Linux Complete Interview Pack 1: 300 Linux Interview Questions and Answers for Beginner, Mid and Senior Level

Linux is a free, open-source operating system kernel written first by Linus Torvalds in 1991. With GNU tools and other software it forms a full OS (a distribution) used on servers, phones (Android), cloud and embedded devices.

The kernel manages CPU, memory, devices and processes. A distribution (RHEL, Ubuntu, Debian, Amazon Linux) packages the kernel with a shell, libraries, package manager, installer and default configs.

Server side: RHEL, Rocky Linux, AlmaLinux, CentOS Stream, Ubuntu Server, Debian, SUSE, Amazon Linux. Desktop: Ubuntu, Fedora, Linux Mint. Containers: Alpine.

A shell is the program that reads your commands and asks the kernel to run them. Common shells are bash, sh (dash), zsh and fish. echo $SHELL shows your login shell.

Everything starts at / (root). /etc holds config, /var holds changing data like logs, /home holds user folders, /root is root's home, /bin and /usr/bin hold commands, /tmp is temporary, /dev holds device files, /proc and /sys are virtual kernel views, /boot holds the kernel and bootloader files, /opt holds add-on software.

An absolute path starts from / such as /var/log/messages. A relative path starts from the current folder such as logs/app.log or ../conf.

Run pwd (print working directory).

ls -la shows all files (including names starting with a dot) in long format with permissions, owner, size and time. Add -h for human sizes and -t to sort by time.

mkdir -p a/b/c creates all missing parent folders and does not fail if they exist.

cp -r src dst copies recursively. cp -a also keeps permissions, owners, times and links, so it is better for backups.

mv old new renames. mv file /dir/ moves it. Use mv -i to ask before overwriting.

rm -r dir removes it and everything inside. rm -rf forces without prompts; double-check the path because there is no recycle bin. rmdir only removes empty folders.

less file lets you scroll, search with /word and quit with q. cat prints everything at once, head shows the start and tail shows the end.

tail -f /var/log/app.log keeps printing new lines. tail -F also follows the file after log rotation.

It creates an empty file if it does not exist, or updates the modified time of an existing file.

A hard link is another name for the same inode, so it keeps working if the original name is deleted, but it cannot cross file systems or point to directories. A soft (symbolic) link stores a path; it can cross file systems but breaks if the target is removed. Create them with ln and ln -s.

An inode is the record that stores a file's metadata: type, permissions, owner, size, timestamps and data block pointers. The file name lives in the directory entry, not the inode. ls -i shows inode numbers and df -i shows inode usage.

find / -name 'nginx.conf' 2>/dev/null searches the tree. locate nginx.conf is faster but uses a database updated by updatedb.

grep -rn 'error' /var/log searches recursively and shows line numbers. Add -i to ignore case and -l to print only file names.

wc file prints all three. wc -l counts only lines, which is common in pipelines like grep error app.log followed by wc -l.

man ls opens the manual page for ls. Use /word to search inside it. ls --help gives a short summary and man -k keyword searches all manuals.

history lists previous commands. !! repeats the last one, !42 runs entry 42 and Ctrl+R searches history interactively.

> writes output to a file and replaces old content. >> appends to the end of the file.

A pipe (|) sends the output of one command as input to the next, for example ps aux | grep nginx.

diff a b shows line differences, diff -u gives the unified patch style, cmp checks bytes, and md5sum or sha256sum compares checksums.

The first three (rwx) are for the owner: read, write, execute. The next three (r-x) are for the group: read and execute. The last three (r--) are for others: read only. In numbers that is 754.

r=4, w=2, x=1, added per class. 644 is rw-r--r-- (normal file), 755 is rwxr-xr-x (scripts and folders), 600 is rw------- (private keys), 700 is rwx------ (private folder).

x on a directory lets you enter it with cd and reach files inside. r lets you list names, and w lets you create, delete or rename entries.

chmod 640 file sets numbers. chmod u+x script.sh adds execute for the owner. chmod -R g+w dir changes a whole tree.

chown user file, chown user:group file, or chown -R app:app /srv/app for a tree. chgrp changes only the group.

umask removes permissions from new files. With umask 022, new files get 644 and new folders 755. With 027 others get nothing.

useradd -m -s /bin/bash asha creates the user with a home folder and shell. passwd asha sets the password. On Debian adduser asha is the friendly wrapper.

usermod -aG docker asha appends the group. Without -a the user is removed from other secondary groups. The user must log in again to get the new group.

