Monthly server maintenance checklist for a small business

Pick the same evening each month and announce it. Staff stop asking whether a restart is planned once it always falls on the second Tuesday. The habit holds. Run apt or yum for the operating system updates first. Then update the packages your applications depend on, such as Nginx, PostgreSQL or MySQL, and the PHP or Node runtime.

Reboot afterwards. Always. Many kernel and library fixes only take effect after a restart, and a server that has run for two hundred days is an unknown. Open the application once it returns and check the login page, one report and one write.

Take a snapshot or an image just before you start. If an update breaks something, you roll back in minutes instead of rebuilding the machine over a weekend.

A green backup job proves that files were written. It does not prove that they open, or that they are complete. Once a month, restore the latest mysqldump or pg_dump file and one folder of customer uploads onto a spare machine.

Then run a query. A real one. Count the orders from yesterday and compare the figure with production. Time the whole exercise with a stopwatch, because that duration is your honest recovery estimate.

Check that the backup copy sits somewhere else, in another account or another region. A copy on the same disk dies with the disk.

Full disks cause more small-business outages than attackers do. Check them with df and du. Look at free space on every volume and at the biggest directories under /var. Confirm that logrotate runs for the application logs, the Nginx access log and the database log, and that old archives are deleted.

Certificates expire on a date you can read. List every domain and its expiry from the server itself with openssl, then check that the certbot renewal job ran. A certificate lapsing on a Saturday is a classic avoidable call-out.

Add the domain registration renewal to the same list. It is forgotten just as often.

List the Linux users, the sudo group and every public key in authorized_keys, then match each one to a name. Remove the contractor who finished in spring and the developer who left last year.

Check the database roles and the hosting control panel logins too. Shared accounts hide who did what, so give each person their own. Turn off password login over SSH wherever keys are in use.

Look at the failed login count in the auth log. A sudden jump tells you someone is guessing.

Monitoring that nobody receives is decoration. Trigger a test alert for disk, CPU and an uptime check, and confirm that the phone of the person on call buzzes. Phone numbers change. Mail rules swallow messages.

Skim the dashboards for slow drifts such as swap use creeping up, page response times lengthening or the job queue growing. Drifts are cheaper to fix in month one than in month six.

Finish by filing the sheet. Keep twelve months together so a pattern shows up, and book next month’s date before closing the file.