Linux Filesystem

← Back to all decks

141 cards — 🟢 35 easy | 🟡 59 medium | 🔴 32 hard

🟢 Easy (35)

1. Explain the following in regards to LVM: PV, VG, LV

Show answer

LVM has three abstraction layers:

PV (Physical Volume):
- Bottom layer
- Actual disk or partition
- Created with: pvcreate /dev/sdb
- View with: pvs, pvdisplay

VG (Volume Group):
- Middle layer

Remember: LVM: PV→VG→LV. "Disks→pool→partitions."

Example: `pvcreate /dev/sdb && vgcreate myvg /dev/sdb && lvcreate -L 10G -n mylv myvg`

2. What is LVM (Logical Volume Manager) and why is it useful in Linux?

Show answer

LVM (Logical Volume Manager) provides flexible disk management.

Components:
- PV (Physical Volume): Actual disks/partitions
- VG (Volume Group): Pool of PVs
- LV (Logical Volume): Virtual partitions from VG

Benefits:
- Resize volumes online
- Span multiple disks

Remember: LVM: PV→VG→LV. "Disks→pool→partitions."

Example: `pvcreate /dev/sdb && vgcreate myvg /dev/sdb && lvcreate -L 10G -n mylv myvg`

3. What is an archive? How do you create one in Linux?

Show answer

An archive combines multiple files into one file.

tar (Tape Archive):
- tar cvf archive.tar files/ - Create archive
- tar cvzf archive.tar.gz files/ - Create compressed (gzip)
- tar cvjf archive.tar.bz2 files/ - Create compressed (bzip2)
- tar xvf archive.tar - Extract

Options:
- c: Create

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

4. What is the difference between find and locate?

Show answer

Both search for files but work differently:

find:
- Searches filesystem in real-time
- Slower but always current
- Flexible criteria (name, size, time, permissions)
- find /path -name "*.txt" -mtime -7

locate:
- Searches pre-built database

Example: `find /var/log -name '*.log' -mtime +30 -delete` — delete old logs.

5. Why would you want to mount servers in a rack?

Show answer

- Protecting Hardware
- Proper Cooling
- Organized Workspace
- Better Power Management
- Cleaner Environment

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

6. How do you check free disk space in Linux?

Show answer

By using df -h (shows disk filesystem usage in human-readable form).

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

7. What is the home directory subdirectory used for?

Show answer

It stores individual user files and settings.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

8. What is /etc in Linux?

Show answer

It is the directory for system-wide configuration files.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

9. In which path can you find the system devices (e.g. block storage)?

Show answer

System devices are found in several locations:

1. /dev - Device files (block and character devices)
- Block: /dev/sda, /dev/nvme0n1
- Created by udev dynamically

2. /sys - Sysfs virtual filesystem
- /sys/block/ - Block devices
- /sys/class/ - Device classes
- /sys/devices/ - Device hierarchy

3. /proc - Process and system info
- /proc/devices - Registered devices
- /proc/partitions - Partition table

Commands: lsblk, blkid, ls /sys/block/

Example: `find /var/log -name '*.log' -mtime +30 -delete` — delete old logs.

10. Hard link vs soft link?

Show answer

Hard link: another directory entry to the same inode (same filesystem only).

Soft link: file containing a path; can cross filesystems.

Remember: Hard=same inode, survives deletion, no cross-FS. Soft=path pointer, breaks if deleted. "Hard=twin, Soft=shortcut."

11. True or False? You can create a soft link between different filesystems.

Show answer

TRUE.

Soft links (symbolic links):
- Can cross filesystem boundaries
- Just a file containing a path
- Works across partitions, NFS, etc.
- ln -s /mnt/disk2/file /home/user/link

Hard links:
- CANNOT cross filesystem boundaries
- Share same inode
- Must be on same filesystem
- ln /path/file /path/hardlink

This is a key difference between soft and hard links.

Remember: Symlink = path pointer. Target deleted→dangling. Can cross FS and link directories.

12. What is lazy umount in Linux and when would you use it?

Show answer

Lazy umount (umount -l) detaches filesystem immediately but cleans up when no longer busy.

Normal umount fails if filesystem is busy (files open, processes using it).

Lazy umount:
- Immediately removes from namespace
- New processes can't access
- Existing file handles continue working
- Actually unmounts when all references close

Usage: umount -l /mnt/stuck



Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

13. Describe three different ways to remove a file or directory

Show answer

Multiple methods to remove files/directories:

1. rm command:
- rm file - Remove file
- rm -r directory - Remove directory recursively
- rm -rf directory - Force remove without prompts

2. unlink command:
- unlink file - Remove single file
- Cannot remove directories

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

14. What is a file descriptor? What file descriptors are you familiar with?

Show answer

Kerberos
File descriptor, also known as file handler, is a unique number which identifies an open file in the operating system.

In Linux (and Unix) the first three file descriptors are:

* 0 - the default data stream for input
* 1 - the default data stream for output
* 2 - the default data stream for output related to errors

This is a great article on the topic: https://www.computerhope.com/jargon/f/file-descriptor.htm

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

15. What is the primary purpose of the /etc directory?

Show answer

It contains system configuration files edited by administrators.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

16. What happens when you delete the original file in a soft link?

Show answer

The soft link becomes a "dangling" or "broken" link.

Behavior:
- The symlink file still exists
- It points to a non-existent path
- Accessing it gives "No such file or directory"
- ls -l shows the link in red (broken)

Example:
- ln -s /tmp/original /tmp/link
- rm /tmp/original
- cat /tmp/link → Error: No such file or directory

With hard links: File data persists until ALL hard links are deleted (reference counting via inode link count).

Remember: Symlink = path pointer. Target deleted→dangling. Can cross FS and link directories.

17. In Linux FHS (Filesystem Hierarchy Standard) what is the /?

Show answer

In the Linux Filesystem Hierarchy Standard (FHS), `/` is the root directory — the top of the entire filesystem tree. All other directories branch from it. Key subdirectories: `/etc` (configuration), `/var` (variable data and logs), `/tmp` (temporary files), `/opt` (third-party software), `/home` (user directories), `/usr` (user programs).