/etc/passwd holds user name, UID, GID, home and shell. /etc/shadow holds password hashes and ageing, readable only by root. /etc/group holds groups.

0. Any account with UID 0 has full root power, so check for extra UID 0 accounts during audits.

su switches to another user (default root) and needs that user's password. sudo runs one command as root using your own password and is logged, and rules in /etc/sudoers decide who can do what.

Use visudo. It checks syntax before saving, so a typo cannot lock everyone out. Put extra rules in files under /etc/sudoers.d/.

whoami prints the user name. id shows UID, GID and all groups. groups lists only group names.

usermod -L user or passwd -l user locks the password. chage -E 0 user expires the account. Setting the shell to /sbin/nologin blocks interactive logins.

userdel -r user removes the account, home folder and mail spool. Back up the home first if needed.

On a folder like /tmp (permissions 1777, shown as t), users can delete only their own files even though everyone can write there.

SUID (4xxx, s in owner x) makes a program run as its owner, like passwd running as root. SGID (2xxx) on a program runs with the group; on a folder new files inherit the folder's group, which is handy for shared team folders.

chage -l user lists last change, expiry and warning days. chage -M 90 user forces a change every 90 days.

who and w show logged-in users; w also shows what they run and load. last shows login history and lastb shows failed logins.

An account for a service (like nginx or mysql) with a low UID, no password and often a nologin shell. Create one with useradd -r -s /sbin/nologin app.

Access Control Lists give extra users or groups permissions beyond owner, group and others. setfacl -m u:ravi:rw file grants access and getfacl file shows it. A + after the permission string in ls -l means an ACL exists.

chsh -s /bin/zsh user or usermod -s /bin/zsh user. The shell must be listed in /etc/shells.

A template folder. Its files (like .bashrc) are copied into every new user's home when useradd -m runs.

One wrong command can destroy the system, and malware or mistakes get full power. Use a normal user and sudo only when needed, which is also logged for audits.

A running instance of a program. Each has a PID, a parent (PPID), an owner, memory and a state such as running or sleeping.

ps aux lists all with CPU and memory. ps -ef shows the parent PID. top and htop show them live. pgrep nginx gives PIDs by name.

kill PID sends SIGTERM (15) so the program can clean up. kill -9 PID sends SIGKILL which cannot be caught; use it last. pkill name and killall name work by name.

The first user-space process started by the kernel. On modern systems it is systemd; it starts services and adopts orphan processes.

A foreground job holds the terminal. Add & to run in the background, Ctrl+Z to pause, bg to resume in background, fg to bring back, and jobs to list.

nohup cmd & ignores the hangup signal and writes output to nohup.out. tmux or screen keep a whole session. For real services use a systemd unit.

Uptime and load average, task counts, CPU split (us, sy, id, wa), memory and swap, then processes sorted by CPU. Press M to sort by memory, P for CPU, k to kill and q to quit.

The average number of tasks running or waiting for CPU or disk, over 1, 5 and 15 minutes. Compare it with the number of CPU cores (nproc); a load of 4 on 4 cores is fully busy.

nice -n 10 cmd starts with lower priority. renice -n 5 -p PID changes a running one. Values go from -20 (highest) to 19 (lowest); only root can raise priority.

A tool that installs, updates and removes software with its dependencies from repositories. RHEL family uses dnf (or yum) with rpm packages; Debian and Ubuntu use apt with deb packages.

RHEL: dnf install nginx and dnf remove nginx. Ubuntu: apt update then apt install nginx and apt remove nginx (apt purge also removes config).

rpm -q nginx or dnf list installed nginx on RHEL. dpkg -l nginx or apt list --installed on Ubuntu.

rpm -qf /usr/sbin/nginx on RHEL, dpkg -S /usr/sbin/nginx on Debian. dnf provides '*/semanage' finds which package gives a missing command.

