output: two lines per interface, extended station address, encapsulation methods.

 Default use: lanscan → gives a full overview of LAN devices.

 Focused checks: use options like -a or -i when you only need specific info.
 Verbose mode: -v is best when troubleshooting, since it shows extended details.
�Purpose of lanadmin

 A local area network administration program.

 Reads commands from standard input, writes prompts/errors to standard error, and outputs
status to standard output.
 Used to display and modify LAN interface settings such as:
o MAC/Physical address
o MTU (Maximum Transmission Unit)
o Speed

Key Functions of lanadmin

For each LAN interface card, you can:

 Display & change the station address (MAC address).

 Display & change MTU (packet size limit).
 Display & change speed settings (e.g., auto-negotiation, fixed speeds).
 Clear network statistics registers (reset counters to zero).
 Display interface statistics (errors, packets sent/received).
 Display interface usage information (traffic load, utilization).
 Reset the interface card (forces self-test).
 Configure VLANs (if supported by the card).

Network Services

Networking operating systems provide processes that allow clients and peers to communicate
and share resources. Common services include:

 World Wide Web (WWW) – browsing and accessing websites.

 File Sharing – exchanging files across systems.
 Mail Exchange – sending and receiving emails.
 Directory Services – centralized authentication and resource lookup.
 Remote Management – administering systems from afar.
 Print Services – sharing printers across the network.

�Most of these rely on the TCP/IP protocol suite.

�Remote Administration & Access

Remote Access allows employees to connect to a corporate network from outside the office:

 They log in with their usual credentials.

 Gain access to the same resources as if they were on-site.
�Telnet Services

 Telnet is an Internet protocol for connecting to remote machines.

 Enables a user to work on another system from their own.
 Security concerns:
o Hacking
o Password guessing
o Denial of Service (DoS) attacks
o Packet sniffing (since data is transmitted in plain text)

Virtual Network Computing (VNC)

 A graphical desktop sharing system using the RFB protocol.

 Allows remote control of another computer.
 Works by:
o Sending keyboard/mouse inputs from one machine to another.
o Relaying graphical screen updates back.

�Forwarding / Port Mapping

 A port identifies a specific process or service in an OS.

 Port forwarding makes devices on a private LAN accessible from the public Internet.
 Common use: enabling remote access to webcams for monitoring and streaming.
 Allows private network services to connect with external systems.

Chapter five

Installation of Application Server and Management

Core Components

 DHCP Server: Maintains IP addresses and configuration settings, dynamically assigns

them to clients.
 DHCP Client: Any device (PC, phone, printer, etc.) requesting network configuration.
 DHCP Relay: Forwards DHCP requests across different subnets when the server isn’t on
the same local network.
 IP Address Pool: The defined range of IP addresses available for leasing.
 Subnets: Logical divisions of the network to manage IP allocation more efficiently.

 Lease: The time period an IP address is assigned to a client before renewal.

 Default Gateway: Router address provided to clients for external communication.
  DNS Servers: Supplied to clients for resolving domain names into IP addresses.
 Options: Extra parameters like domain name, time servers, and subnet mask.

Domain Name System (DNS)

 Converts human-readable names (like [Link]) into IP addresses.

 Critical for internet communication.

Functionality

 Each domain can have multiple IPs.

 DNS servers perform domain-to-IP translation.

BIND (Berkeley Internet Name Domain)

 Most widely used DNS software.

 Acts as both name server (resolves names) and resolver (queries other servers).
 Key features:
o Authoritative server: Provides official answers.
o Caching server: Stores recent queries for speed.
o Forwarder: Sends queries to other servers.
o Master/Slave setup: Ensures redundancy and load distribution.

�Together, DNS + BIND make domain resolution fast, reliable, and user-friendly across the
internet.

Telnet Server

 Telnet Protocol: Allows remote login and command-line access to another computer
over a network.
 Usage: Administrators can control servers using text-based commands.
 Security: Not secure (data sent in plain text). SSH is recommended instead.
 Default Port: TCP Port 23.

What It Enables

 Remote login to servers.

 Executing commands.
 Managing system settings.
 Troubleshooting network devices.

How It Works

1. Client sends a connection request.

2. Telnet server authenticates the user.
3. Remote command session is established.
4. User runs commands remotely.
� In short, Telnet is an old remote access tool useful for management and troubleshooting, but
insecure compared to modern alternatives like SSH.

OpenSSH: Secure Network Communication

 Provides encrypted remote login, command execution, and file transfer.

 Protects communication from hackers by encrypting all data.
 Default Port: TCP 22.
 Replaces insecure protocols like Telnet.