18. What does the /bin directory contain?

Show answer

Essential binary commands needed to boot the system.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

19. What is RAID? What is RAID0, RAID1, RAID5, RAID6, RAID10?

Show answer

A **RAID** (Redundant Array of Inexpensive Disks) is a technology that is used to increase the performance and/or reliability of data storage.

- **RAID0**: Also known as disk **striping**, is a technique that breaks up a file and spreads the data across all the disk drives in a RAID group.

Remember: 0=stripe, 1=mirror, 5=parity(min 3), 10=mirror+stripe. "0=Speed, 1=Mirror, 5=Parity."

20. What is the difference between a soft link and hard link?

Show answer

Hard link is the same file, using the same inode.
Soft link is a shortcut to another file, using a different inode.

Remember: Hard=same inode, survives deletion, no cross-FS. Soft=path pointer, breaks if deleted. "Hard=twin, Soft=shortcut."

21. What kind of filesystem is /proc and what does it contain?

Show answer

/proc is a pseudo-filesystem (virtual, not on disk) that exposes kernel and per-process state as readable files. It contains CPU info, memory stats, and per-PID directories with process details.

Remember: /proc=process/kernel info. /sys=device/driver. Both virtual — no disk used.

22. What command shows the block device hierarchy including partitions and their mount points?

Show answer

lsblk. It displays all block devices in a tree format showing relationships between disks, partitions, and LVM volumes, along with their mount points, sizes, and types.

Remember: /etc(config), /var(data/logs), /tmp(temp), /opt(third-party), /home(users).

23. How do you check filesystem usage in a human-readable format?

Show answer

df -h. The -h flag shows sizes in human-readable units (KB, MB, GB). It displays total size, used space, available space, use percentage, and mount point for each mounted filesystem.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

24. Why should you use UUIDs instead of /dev/sdX device names in /etc/fstab, and how do you find a UUID?

Show answer

Device names like /dev/sdX can change between reboots (e.g., when disks are added or removed). UUIDs are persistent identifiers tied to the filesystem. Use the blkid command to show filesystem UUIDs and types.

Remember: fstab fields: device, mount, type, options, dump, check. "DMTODC."

Gotcha: Typo → boot failure. Test: `mount -a`. Use `nofail` for non-critical mounts.

25. What command shows inode usage per mounted filesystem?

Show answer

`df -i` — shows inode usage (total, used, free, percentage) per mounted filesystem. When inode usage hits 100%, you can't create new files even if disk space remains.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

26. What information does an inode store?

Show answer

File metadata: type, permissions, owner (UID/GID), size, timestamps (atime/mtime/ctime), hard link count, and pointers to data blocks. It does NOT store the filename or file contents.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

27. How do you display the inode number of a file?

Show answer

Use ls -i filename or stat filename.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

28. What command shows all current mounts in a tree view?

Show answer

findmnt — it displays all mounts in a hierarchical tree with source device, filesystem type, and options.

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

29. How do you find the UUID of a block device?

Show answer

Use blkid or lsblk -f. Both show UUID, filesystem type, and label for all block devices.

Example: `find /var/log -name '*.log' -mtime +30 -delete` — delete old logs.

30. What are the six fields in an /etc/fstab entry?

Show answer

Device (UUID/path), mount point, filesystem type, options, dump flag (0/1), and fsck pass order (0/1/2).

Remember: fstab fields: device, mount, type, options, dump, check. "DMTODC."

Gotcha: Typo → boot failure. Test: `mount -a`. Use `nofail` for non-critical mounts.

31. What does umount -l (lazy unmount) do?

Show answer

It immediately detaches the filesystem from the mount point but defers cleanup until all references to it are released. Useful when a normal umount returns "device is busy."

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

32. How do you display the block device hierarchy including disk types, sizes, and mount points?

Show answer

lsblk shows all block devices in a tree format. It displays the relationship between physical disks, partitions, LVM logical volumes, and their mount points. Add -f to also show filesystem types and UUIDs.

Remember: /etc(config), /var(data/logs), /tmp(temp), /opt(third-party), /home(users).

33. What does the blkid command show, and why is it important for troubleshooting?

Show answer

blkid shows filesystem UUIDs, types (ext4, xfs, etc.), and labels for all block devices. It is critical for troubleshooting because /etc/fstab should use UUIDs (not /dev/sdX names which can change between reboots), and blkid helps you identify which device corresponds to which UUID.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

34. What is the difference between df and du, and when would you use each for disk troubleshooting?

Show answer

df -h shows filesystem-level usage (total, used, available, mount point) -- use it to identify which filesystem is full. du -sh /path/* shows directory-level usage -- use it to drill down and find which directories or files are consuming the most space. They complement each other: df for the overview, du for the details.

Remember: df=filesystem level. du=directory level. "df=room left, du=who's using it."

35. Why are there different sections in man? What is the difference?

Show answer

Man pages are organized into numbered sections by topic.

Sections:
1. User commands (ls, cp, cat)
2. System calls (open, read, fork)
3. Library functions (printf, malloc)
4. Special files (/dev devices)
5. File formats (/etc/passwd format)
6. Games
7. Miscellaneous (conventions, standards)
8. System admin commands (mount, systemctl)

Why sections exist:
- Same name in different contexts
- Example: printf(1) command vs printf(3) C function
- Example: passwd(1) command vs passwd(5) file format

Access specific section:
- man 1 printf - Command
- man 3 printf - C function
- man 5 passwd - File format

Find all:
- man -k keyword - Search descriptions
- man -f command - List all sections

🟡 Medium (59)

1. You see high "iowait" in top. What are your next three steps to identify the culprit?

Show answer

High iowait means CPU is idle waiting for I/O operations to complete.

Three diagnostic steps:
1. Identify the saturated disk:
- `iostat -xz 1`
- Look for high %util, await, and avgqu-sz columns
- Identifies WHICH disk device is the bottleneck

2. Find the process generating I/O:
- `iotop` (requires root)
- Shows per-process I/O read/write rates

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

2. df -h shows a disk is 100% full, but du -sh of the mount point shows only 50% usage. Why?