The init system and service manager on most distributions. It starts services in parallel, tracks them in cgroups, restarts them on failure, handles logs (journald), timers, mounts and targets.

systemctl start nginx, systemctl stop nginx, systemctl restart nginx, systemctl status nginx. reload re-reads config without dropping connections when the service supports it.

systemctl enable nginx creates the boot link. systemctl enable --now nginx enables and starts at once. disable removes it and is-enabled checks it.

journalctl -u nginx shows that unit's logs. Add -f to follow, -b for this boot, --since '1 hour ago' for a window, and -p err for errors only.

Under /var/log: messages or syslog for general logs, secure or auth.log for logins and sudo, dmesg for kernel messages, plus app folders like nginx/ and httpd/.

cat /etc/os-release shows the distribution and version. uname -r shows the kernel version and hostnamectl shows both plus the hostname.

uptime shows how long the system has run plus load average. uptime -p prints it in a friendly form.

crontab -e and add a line like 30 2 * * * /opt/backup.sh to run at 02:30 daily. The five fields are minute, hour, day of month, month and day of week.

at 22:00 then type the command and press Ctrl+D. atq lists jobs and atrm removes one. The atd service must be running.

free -h shows total, used, free and available memory and swap. Look at available, not free, because Linux uses spare RAM for cache.

df -h shows space per mounted file system. du -sh /var/log shows how much one folder uses, and du -h --max-depth=1 / helps find big folders.

tar -czf backup.tgz dir creates a gzip archive and tar -xzf backup.tgz extracts it. Use -tzf to list. zip and unzip handle .zip files; gzip and gunzip handle single files.

ip a (ip addr show) lists interfaces and addresses. hostname -I prints only the IPs. ifconfig is the older tool from net-tools.

ping -c 4 host sends four ICMP echo requests. No reply can also mean ICMP is blocked by a firewall, so also test the real port.

ss -tulpn shows TCP and UDP listening sockets with the process. netstat -tulpn is the older equivalent.

nc -zv host 443, or curl -v telnet://host:443, or timeout 3 bash -c 'echo > /dev/tcp/host/443'. telnet host 443 also works if installed.

Programs ask the resolver, which follows /etc/nsswitch.conf: usually /etc/hosts first, then DNS servers in /etc/resolv.conf (often via systemd-resolved). dig name and nslookup name query DNS directly.

Static name-to-IP mappings that override DNS, handy for testing a new server before DNS changes.

ssh user@host. Use -i key.pem for a key, -p 2222 for another port. ssh -v shows debug details when it fails.

ssh-keygen -t ed25519 creates a key pair. ssh-copy-id user@host puts the public key in ~/.ssh/authorized_keys on the server. Keep ~/.ssh at 700 and authorized_keys at 600.

scp file user@host:/path copies one file; scp -r copies folders. rsync -avz src/ user@host:/dst/ copies only changes and can resume, so it is better for big or repeated copies.

curl -O URL or wget URL. curl -I URL shows only headers, useful to check status codes.

The router that sends traffic outside your network. ip route shows it as the default via line.

hostnamectl set-hostname web01 sets it permanently. Update /etc/hosts too if apps resolve their own name.

22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3306 MySQL, 5432 PostgreSQL, 6379 Redis, 123 NTP, 389 LDAP, 2049 NFS.

TCP is connection based, ordered and reliable with retransmits (web, SSH, databases). UDP is connectionless and faster with no delivery guarantee (DNS queries, video, NTP).

traceroute host or tracepath host shows each hop. mtr host combines ping and traceroute live.

firewall-cmd --state and firewall-cmd --list-all show the active zone, services and ports. On Ubuntu, ufw status does the same.

firewall-cmd --permanent --add-port=8080/tcp then firewall-cmd --reload. For known services use --add-service=http.

timedatectl shows local time, UTC, zone and whether NTP sync is active. timedatectl set-timezone Asia/Kolkata changes the zone.

ssh -L 8080:db:5432 user@bastion makes local port 8080 reach db:5432 through the bastion. -R does the reverse, and -D makes a SOCKS proxy.

ss -ltnp 'sport = :80' or lsof -i :80 shows the PID and program. fuser 80/tcp also prints the PID.