Uses

 Securely access remote servers.

 Encrypt data during transmission.
 Manage servers remotely.
 Transfer files safely.

Key Components

 SSH Client: Connects to remote servers (ssh user@server_ip).

 SSH Server (sshd): Listens for incoming connections.
 SSH Keys: Public/Private keys for secure, password-free login.

OpenSSH is the secure alternative to Telnet, ensuring safe remote access and data transfer
across networks.

FTP Basics
 Protocol: FTP (File Transfer Protocol) is used to move files between a client (your
computer) and a server (remote machine).
 Ports:
o 21 → Control channel (commands like login, list, upload).
o 20 → Data channel (actual file transfer).
 Modes:
o Active Mode → Client opens a port, server connects back for data. Can be tricky
with firewalls.
o Passive Mode → Client initiates both control and data connections. Easier when
behind NAT or firewalls.

Why FTP is Useful

 Uploading website files to a hosting server.
 Sharing files between remote systems.
 Backing up important files to a remote server.
Network Information Service (NIS)
 Purpose: Provides a centralized database for configuration files across a network.
 How it works:
o NIS server stores common configuration files (like /etc/hosts, /etc/passwd).
o NIS clients query the server instead of keeping their own local copies.
 Benefit: Makes administration easier in large networks—changes are made once on the
server and automatically available to all clients.

Network File System (NFS)

 Purpose: Allows files to be shared across different machines so they appear as if they are
local.
 How it works:
o An NFS server exports (shares) directories.
o NFS clients mount those directories using the mount command.
o To the client, the remote directory looks like part of its own file system.

Chapter Six
Managing Network Service

Core Areas of Network Management

1. Network Administration

 Tracks resources like switches, servers, and routers.

 Handles software updates and performance monitoring.
 Ensures devices are properly configured and functioning.

2. Network Maintenance

 Focuses on fixes and upgrades to hardware/software.

 Includes remediation activities (e.g., replacing faulty routers).
 Implements proactive measures to prevent downtime.

3. Network Operation

 Ensures smooth day-to-day running of the network.

 Involves continuous monitoring to detect and resolve issues quickly.
 Keeps services available and reliable for users.
4. Network Provisioning

 Configures resources to meet specific service requirements.

 Allocates bandwidth, IP addresses, and access permissions.
 Supports scalability and new service deployments.

Managed Network Services (MNS)

 Outsourcing network management to third-party providers.
 Covers design, implementation, support, security, and maintenance.
 Helps organizations reduce costs and focus on core business.
 Ensures expert handling of complex infrastructures.

Common System Problems

Problem Cause Solution

Slow system Too many startup/background apps, low Close unused programs, upgrade
performance RAM/disk space, malware RAM/disk, run antivirus
System Hardware overheating, faulty drivers, Update/reinstall drivers, check
crashes/freezing corrupted system files cooling, repair OS
Delete unnecessary files, clean
Disk full Unmanaged storage
temporary files
Run antivirus, install security
Malware infection Unsafe downloads, weak security
patches
Corrupt system files, damaged boot Use Startup Repair, System
Boot failure
loader Restore, or reinstall OS

Common Network Problems

Problem Cause Solution

No internet Router/modem issue, incorrect IP Restart router, check IP settings, contact
connection config, ISP outage ISP
Slow network Bandwidth overload, weak Wi-Fi Limit heavy usage, adjust router
speed signal, malware location, scan for malware
IP address
Duplicate IP addresses Renew IP, reconfigure network settings
conflict
DNS resolution DNS server down, misconfigured Change DNS settings, use alternate
failure DNS DNS
Adjust router location, reduce
Wireless dropouts Signal interference
interference
General Maintenance Strategies
 Preventive Maintenance: Regular updates, security patches, virus scans, hardware
checks.
 Security Strategy: Firewalls, antivirus, strong authentication.
 Backup & Recovery: Regular backups, restore points, recovery drives.
 Performance Optimization: Clean temporary files, monitor system performance.
 Documentation & Monitoring: Keep logs, use tools like Event Viewer for
troubleshooting.