Show answer

The most common cause is deleted files still held open by running processes.

Explanation:
- When a file is deleted while a process has it open, the directory entry is removed
- du only counts files visible in the directory tree
- The file's data blocks remain allocated until the file descriptor is closed
- df reports actual block allocation from filesystem metadata



Remember: df=filesystem level. du=directory level. "df=room left, du=who's using it."

3. How can you print all the information on connected block devices in your system?

Show answer

`lsblk` — lists all block devices (disks, partitions, LVM volumes) in a tree format showing name, size, type, and mountpoint. Add `-f` to include filesystem type and UUID.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

4. What does high iowait with low disk utilization usually mean?

Show answer

Latency-bound I/O (small random reads/writes). Check `iostat -x` and `await`.

Often caused by slow storage, seeks, or network-backed storage (NFS).

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

5. Explain /proc vs /sys vs /dev — what kind of tuning would you do in each?

Show answer

These are virtual/special filesystems with distinct purposes.

/proc - Process and kernel information:
- Process info: /proc// (cmdline, fd, maps, status)
- Kernel tunables: /proc/sys/
- Examples:
- /proc/sys/vm/swappiness (memory management)
- /proc/sys/net/core/somaxconn (socket backlog)

Remember: /proc=process/kernel info. /sys=device/driver. Both virtual — no disk used.

6. What can you find in /boot?

Show answer

/boot contains files needed for system boot:

Key contents:
- vmlinuz-* - Compressed Linux kernel
- initrd.img-* or initramfs-* - Initial RAM disk
- config-* - Kernel build configuration
- System.map-* - Kernel symbol table
- grub/ - GRUB bootloader files

On UEFI systems:
- /boot/efi/ - EFI System Partition mount
- /boot/efi/EFI/ - EFI bootloaders

Size considerations:
- Multiple kernels take space
- apt autoremove removes old kernels
- Typically 500MB-1GB partition

Example: `find /var/log -name '*.log' -mtime +30 -delete` — delete old logs.

7. What system call is used for listing files?

Show answer

getdents/getdents64 system calls read directory entries.

How ls works:
1. open() - Open directory
2. getdents64() - Read directory entries
3. stat() - Get file details (for -l)
4. close() - Close directory

Related syscalls:
- opendir/readdir - Library wrappers
- getdents64 - Modern version
- getdents - Legacy version

Trace it:
- strace ls /tmp
- Shows open, getdents64, stat calls

Note: readdir() is a library function (glibc) that calls getdents internally.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

8. What does the readdir() system call do?

Show answer

readdir() reads directory entries one at a time.

Actually, readdir() is a library function (glibc), not a syscall.
It wraps the getdents/getdents64 system calls.

What it does:
- Returns next directory entry (struct dirent)
- Contains: d_name, d_ino, d_type
- Returns NULL at end of directory



Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

9. How do you safely expand a filesystem online?

Show answer

Order matters - always expand from bottom up:

1. **Expand block device** (LVM, cloud volume, etc.)
```bash\n# LVM example:\nlvextend -L +10G /dev/vg/lv\n# Or cloud: resize EBS/disk in console, then rescan\n```

2. **Rescan if needed** (for cloud/SAN):
```bash\necho 1 > /sys/class/block/sda/device/rescan\n```

3.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

10. What is the difference between a symbolic link and a hard link?

Show answer

Underneath the file system files are represented by inodes (or is it multiple inodes not sure)

- a file in the file system is basically a link to an inode
- a hard link then just creates another file with a link to the same underlying inode

When you delete a file it removes one link to the underlying inode.

Remember: Hard=same inode, survives deletion, no cross-FS. Soft=path pointer, breaks if deleted. "Hard=twin, Soft=shortcut."

11. What are you using for troubleshooting and debugging disk & file system issues?

Show answer

`dstat -t` is great for identifying network and disk issues.
`opensnoop` can be used to see which files are being opened on the system (in real time).

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

12. Can you check what type of filesystem is used in /home?

Show answer

There are many answers for this question. One way is running `df -T`

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

13. True or False? You can create an hard link for a directory

Show answer

False. Hard links to directories are not allowed on most Unix/Linux systems because they could create filesystem loops, making traversal (find, ls -R) ambiguous and potentially infinite.

Remember: Hard link = another dir entry→same inode. Delete original, link works. No cross-FS.

14. How to extract the content of an archive?

Show answer

Extraction depends on archive type:

tar archives:
- tar xvf archive.tar - Plain tar
- tar xvzf archive.tar.gz - Gzip compressed
- tar xvjf archive.tar.bz2 - Bzip2 compressed
- tar xvJf archive.tar.xz - XZ compressed
- tar xvf archive.tar -C /destination - Extract to specific dir

ZIP:
- unzip archive.zip
- unzip archive.zip -d /destination

7z:
- 7z x archive.7z

List contents without extracting:
- tar tvf archive.tar
- unzip -l archive.zip

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

15. How do you check disk I/O performance on Linux?

Show answer

`iostat -xz 1` from the sysstat package. Key columns: `%util` (device saturation), `await` (avg I/O latency in ms), `r/s` and `w/s` (reads/writes per second), `avgqu-sz` (queue depth). The `-x` flag shows extended stats, `-z` hides idle devices, and `1` samples every second. High %util with high await indicates a disk bottleneck.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

16. What does the lsof command do? Have you used it? What for?

Show answer

lsof (List Open Files) shows files opened by processes.

Use cases:
1. Find what's using a file:
- lsof /var/log/syslog

2. Find what's using a port:
- lsof -i :80
- lsof -i tcp:22

3. Files opened by process:
- lsof -p PID
- lsof -c nginx

4. Find deleted but held files:

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

17. Bind mount vs symlink?

Show answer

Bind mount mirrors a directory at the VFS level—works in chroots/containers.

Symlink is a path reference resolved during pathname lookup.