The hardware address of a network card (like 0a:1b:2c:3d:4e:5f) used inside a local network. ip link shows it.

It says which part of an IP is the network. 192.168.1.0/24 means the first 24 bits are network, giving 256 addresses (254 usable hosts).

systemctl reboot or shutdown -r now to reboot; shutdown -h +10 'maintenance' halts in 10 minutes with a warning; shutdown -c cancels.

lscpu for CPU, free -h for RAM, lsblk for disks, lspci and lsusb for devices, dmidecode for vendor and serial (as root).

Named values passed to processes, like PATH, HOME and LANG. env or printenv lists them, export NAME=value sets one for child processes, and you make it permanent in ~/.bashrc or /etc/environment.

A colon-separated list of folders the shell searches for commands. echo $PATH shows it, which cmd or command -v cmd shows where a command is found, and export PATH=$PATH:/opt/tool/bin adds a folder.

lsblk shows block devices as a tree with sizes and mount points. fdisk -l and parted -l show partition tables, and blkid shows UUIDs and file system types.

MBR supports disks up to 2 TB and 4 primary partitions. GPT supports huge disks, 128 partitions by default, keeps a backup header and is needed for UEFI boot.

Partition with fdisk or parted, then mkfs.xfs /dev/sdb1 (or mkfs.ext4), mkdir /data, mount /dev/sdb1 /data, and check with df -h /data.

Add a line to /etc/fstab using the UUID: UUID=... /data xfs defaults,nofail 0 0. Then run mount -a to test before rebooting; a bad fstab line can stop boot.

Device (UUID or path), mount point, file system type, options (defaults, noatime, nofail), dump flag and fsck order (0 skip, 1 root, 2 others).

Logical Volume Manager puts disks (physical volumes) into a pool (volume group) and cuts flexible logical volumes from it. You can grow volumes, add disks and take snapshots without repartitioning.

pvcreate /dev/sdb, vgcreate vgdata /dev/sdb, lvcreate -n lvapp -L 10G vgdata, mkfs.xfs /dev/vgdata/lvapp, then mount it. Check with pvs, vgs and lvs.

lvextend -r -L +5G /dev/vgdata/lvapp grows the volume and the file system together (-r). Without -r run xfs_growfs /mount for XFS or resize2fs for ext4. If the VG is full, add a disk with vgextend first.

No. XFS can only grow. To shrink, back up, recreate smaller and restore. ext4 can shrink but only while unmounted.

Both are journaling file systems. XFS is the RHEL default, scales well for large files and parallel I/O, and cannot shrink. ext4 is the Debian and Ubuntu default, can shrink offline and is very mature.

Disk space used when RAM is full. Add a swap file: fallocate -l 2G /swapfile, chmod 600 /swapfile, mkswap /swapfile, swapon /swapfile, and add it to /etc/fstab. swapon --show lists swap.

vm.swappiness (0 to 100) controls how eagerly the kernel swaps. Databases often use 1 to 10 so memory stays in RAM. Set it with sysctl vm.swappiness=10 and save it under /etc/sysctl.d/.

Inodes may be full, often from millions of tiny files like sessions or mail queue. Check df -i, find the folder with the most files, and clean it.

A deleted file is still held open by a process, so its space is not freed. Find it with lsof +L1 or lsof | grep deleted and restart that process, or truncate it through /proc/PID/fd/N.

Unmount it first. fsck -f /dev/sdb1 for ext4, xfs_repair /dev/sdb1 for XFS. For the root file system boot into rescue mode.

RAID combines disks for speed or safety. RAID 0 stripes (fast, no safety), RAID 1 mirrors, RAID 5 stripes with parity (one disk can fail), RAID 6 allows two failures, RAID 10 mirrors and stripes. On Linux software RAID uses mdadm.

A point-in-time copy of a volume, made with lvcreate -s -n snap -L 2G /dev/vg/lv. Use it for consistent backups or a quick rollback before an upgrade; it only stores changed blocks, so give it enough space.

Install nfs-utils, then mount -t nfs server:/export /mnt. In fstab use server:/export /mnt nfs defaults,_netdev 0 0. showmount -e server lists exports.