Resolving Boot Problems

Boot problems occur when a computer fails to start or load the operating system.
Problem Cause Troubleshooting Steps
Corrupt OS files,
System won’t - Check power supply<br/>- Boot from recovery
hardware failure,
start media<br/>- Run Startup Repair
damaged boot loader
Software failure, driver
- Boot into Safe Mode<br/>- Uninstall recent
Boot loop conflict, corrupted
updates/drivers<br/>- Run System Restore
updates
Driver or hardware
Blue Screen - Note error code<br/>- Update/reinstall
conflict, corrupt system
(BSOD) drivers<br/>- Run memory/disk diagnostics
files
“Operating Damaged boot loader, - Check boot order in BIOS<br/>- Repair boot
System Not incorrect BIOS/UEFI loader (bootrec /fixmbr, bootrec /fixboot)<br/>-
Found” settings, missing OS files Reinstall OS if needed
Too many startup
- Disable unnecessary startup apps<br/>- Run disk
Slow startup programs, fragmented
cleanup/defragmentation<br/>- Scan for malware
disk, malware

Key Recovery Tools

 Startup Repair: Automatically fixes boot issues.
 System Restore: Rolls back to a stable state.
 Safe Mode: Loads minimal drivers to isolate faulty software.
 Command Prompt (Recovery Mode): Use sfc /scannow or chkdsk for file/disk repair.
 BIOS/UEFI Settings: Ensure correct boot device priority.

A system volume is the disk section that contains the operating system.
Method Purpose
System Restore Reverts system settings
System Image Recovery Restores full OS and files
 Method Purpose
Reset This PC Reinstalls OS
Fixes boot and system
Recovery Drive
errors

Event Viewer is a Windows tool that records system events, errors, warnings, and security logs to help
administrators troubleshoot problems.

Event Viewer Log Categories

Log Type Purpose
Application Records software errors and events from installed programs.
Logs operating system and hardware issues (e.g., driver failures, service
System
errors).
Tracks login attempts, access events, and audit results for security
Security
monitoring.
Setup Contains installation and update logs.
Forwarded
Collects logs from other computers on the network.
Events

Event Levels/type

Event Level Meaning

Information Normal activity or successful operations.
Warning Potential issue that may need attention.
Error Serious problem that affects functionality.
Critical System failure or event that caused the system to stop.

Chapter Seven
Systems Security
Boot Loader Basics

 A boot loader is a small program that runs when a computer starts.

 Its main role: load the operating system into memory and start it.
 In Linux systems, common boot loaders are:
o LILO (Linux Loader) – older, simpler boot loader.
o GRUB (GRand Unified Bootloader) – more advanced, supports multiple OSes,
flexible configuration.
 LILO (Linux Loader)

 Overview:
o Older boot loader, directly loads Linux kernels.
o Simple, widely used in legacy systems.
 Security Features:
o Password protection for boot options and kernel parameter editing.
o Restricts booting into alternative kernels or single-user mode without a password.
 Limitations:
o Stores passwords in plain text in /etc/[Link] (weak security).
o No interactive menus; changes require running the lilo command to update the boot
sector.

GRUB (GRand Unified Bootloader)

 Overview:
o Advanced boot loader used in modern Linux distributions.
o Supports multiple OS, graphical menus, and dynamic configuration.
 Security Features:
o Password protection for boot menu and editing boot entries.
o Restricts access to single-user mode or kernel parameters unless authenticated.
o Supports hashed passwords (SHA-512) for stronger security.
o Integrates with UEFI Secure Boot to ensure only signed bootloaders/kernels run.
 Advantages over LILO:
o Flexible menu system.
o Passwords are hashed, not plain text.
o Can protect both boot menu and command-line editing.
o Secure multi-OS booting.

General Boot Loader Security Best Practices

 Always set strong passwords to prevent unauthorized boot entry modification.

 Restrict booting into single-user or recovery mode without authentication.
 Keep boot loader configuration files readable only by root.
 Enable UEFI Secure Boot on modern systems to block untrusted code.
 Regularly update boot loader software for security patches.

�Quick takeaway:

 LILO = simple, legacy, weaker security (plain text passwords).

 GRUB = modern, flexible, stronger security (hashed passwords, UEFI integration).
TCP Wrappers

 Definition: A host-based access control system for Unix/Linux.

 Purpose: Controls access to network services (e.g., SSH, FTP, Telnet) based on IP
addresses, hostnames, or domain names.
 Function: Acts as a security layer between the network service and the requesting client.

Here’s a structured study note on Iptables Firewalling: Preliminaries and Scenarios from your
Chapter 7 material:

Iptables Overview

 Definition: A powerful Linux utility to configure, maintain, and inspect packet filtering rules in
the kernel firewall.
 Layer: Works at the network layer to control traffic based on IP, port, protocol, and packet
attributes.
 Firewall Role:
o Monitors and controls incoming/outgoing traffic.
o Allows or blocks traffic based on rules.
o Protects systems from unauthorized access.
o Prevents attacks (e.g., port scanning, DoS).