Remember: Symlink = path pointer. Target deleted→dangling. Can cross FS and link directories.

18. How does Linux handle deleted-but-open files?

Show answer

When a file is deleted but still has open file descriptors, the directory entry is removed but disk space is NOT reclaimed until ALL file descriptors are closed.

The inode and data blocks remain allocated until reference count reaches zero.


Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

19. How to check which disks are currently mounted?

Show answer

Run `mount` with no arguments to list all currently mounted filesystems, their mount points, types, and options. For a cleaner view, use `findmnt` which displays the mount tree, or parse `/proc/mounts` directly.

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

20. Describe the process of extending a filesystem/disk

Show answer

Steps depend on setup (LVM vs direct partition):

With LVM:
1. Add space to PV (if needed): pvresize /dev/sdb
2. Extend LV: lvextend -L +10G /dev/vg/lv
3. Resize filesystem:
- ext4: resize2fs /dev/vg/lv
- xfs: xfs_growfs /mountpoint
(Can do online for most filesystems)

Without LVM:
1. Extend partition (risky, may need unmount)
- parted, fdisk, or growpart
2.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

21. Why does df show free space but writes fail with "no space left"?

Show answer

Common causes: inode exhaustion (`df -i`), reserved blocks, deleted files held open, or quotas.

Remember: `df -h`=sizes, `df -i`=inodes. "df = Disk Free."

22. You run the mount command but you get no output. How would you check what mounts you have on your system?

Show answer

`cat /proc/mounts` shows all mounted filesystems even when the `mount` command produces no output. Alternatives: `findmnt` (tree view), `mount | column -t` (tabular), or `df -hT` (with filesystem types and sizes).
Gotcha: `/proc/mounts` is a symlink to `/proc/self/mounts` and shows the mount namespace of the calling process.

23. Explain the /proc filesystem.

Show answer

`/proc` is a virtual file system that provides detailed information about kernel, hardware and running processes.

Since `/proc` contains virtual files, it is called virtual file system. These virtual files have unique qualities. Most of them are listed as zero bytes in size.


Remember: /proc=process/kernel info. /sys=device/driver. Both virtual — no disk used.

24. How do you find what's holding a deleted file open (preventing disk space from being freed)?

Show answer

Use `lsof +L1` to list files with a link count < 1.

Fix by restarting or killing the process, or truncating via `/proc//fd/`.

Example: `find /var/log -name '*.log' -mtime +30 -delete` — delete old logs.

25. Why do we need package managers? Why not simply creating archives and publish them?

Show answer

Package managers allow you to manage packages lifecycle as in installing, removing and updating the packages.
In addition, you can specify in a spec how a certain package will be installed - where to copy the files, which commands to run prior to the installation, post the installation, etc.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

26. What causes sudden disk full with "no files"?

Show answer

Several possibilities when `df` shows full but `du` shows less:

1. **Deleted-but-open files**: Most common. `lsof +L1` to find.

2. **Inode exhaustion**: `df -i` - millions of tiny files can exhaust inodes before space.

3. **Journal growth**: ext4/XFS journals can grow large.

4. **Reserved blocks**: ext4 reserves 5% for root by default (`tune2fs -m`).


Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

27. What makes /proc different from other filesystems?

Show answer

/proc is a special virtual filesystem in Unix-like operating systems, including Linux, that provides information about processes and system resources.

Remember: /proc=process/kernel info. /sys=device/driver. Both virtual — no disk used.

28. What is an inode? How to find file's inode number and how can you use it?

Show answer

An **inode** is a data structure on a filesystem on Linux and other Unix-like operating systems that stores all the information about a file except its name and its actual data. A data structure is a way of storing data so that it can be used efficiently.


Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

29. What is an inode in Linux and what metadata does it store?

Show answer

For each file (and directory) in Linux there is an inode, a data structure which stores meta data
related to the file like its size, owner, permissions, etc.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

30. ext4 vs XFS - when do you choose each?

Show answer

**XFS**:
* Large files and scale (media, databases, logs)
* Better parallel I/O performance
* Excellent for large filesystems (100TB+)
* Caveat: Cannot shrink - only grow

**ext4**:
* General purpose, simpler recovery

Remember: ext4=default/mature. XFS=RHEL/large files. Btrfs=COW/snapshots/compression.

31. What is the difference between a hard link and a soft (symbolic) link?

Show answer

A hard link is an additional name for the same file (points directly to the same inode/data), whereas a soft link is a special file that points to another file path (like a shortcut).

Remember: Hard=same inode, survives deletion, no cross-FS. Soft=path pointer, breaks if deleted. "Hard=twin, Soft=shortcut."

32. You are trying to create a new file but you get "File system is full". You check with df and find there's free space. What could be the issue?

Show answer

The filesystem likely ran out of inodes, not disk space.

Cause:
- Each file requires an inode (metadata structure)
- Inodes are fixed at filesystem creation
- Many small files can exhaust inodes before space

Diagnosis:
- df -i - Shows inode usage
- Look for IUse% near 100%

Solutions:

Remember: `df -h`=sizes, `df -i`=inodes. "df = Disk Free."

33. Explain three types of journaling in ext3/ext4.

Show answer

There are three types of journaling available in **ext3/ext4** file systems:

- **Journal** - metadata and content are saved in the journal
- **Ordered** - only metadata is saved in the journal. Metadata are journaled only after writing the content to disk. This is the default
- **Writeback** - only metadata is saved in the journal. Metadata might be journaled either before or after the content is written to the disk

Remember: ext4=default/mature. XFS=RHEL/large files. Btrfs=COW/snapshots/compression.

34. Which of the following is not included in inode:

Show answer

File name (it's part of the directory file)

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

35. What is an inode in a Linux filesystem?

Show answer

A data structure that stores metadata about a file or directory (e.g., size, permissions, timestamps).