It stops updating the access time on every read, which reduces writes and helps busy servers. relatime (the default) is a lighter middle ground.

find / -xdev -type f -size +500M -exec ls -lh {} + or du -ah /var | sort -rh | head -20. ncdu gives an interactive view.

For SCSI or virtual disks: echo '- - -' > /sys/class/scsi_host/host0/scan, or rescan-scsi-bus.sh. On cloud NVMe disks the new device usually appears by itself; check lsblk.

sda is the name for SATA, SAS or SCSI disks. nvme0n1 is the first namespace on the first NVMe controller, with partitions named nvme0n1p1. Names can change between boots, so use UUIDs in fstab.

growpart /dev/nvme0n1 1 grows the partition, then xfs_growfs / or resize2fs /dev/nvme0n1p1 grows the file system. lsblk confirms the new size.

iostat -xz 2 (from sysstat) shows utilisation, await and queue per device. iotop shows which process does the I/O.

mount --bind /src /dst makes the same folder visible at a second path. Containers and chroot setups use it a lot.

Firmware (BIOS or UEFI) runs POST and loads the bootloader (GRUB2). GRUB loads the kernel and initramfs. The kernel starts drivers, mounts the root file system using initramfs, then starts PID 1 (systemd), which reaches the default target and starts services and the login prompt.

A small temporary root file system loaded with the kernel. It has the drivers and tools needed to find and mount the real root (LVM, RAID, encryption). Rebuild it with dracut -f on RHEL or update-initramfs -u on Ubuntu.

Groups of units that describe a system state, replacing runlevels. multi-user.target is like runlevel 3 (text, network), graphical.target is runlevel 5, rescue.target is single user. systemctl get-default and set-default manage the boot target.

Create /etc/systemd/system/app.service with [Unit] Description and After=network.target, [Service] ExecStart=/opt/app/run, User=app, Restart=on-failure, and [Install] WantedBy=multi-user.target. Then systemctl daemon-reload and systemctl enable --now app.

Requires= makes the unit fail or stop if the dependency fails. Wants= is a soft dependency that starts the other unit but does not care if it fails. Neither sets order; use After= for that.

systemctl edit nginx opens a drop-in file in /etc/systemd/system/nginx.service.d/override.conf. Only your changes go there, so package updates do not overwrite them. systemctl cat nginx shows the merged result.

systemctl --failed or systemctl list-units --state=failed. Then journalctl -u name -b to see why, and systemctl reset-failed to clear old entries.

systemd-analyze shows total boot time, systemd-analyze blame lists units by start time and systemd-analyze critical-chain shows the slow path.

Create /var/log/journal (or set Storage=persistent in /etc/systemd/journald.conf) and restart systemd-journald. Then journalctl -b -1 shows the previous boot.

journalctl --disk-usage shows it. journalctl --vacuum-size=500M or --vacuum-time=7d trims it, and SystemMaxUse= in journald.conf caps it.

A tool run daily that rotates, compresses and deletes old logs based on rules in /etc/logrotate.conf and /etc/logrotate.d/. Options include daily, rotate 7, compress, missingok and postrotate to reload the app. Test with logrotate -d.

create renames the log and makes a new file, so the app must reopen it (signal or reload). copytruncate copies then empties the file in place, which works for apps that cannot reopen logs but may lose a few lines.

Reboot, press e at GRUB, add rd.break to the linux line, press Ctrl+X. Then mount -o remount,rw /sysroot, chroot /sysroot, passwd root, touch /.autorelabel for SELinux, exit twice.

grubby --update-kernel=ALL --args='param=value' on RHEL, or edit GRUB_CMDLINE_LINUX in /etc/default/grub and run grub2-mkconfig -o /boot/grub2/grub.cfg (update-grub on Ubuntu).

It prints the kernel ring buffer: hardware detection, driver errors, disk errors, OOM kills and network link changes. dmesg -T shows human times and journalctl -k gives the same with the journal.