Role of Iptables

 Acts as a packet filter at the kernel level.

 Can permit, reject, or drop packets.
 Organizes rules into chains and tables.

Iptables Tables
Table Purpose

filter (default) Controls whether packets are allowed or blocked.

nat (Network Address Translation) Modifies packet source/destination addresses for routing.

mangle Alters packet headers (QoS, TTL, etc.).

raw Configures packets to bypass connection tracking.

 Common Iptables Scenarios
Scenario Rule Purpose

Allow Only SSH Access Permit SSH connections, block all other incoming traffic.

Block a Specific IP Address Prevent access from malicious/suspicious IP.

Allow Web Server Traffic (HTTP/HTTPS) Permit users to access hosted websites.

Restrict Access by Network Range Allow only trusted networks.

Block Ping Requests (ICMP) Hide server from ping scans/discovery.

Protect Against Brute Force Attacks Limit repeated login attempts.

Port Forwarding (NAT) Redirect external requests to internal servers.

Think of iptables as a traffic cop at the Linux kernel level:

 Tables = categories of rules.

 Chains = checkpoints where packets are inspected.
 Rules = decisions (allow, block, modify).

Here’s a structured study note on Packet Filtering, Port Forwarding, and NAT (IP
Masquerading) from your Chapter 7 material:

�Packet Filtering

 Definition: A firewall technique that inspects network packets and decides whether to ALLOW,
DROP, or REJECT them based on rules.
 Criteria for Filtering:
o Source IP address
o Destination IP address
o Port number
o Protocol (TCP, UDP, ICMP)
o Connection state (e.g., established, new)
 OSI Layers: Operates at the Network Layer (Layer 3) and Transport Layer (Layer 4).
 Purpose: Provides fine-grained control over traffic, prevents unauthorized access, and blocks
malicious activity.
�Port Forwarding / Redirection

 Definition: Redirects traffic arriving on one IP/port to another IP/port.

 Use Case: Commonly forwards traffic from a public server to a private internal server.
 Why Needed:
o Private networks use internal IPs (not directly accessible from the internet).
o Public users cannot access private servers directly.
o Router/firewall forwards traffic to the correct internal device.

�NAT / IP Masquerading

 Definition: A technique that allows multiple private network devices to share a single public IP
address.
 Function:
o Hides real internal IP addresses.
o Provides outbound internet access for private hosts.
o Enhances security by masking internal network structure.
 Common Use: Home and enterprise networks where many devices connect to the internet
through one public IP.

�Quick Memory Aid:

 Packet Filtering = Decides which packets get through.

 Port Forwarding = Redirects traffic to the right internal host.
 NAT/IP Masquerading = Lets many devices share one public IP while hiding their private
addresses.

It looks like you’re reviewing material from your System Administration course (Chapter 7).
Let me help you make sense of it by organizing the key ideas into a clear framework so it’s
easier to study and apply.

Analytical System Administration

 Approach: Logical, data-driven, and systematic to manage computer systems and networks.
 Goal: Improve performance, reliability, and stability.
 Style: Proactive management (anticipating issues) rather than reactive (fixing after failure).
 Methods:
o Continuous observation → track system behavior.
 o Evaluation techniques → measure efficiency, detect weaknesses.
o Fault analysis → find root causes of errors.
o Behavioral modeling → predict future performance.
 Benefit: Evidence-based decisions that prevent failures and minimize downtime.

System Observation
Continuous monitoring of:

 CPU usage & load → detect overloads.

 Memory consumption → prevent leaks or exhaustion.
 Disk activity & storage → avoid bottlenecks and failures.
 Network traffic & bandwidth → spot congestion or attacks.
 System logs & error messages → early warning signs.
 Application performance → ensure smooth user experience.

�Purpose: Catch abnormal activity and performance bottlenecks before they escalate.

Faults
A fault = any defect/error causing incorrect behavior or failure.

Types:

 Hardware → disk failure, overheating, memory errors.

 Software → bugs, crashes, misconfigurations.
 Network → packet loss, broken connections.
 Human → incorrect settings, accidental deletion.
 Environmental → power outages, temperature issues.

Handling Steps:

1. Detection → notice the fault.

2. Diagnosis → identify what went wrong.
3. Isolation → contain the problem.
4. Correction → fix the issue.
5. Recovery → restore normal operation.

�Goal: Minimize downtime and keep systems reliable.

1. Observe → 2. Detect → 3. Diagnose → 4. Correct → 5. Recover → back to Observation.
It’s a loop that ensures systems stay healthy.