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

36. How do you determine the appropriate amount of resources (CPU, RAM, storage) for a new server deployment?

Show answer

• Requirements Analysis: Collaborate with stakeholders to gather and analyze requirements, understanding the anticipated workload, user base, and performance expectations. • Performance Benchmarking: Conduct performance benchmarking of similar applications or services to estimate resource needs based on historical data or industry benchmarks. • Capacity Planning: Utilize capacity planning methodologies to forecast resource requirements, considering factors such as growth projections and seasonal variations in demand.

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

37. What are the key differences between ext4 and XFS filesystems?

Show answer

ext4 is the safe default for general use: mature, well-tested, supports online resize (grow only). XFS excels at large files and parallel I/O, making it better for large-scale storage and high-throughput workloads. XFS cannot be shrunk, only grown. Btrfs adds snapshots and checksums but is less proven in production.

Remember: ext4=default/mature. XFS=RHEL/large files. Btrfs=COW/snapshots/compression.

38. How do you create a filesystem on a partition, and what precaution should you take?

Show answer

Use mkfs. (e.g., mkfs.ext4 /dev/sda1 or mkfs.xfs /dev/sdb1). Precaution: mkfs destroys all existing data on the partition. Always verify the target device with lsblk or blkid before running mkfs to avoid formatting the wrong device.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

39. Explain the three-layer LVM abstraction: Physical Volumes, Volume Groups, and Logical Volumes.

Show answer

Physical Volumes (PVs) are raw disks or partitions initialized for LVM. Volume Groups (VGs) pool one or more PVs into a single storage pool. Logical Volumes (LVs) are carved from VGs and are what you format and mount. This enables flexible resizing, snapshots, and spanning across multiple disks.

Remember: LVM: PV→VG→LV. "Disks→pool→partitions."

Example: `pvcreate /dev/sdb && vgcreate myvg /dev/sdb && lvcreate -L 10G -n mylv myvg`

40. What is the difference between GPT and MBR partition schemes, and which tools manage them?

Show answer

MBR is legacy: supports up to 4 primary partitions and 2TB max disk size. GPT is modern: supports up to 128 partitions and disks larger than 2TB. Use fdisk for MBR, gdisk for GPT, or parted for both. GPT is recommended for all new systems.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

41. How do you find which directories are consuming the most disk space?

Show answer

Use du -sh /path/* to show disk usage summary for each item in a directory. du -sh --max-depth=1 / shows top-level directory sizes. Sort with du -sh /path/* | sort -rh to find the largest consumers first.

Example: `find /var/log -name '*.log' -mtime +30 -delete` — delete old logs.

42. A server reports "No space left on device" but df -h shows 40% free disk space. What is the most likely cause and how do you confirm it?

Show answer

Inode exhaustion. Confirm with df -i — if IUse% is 100%, all inodes are consumed and no new files can be created despite free disk space.

Remember: `df -h`=sizes, `df -i`=inodes. "df = Disk Free."

43. How do you find which directory is consuming the most inodes on a filesystem?

Show answer

find / -xdev -printf '%h
' | sort | uniq -c | sort -rn | head — this counts files per directory, staying on the same filesystem (-xdev), and shows the top offenders.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

44. Why should you use find /path -type f -delete instead of rm -rf * to clean up millions of small files?

Show answer

Shell glob expansion in rm -rf * will fail with "Argument list too long" when a directory contains millions of files. find -delete processes files one at a time without shell expansion.

Example: `find /var/log -name '*.log' -mtime +30 -delete` — delete old logs.

45. How do you create an ext4 filesystem with more inodes than the default?

Show answer

Use mkfs.ext4 -N to set an explicit inode count, or mkfs.ext4 -i to set the bytes-per-inode ratio (lower value = more inodes). The default is one inode per 16384 bytes.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

46. What happens if an fstab entry lacks the nofail option and the device is unavailable at boot?

Show answer

The system blocks during boot waiting for the device, potentially rendering the server unbootable. Adding nofail tells systemd to continue boot even if the mount fails.

Remember: fstab fields: device, mount, type, options, dump, check. "DMTODC."

Gotcha: Typo → boot failure. Test: `mount -a`. Use `nofail` for non-critical mounts.

47. What is the difference between hard and soft NFS mount options?

Show answer

hard (default) retries indefinitely — processes hang until the server returns. soft gives up after retrans retries and returns an I/O error to the application.

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

48. How do you find which processes are preventing a filesystem from being unmounted?

Show answer

Use fuser -vm /mount/point to list processes with open files, current directories, or executables on the filesystem. Alternatively, lsof +D /mount/point shows all open file descriptors.

Example: `find /var/log -name '*.log' -mtime +30 -delete` — delete old logs.

49. Why must NFS entries in fstab include the _netdev option?

Show answer

Without _netdev, systemd attempts to mount the NFS share before the network is up, causing the mount to fail or hang during boot.

Remember: fstab fields: device, mount, type, options, dump, check. "DMTODC."

Gotcha: Typo → boot failure. Test: `mount -a`. Use `nofail` for non-critical mounts.

50. How do you use iostat to diagnose disk I/O performance problems?

Show answer

iostat -xz 1 shows per-device I/O statistics updated every second. Key columns: %util (device utilization -- >70% on spinning disk means saturated), await (average I/O latency in ms -- what apps feel), r/s and w/s (read/write operations per second), rrqm/s and wrqm/s (merged requests). On NVMe, %util is misleading due to parallel queues.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

51. How do you identify which process is generating the most disk I/O?

Show answer

Use iotop -oP to show per-process I/O in real-time, displaying only processes actually performing I/O (-o flag). It shows read and write bandwidth per process, helping you pinpoint which application is causing disk pressure.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

52. A server fails to boot because of an /etc/fstab entry. What are the likely causes and how do you fix it?

Show answer

Common causes: wrong UUID (disk replaced or reformatted), missing device, typo in mount point or filesystem type. Fix: boot into single-user mode or rescue media, edit /etc/fstab to correct the entry (use blkid to verify UUIDs), or add nofail mount option to prevent boot failure on missing devices. Always test with mount -a after editing fstab.

Remember: fstab fields: device, mount, type, options, dump, check. "DMTODC."