A unit (name.timer) that starts a matching service on a schedule, like OnCalendar=daily or OnBootSec=5min. It logs to the journal, can catch up missed runs with Persistent=true, and systemctl list-timers shows next runs.

systemctl mask name links it to /dev/null so nothing can start it, even as a dependency. unmask reverses it. Use it to stop conflicts like iptables and firewalld.

In the unit or a drop-in: MemoryMax=1G, CPUQuota=50%, TasksMax=200. systemd applies them through cgroups. systemd-cgtop shows live usage.

systemd restarts the service when it exits with an error, is killed by a signal or times out. RestartSec= sets the wait and StartLimitBurst= stops endless restart loops.

At GRUB add systemd.unit=rescue.target (basic system, root password) or systemd.unit=emergency.target (only root mounted read-only). From a running system use systemctl isolate rescue.target.

The classic syslog daemon. It receives logs (often forwarded from journald) and writes them to files like /var/log/messages, and it can forward to a central server over TCP or UDP port 514.

In rsyslog add *.* @@logserver:514 (@@ is TCP, @ is UDP) in /etc/rsyslog.d/remote.conf and restart rsyslog. Many teams use agents like Fluent Bit or the CloudWatch agent instead.

rpm -q kernel lists them, grubby --default-kernel shows the default and grubby --set-default /boot/vmlinuz-VERSION changes it.

modprobe name loads it with dependencies, lsmod lists loaded modules, modinfo name shows details and modprobe -r removes it. Files in /etc/modules-load.d/ load at boot.

sysctl -w net.ipv4.ip_forward=1 changes it now. Put the line in /etc/sysctl.d/99-custom.conf and run sysctl --system to make it permanent. sysctl -a lists all.

nmcli con mod eth0 ipv4.method manual ipv4.addresses 10.0.1.20/24 ipv4.gateway 10.0.1.1 ipv4.dns 10.0.0.2 then nmcli con up eth0. nmtui gives a menu.

Ubuntu's network config in YAML under /etc/netplan/. Edit the file, run netplan try (auto rollback) and then netplan apply.

ip route add 10.20.0.0/16 via 10.0.1.1 adds it now. For permanence use nmcli con mod eth0 +ipv4.routes '10.20.0.0/16 10.0.1.1' or the routes section in netplan.

tcpdump -i eth0 -nn port 443 prints packets live. Add -w file.pcap to save for Wireshark, and host 10.0.1.5 to filter one host.

firewalld is a manager with zones (public, internal, trusted) and services, and it changes rules without dropping connections. It uses nftables underneath on new systems. iptables is the older direct rule tool with chains like INPUT and FORWARD.

Use a rich rule: firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/16 port port=5432 protocol=tcp accept' then --reload. Or add the source to a zone.

In /etc/ssh/sshd_config: PermitRootLogin no, PasswordAuthentication no, use keys, AllowUsers or AllowGroups, MaxAuthTries 3, and maybe a non-default port. Test with sshd -t, then systemctl reload sshd. Add fail2ban for brute force.

Mandatory access control on RHEL. Every process and file has a label (context), and policy decides who can access what, even for root. Modes are enforcing, permissive and disabled; getenforce and sestatus show them.

Check with ls -Z and ausearch -m avc -ts recent. Set the right type: semanage fcontext -a -t httpd_sys_content_t '/srv/web(/.*)?' then restorecon -Rv /srv/web. Do not disable SELinux.

semanage port -a -t http_port_t -p tcp 8081 adds the port to the allowed type. semanage port -l lists existing ones.

On or off switches for parts of policy, like httpd_can_network_connect. getsebool -a lists them and setsebool -P name on sets one permanently.

The Ubuntu and SUSE alternative to SELinux. It uses path-based profiles in /etc/apparmor.d/ with enforce and complain modes. aa-status shows them.

A service that watches logs for repeated failures (like SSH logins) and bans the source IP in the firewall for a while. Configure jails in /etc/fail2ban/jail.local and check with fail2ban-client status sshd.

ss -tan shows all TCP connections with state. ss -tan state established | wc -l counts them and ss -s gives a summary.

The side that closed a TCP connection keeps it for a short time to catch late packets. Many TIME_WAIT sockets are normal on busy clients; use keepalive and connection pooling if ports run out.

openssl s_client -connect host:443 -servername host shows the chain. Pipe it to openssl x509 -noout -dates -subject to see expiry and name. curl -vI https://host also shows it.

