Start with identity
Before changing a service, write down the distribution, kernel, uptime and the exact process that owns its listening socket. A hostname alone is insufficient: a shell can be inside a container, while the public listener belongs to the host. Record which machine each observation came from. This makes later comparisons repeatable instead of relying on memory.
Separate capacity from pressure
Free memory is not the same as available memory. Linux uses otherwise idle memory for caches; reclaimable cache is useful work, not automatically a leak. Likewise, a high load average requires context: the number of CPUs, runnable work, storage waits and the time interval all matter. A single snapshot is a starting point. Take another observation during the symptom before assigning a cause.
Make a reversible first change
Save the service configuration and its ownership before editing. Validate the candidate configuration, make one bounded change and check the actual application response. Keep a separate SSH session available when changing access controls. A successful configuration parser proves syntax; it does not prove that a process can bind its port, read its certificate or answer an external request.
At the terminal
uname -r
uptime
free -m
df -h /
ss -lntup