Gotcha: Typo → boot failure. Test: `mount -a`. Use `nofail` for non-critical mounts.

53. Why do /dev/sdX device names change between reboots, and what should you use instead?

Show answer

/dev/sdX names are assigned by the kernel based on device detection order, which can change when disks are added, removed, or detected in a different sequence. Use UUIDs (from blkid) or filesystem labels in /etc/fstab and scripts. UUIDs are tied to the filesystem and persist regardless of detection order.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

54. How do you quickly check the status of LVM physical volumes, volume groups, and logical volumes?

Show answer

Use pvs (Physical Volume summary), vgs (Volume Group summary), and lvs (Logical Volume summary). These give a one-line-per-item overview of your LVM configuration including sizes, free space, and status. For detailed info, use pvdisplay, vgdisplay, and lvdisplay.

Remember: LVM: PV→VG→LV. "Disks→pool→partitions."

Example: `pvcreate /dev/sdb && vgcreate myvg /dev/sdb && lvcreate -L 10G -n mylv myvg`

55. You have the task of sync the testing and production environments. What steps will you take?

Show answer

Steps to sync testing and production environments:

1. **Snapshot production**: Create DB dump and disk/VM snapshots
2. **Restore to test**: Import snapshots into testing environment
3. **Sanitize data**: Remove/mask sensitive data (PII, credentials)
4. **Sync packages**: Match OS and application versions
5. **Update configs**: Adjust environment-specific settings (hostnames, endpoints, credentials)
6. **Verify**: Run smoke tests to confirm parity

Key principle: Only production is production. Use infrastructure-as-code and deploy scripts to minimize drift.

Example: `du -sh /var/log/*` — size per item. `du -sh --max-depth=1 /` for overview.

56. Can you give a particular example when is indicated to use nobody account? Tell me the differences running httpd service as a nobody and www-data accounts.

Show answer

In Unix, `nobody` is a user account that owns no files and has no special privileges. It is used to run daemons that don't need filesystem access (e.g., memcached).

**nobody vs www-data for httpd:**
- `nobody`: Shared across services. If one service is compromised, attacker gains access to all nobody-owned processes
- `www-data`: Application-specific user. Isolates Apache from other services. Preferred for web servers

Best practice: Use per-service accounts (www-data, postgres, etc.) rather than the shared nobody account. This limits blast radius if a service is compromised.

57. Describe shortly what happens when you execute a command in the shell

Show answer

The shell figures out, using the PATH variable, where the executable of the command resides in the filesystem. It then calls fork() to create a new child process for running the command. Once the fork was executed successfully, it calls a variant of exec() to execute the command and finally, waits the command to finish using wait(). When the child completes, the shell returns from wait() and prints out the prompt again.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

58. You try to create a file but it fails. Name at least three different reason as to why it could happen

Show answer

* No more disk space
* No more inodes
* No permissions

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

59. You executed a script and while still running, it got accidentally removed. Is it possible to restore the script while it's still running?

Show answer

It is possible to restore a script while it's still running if it has been accidentally removed. The running script process still has the code in memory. You can use the /proc filesystem to retrieve the content of the running script.
1.Find the Process ID by running
```\nps aux | grep yourscriptname.sh\n```
Replace yourscriptname.sh with your script name.
2.Once you have the PID, you can access the script's memory through the /proc filesystem.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

🔴 Hard (32)

1. To LVM or not to LVM. What benefits does it provide?

Show answer

- LVM makes it quite easy to move file systems around
- you can extend a volume group onto a new physical volume
- move any number of logical volumes of an old physical one
- remove that volume from the volume group without needing to unmount any partitions
- you can also make snapshots of logical volumes for making backups
- LVM has built in mirroring support so you can have a logical volume mirrored across multiple physical volumes
- LVM even supports TRIM

Remember: LVM: PV→VG→LV. "Disks→pool→partitions."

Example: `pvcreate /dev/sdb && vgcreate myvg /dev/sdb && lvcreate -L 10G -n mylv myvg`

2. What is an Inode, and what happens if a filesystem runs out of them?

Show answer

An inode is a data structure storing file metadata, and running out prevents new file creation.

What an inode contains:
- File type and permissions
- Owner (UID) and group (GID)
- File size
- Timestamps (atime, mtime, ctime)
- Link count (hard links)

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

3. Why is fsync() one of the most dangerous syscalls?

Show answer

fsync() forces synchronous writes through all layers, potentially stalling the entire I/O subsystem.

What fsync() does:
- Flushes file data to stable storage
- Flushes filesystem metadata
- Issues write barriers to hardware
- Waits for confirmation from disk

Why it's dangerous:

1. Stalls entire I/O queue
- Other processes wait behind fsync

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

4. How do you recover a system where /etc is filled and / is read-only?

Show answer

Boot to rescue mode and methodically clean up and fix the underlying issue.

Recovery steps:
1. Boot to rescue/live CD or use recovery mode from GRUB
2. Mount root filesystem: `mount /dev/sda1 /mnt` (adjust device)
3. If read-only, check for errors: `fsck /dev/sda1`
4. Remount read-write: `mount -o remount,rw /mnt`
5. Find large files: `du -ah /mnt/etc | sort -rh | head -20`
6.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

5. Getting Too many Open files error for Postgres. How to resolve it?

Show answer

Fixed the issue by reducing `max_files_per_process` e.g. to 200 from default 1000. This parameter is in `postgresql.conf` file and this sets the maximum number of simultaneously open files allowed to each server subprocess.

Usually people start to edit `/etc/security/limits.conf` file, but forget that this file only apply to the actively logged in users through the PAM system.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

6. What is an inode in Linux, and what happens when you run out of inodes?

Show answer

An inode (index node) is a data structure that stores metadata about a file:
- File type and permissions
- Owner and group IDs
- File size
- Timestamps (access, modification, change)
- Number of hard links

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

7. What fields are stored in an inode?

Show answer

Within a POSIX system, a file has the following attributes which may be retrieved by the stat system call:

- **Device ID** (this identifies the device containing the file; that is, the scope of uniqueness of the serial number).


Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

8. How to increase the size of LVM partition?

Show answer

Use the `lvextend` command for resize LVM partition.

- extending the size by 500MB:

```bash\nlvextend -L +500M /dev/vgroup/lvolume\n```

- extending all available free space:

```bash\nlvextend -l +100%FREE /dev/vgroup/lvolume\n```

and `resize2fs` or `xfs_growfs` to resize filesystem:

- for ext filesystems:

```bash\nresize2fs /dev/vgroup/lvolume\n```

- for xfs filesystem:

```bash\nxfs_growfs mountpoint_for_/dev/vgroup/lvolume\n```

Remember: LVM: PV→VG→LV. "Disks→pool→partitions."

Example: `pvcreate /dev/sdb && vgcreate myvg /dev/sdb && lvcreate -L 10G -n mylv myvg`

9. In what circumstance can df and du disagree on available disk space? How do you solve it?

Show answer

`du` checks usage of directories, but `df` checks free'd inodes, and files can be held open and take space after they're deleted.

**Solution 1**

Check for files on located under mount points. Frequently if you mount a directory (say a sambafs) onto a filesystem that already had a file or directories under it, you lose the ability to see those files, but they're still consuming space on the u

Remember: df=filesystem level. du=directory level. "df=room left, du=who's using it."

10. System freezes for 30-60 seconds randomly. SSH hangs. No kernel panic. Why?

Show answer

This is almost always block layer stalls causing D state process accumulation.

Root causes:
1. Journal commit waits - ext4/XFS waiting for journal flush
2. SAN timeouts - iSCSI/FC target not responding
3. NFS hangs - server unreachable or slow
4. Dying disk - controller retry storms
5.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

11. You deleted an active log file (e.g. /var/log/apache2/access.log) but didn't restart the process. The file appears gone with ls, but disk space isn't freed. How do you recover the space without restarting the service?

Show answer

The process still holds the open file descriptor. The file is "deleted" from the directory but the inode and data blocks remain allocated until the file descriptor is closed.

Recovery steps:
- Run `lsof +L1` or `lsof | grep deleted` to find the PID and FD number
- Truncate the file via the proc filesystem: `truncate -s 0 /proc//fd/`
- Alternative: `: > /proc//fd/` to zero i

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

12. Tell me about the dangers and caveats of LVM.

Show answer

**Risks of using LVM**

- Vulnerable to write caching issues with SSD or VM hypervisor
- Harder to recover data due to more complex on-disk structures
- Harder to resize filesystems correctly
- Snapshots are hard to use, slow and buggy
- Requires some skill to configure correctly given these issues

Remember: LVM: PV→VG→LV. "Disks→pool→partitions."

Example: `pvcreate /dev/sdb && vgcreate myvg /dev/sdb && lvcreate -L 10G -n mylv myvg`

13. What is a file descriptor in Linux?

Show answer

In Unix and related computer operating systems, a file descriptor (FD, less frequently fildes) is an abstract indicator (handle) used to access a file or other input/output resource, such as a pipe or network socket. File descriptors form part of the POSIX application programming interface.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

14. Filesystem reports clean, RAID reports clean, but application data is corrupted. How is this possible?

Show answer

Traditional filesystems and RAID don't protect against silent data corruption.

Root causes:
1. Bit rot - random bit flips in storage media
2. DMA errors - data corrupted during transfer
3. Bad RAM - corruption before data reaches disk
4. Write cache without battery backup - partial writes on power loss
5.

Remember: 0=stripe, 1=mirror, 5=parity(min 3), 10=mirror+stripe. "0=Speed, 1=Mirror, 5=Parity."

15. Why can Btrfs/ZFS still corrupt data even with checksums?

Show answer

Checksums only detect corruption after it happens - they can't prevent all corruption paths.

Corruption vectors that bypass checksums:

1. Bad memory before checksum calculation
- Data corrupted in RAM before ZFS/Btrfs sees it
- Checksum calculated on already-bad data
- ECC memory is the only fix

2.

Remember: ext4=default/mature. XFS=RHEL/large files. Btrfs=COW/snapshots/compression.

16. What is RAID used for? Can you explain the different RAID levels?

Show answer

RAID (Redundant Array of Independent Disks) combines disks for performance and/or redundancy.

Common levels:
- RAID 0: Striping, no redundancy. Fast but risky.
- RAID 1: Mirroring. 2 disks, survives 1 failure.
- RAID 5: Striping with parity. Min 3 disks, survives 1 failure.
- RAID 6: Double parity. Min 4 disks, survives 2 failures.


Remember: 0=stripe, 1=mirror, 5=parity(min 3), 10=mirror+stripe. "0=Speed, 1=Mirror, 5=Parity."

17. Explain dirty pages and writeback in Linux

Show answer

Dirty pages are memory pages modified but not yet written to disk.

**How it works**:
* Writes go to page cache first (fast)
* Kernel marks pages "dirty"
* Background writeback flushes to disk asynchronously
* Sync forces immediate flush

**Key tunables** (`/proc/sys/vm/`):
* `dirty_background_ratio`: Start background writeback at this % of memory (default 10%)

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

18. Explain differences between 2>&-, 2>/dev/null, |&, &>/dev/null, and >/dev/null 2>&1.

Show answer

- a **number 1** = standard out (i.e. `STDOUT`)
- a **number 2** = standard error (i.e. `STDERR`)
- if a number isn't explicitly given, then **number 1** is assumed by the shell (bash)

First let's tackle the function of these.


Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

19. What are the key fields in an /etc/fstab entry, and what does a typical line look like?

Show answer

An fstab entry has 6 fields: device (UUID preferred), mount point, filesystem type, mount options, dump flag (0/1), fsck pass order (0/1/2). Example: UUID=abc-123 /data ext4 defaults,noatime 0 2. The fsck pass order determines check order at boot (0=skip, 1=root, 2=other).

Remember: fstab fields: device, mount, type, options, dump, check. "DMTODC."

Gotcha: Typo → boot failure. Test: `mount -a`. Use `nofail` for non-critical mounts.

20. Describe the Linux storage stack from application down to hardware.

Show answer

Application -> Filesystem (ext4, xfs, btrfs) -> Device Mapper / LVM / mdadm (optional layers) -> Block Device (/dev/sda, /dev/nvme0n1) -> Hardware (SATA, SAS, NVMe, virtio). Device Mapper is the kernel framework underlying LVM, dm-crypt (encryption), and multipath. Each layer adds capability and complexity.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

21. What RAID levels does Linux software RAID (mdadm) support, and when would you use each?

Show answer

RAID 1 (mirror): two copies of data, good for boot drives and small critical volumes. RAID 5 (parity): striping with one parity disk, good read performance, can survive one disk failure. RAID 10 (mirror+stripe): combines mirroring and striping, best performance and redundancy, requires minimum 4 disks. Use mdadm to create and manage software RAID arrays.

Remember: 0=stripe, 1=mirror, 5=parity(min 3), 10=mirror+stripe. "0=Speed, 1=Mirror, 5=Parity."

22. From an inode perspective, what is the difference between a hard link and a symbolic link? Which one consumes an additional inode?

Show answer

A hard link is an additional directory entry pointing to the same inode — it does NOT consume a new inode. A symbolic link is a separate file with its own inode whose content is the target path — it DOES consume an additional inode. Therefore, millions of symlinks can cause inode exhaustion while millions of hard links cannot.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

23. When is an inode's data actually freed on a Linux filesystem?

Show answer

When both conditions are met: the hard link count reaches 0 (no directory entries reference the inode) AND no process has the file open. A deleted file with an open file descriptor continues to occupy disk space until the process closes it.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

24. Can you increase the number of inodes on an existing ext4 filesystem without reformatting? How does XFS handle this differently?

Show answer

No — ext4 inode count is fixed at mkfs time and cannot be changed without reformatting. XFS allocates inodes dynamically by default, so it rarely hits inode exhaustion. However, XFS can still exhaust inodes on large filesystems if the inode64 mount option is not enabled.

Remember: Inode = metadata (perms, size, timestamps, blocks) but NOT filename.

Gotcha: Out of inodes before disk space with millions of tiny files. Check: `df -i`.

25. How do you create a read-only bind mount, and why does it require two steps?

Show answer

First: mount --bind /src /dest. Then: mount -o remount,bind,ro /dest. The initial bind mount ignores ro in the options — you must remount to enforce read-only. Bind mounts are heavily used in containers for volume mounts.

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

26. When would you remount a filesystem read-only on a running system, and how?

Show answer

Use mount -o remount,ro /path when the filesystem shows corruption (prevent further damage), before taking an LVM snapshot, or during emergency disk diagnostics. This avoids a full unmount when processes hold references.

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

27. Describe the recovery procedure when a bad fstab entry prevents a Linux server from booting.

Show answer

Boot into single-user mode or a rescue disk. Remount root read-write with mount -o remount,rw /. Edit /etc/fstab to comment out or fix the bad entry. Reboot normally. Prevention: always run mount -a to test fstab changes before rebooting.

Remember: fstab fields: device, mount, type, options, dump, check. "DMTODC."

Gotcha: Typo → boot failure. Test: `mount -a`. Use `nofail` for non-critical mounts.

28. How do you diagnose a hung NFS mount on a Linux client?

Show answer

Check for processes in uninterruptible sleep (D state) with ps aux | grep " D ". Review NFS client statistics with nfsstat -c. Inspect /proc/self/mountstats for stuck operations. Verify server availability with showmount -e and rpcinfo -p. If soft-mounted, the application gets I/O errors; if hard-mounted, processes block until the server recovers or you force-unmount with umount -f.

Example: `mount -t ext4 /dev/sdb1 /mnt/data`. View: `mount | column -t` or `findmnt`.

29. What is the Device Mapper in Linux, and which storage technologies depend on it?

Show answer

Device Mapper is a kernel framework that provides a generic way to create virtual block devices mapped onto real ones. It underpins LVM (logical volume management), dm-crypt (disk encryption via LUKS), and multipath (redundant storage paths). Understanding Device Mapper helps when debugging why a device is not appearing or performing as expected.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.

30. You need to replace a failed disk in a Linux software RAID array. What is the general procedure?

Show answer

1) Identify the failed disk with mdadm --detail /dev/mdX or cat /proc/mdstat. 2) Remove the failed disk: mdadm --manage /dev/mdX --remove /dev/sdY. 3) Physically replace the disk. 4) Partition the new disk to match the array layout. 5) Add the new disk: mdadm --manage /dev/mdX --add /dev/sdZ. 6) Monitor rebuild: watch cat /proc/mdstat. The array runs degraded during rebuild.

Example: `du -sh /var/log/*` — size per item. `du -sh --max-depth=1 /` for overview.

31. How do you check and change the I/O scheduler for a block device, and which scheduler is best for NVMe vs spinning disk?

Show answer

Check: cat /sys/block/sda/queue/scheduler. Change: echo deadline > /sys/block/sda/queue/scheduler. For spinning disks, deadline or mq-deadline reduces latency for database workloads. For NVMe, use none (no scheduler) since NVMe has its own internal parallelism and scheduling. Set nr_requests to increase queue depth for high-throughput workloads.

Example: `du -sh /var/log/*` — size per item. `du -sh --max-depth=1 /` for overview.

32. How to prevent dd from freezing your system?

Show answer

Try using ionice:

```bash\nionice -c3 dd if=/dev/zero of=file\n```

This start the `dd` process with the "idle" IO priority: it only gets disk time when no other process is using disk IO for a certain amount of time.

Of course this can still flood the buffer cache and cause freezes while the system flushes out the cache to disk. There are tunables under `/proc/sys/vm/` to influence this, particularly the `dirty_*` entries.

Remember: Linux FS knowledge is foundational. `man hier` shows the directory hierarchy.

Gotcha: Back up configs before editing: `cp file file.bak`. One typo can lock you out.