It stores per-host settings like HostName, User, Port, IdentityFile and ProxyJump, so ssh prod works instead of a long command.

A hardened server in a public subnet used as the only way into private servers. ssh -J user@bastion user@private connects through it in one step.

dig +short example.com A gives the IP, dig @8.8.8.8 example.com tests a specific resolver and getent hosts example.com shows what the system actually resolves (including /etc/hosts).

chronyd keeps the clock in sync with time servers. Wrong time breaks TLS certificates, Kerberos, log order and distributed databases. chronyc sources and chronyc tracking show sync status.

Combining two or more NICs into one logical link for failover (active-backup) or more bandwidth (802.3ad LACP). Configure with nmcli con add type bond.

auditd records events from rules: auditctl -w /etc/passwd -p wa -k passwd_change watches writes. ausearch -k passwd_change and aureport show results. Put rules in /etc/audit/rules.d/.

RHEL: dnf update --security or dnf updateinfo list security. Ubuntu: unattended-upgrades handles security updates automatically.

find / -xdev -perm -4000 -type f lists them. Compare against a known list; an unexpected SUID binary can be a backdoor.

ss -tulpn and look for 0.0.0.0 or [::] binds on databases, Redis or admin ports. Bind them to 127.0.0.1 or a private IP and block with the firewall.

us is user code, sy is kernel work, wa is waiting for disk I/O, st is steal time taken by the hypervisor on VMs. High wa points to storage, high st to a noisy neighbour or too small an instance.

vmstat 2 prints every 2 seconds: run queue (r), blocked (b), swap in and out (si, so), I/O (bi, bo) and CPU split. Non-zero si and so means memory pressure.

From sysstat, it records performance history every 10 minutes. sar -u for CPU, sar -r for memory, sar -d for disks, sar -n DEV for network, and sar -f /var/log/sa/sa25 for a past day.

When memory and swap run out, the kernel kills the process with the highest oom_score to save the system. dmesg or journalctl -k shows Out of memory: Killed process lines. Tune with oom_score_adj or fix the leak.

A process that has exited but whose parent has not read its exit status, shown as Z or defunct. It uses no CPU or memory, only a PID. Fix the parent or restart it; you cannot kill a zombie directly.

Uninterruptible sleep, usually waiting on disk or NFS I/O. It cannot be killed until the I/O returns. Many D processes raise load average even with idle CPU.

It shows the system calls a process makes. strace -p PID attaches to a running one, strace -f follows children, strace -e trace=open,connect filters. Great for finding missing files or hung network calls.

Lists open files, which on Linux includes sockets and pipes. lsof -p PID for one process, lsof -i :443 for a port, lsof /var/log/app.log for who holds a file.

Per-process limits like open files (-n) and processes (-u). ulimit -a shows them. Set permanent limits in /etc/security/limits.conf for login sessions, or LimitNOFILE= in a systemd unit for services.

The process reached its file descriptor limit, often from leaking connections or a low default of 1024. Check ls /proc/PID/fd | wc -l and cat /proc/PID/limits, then raise LimitNOFILE and fix leaks.

ps aux --sort=-%mem | head or top then press M. smem gives a fair proportional view. Remember shared memory is counted in each process RSS.

Spare RAM used to cache file data. It shows as buff/cache in free and is released when apps need memory, which is why available matters more than free.

The shebang, like #!/bin/bash or #!/usr/bin/env bash. It tells the kernel which interpreter runs the file when you execute it directly.

-e exits on a failing command, -u errors on unset variables, and pipefail makes a pipeline fail if any part fails. Together they stop scripts from silently continuing after errors.

echo $? prints it. 0 means success and any other number means failure. if cmd; then ... tests it directly.

$0 is the script name, $1 the first argument, $# the number of arguments and "$@" all arguments as separate words (always quote it).

while IFS= read -r line; do echo "$line"; done < file. IFS= keeps spaces and -r keeps backslashes.

cmd > out.log 2>&1 or in bash cmd &> out.log. Order matters: 2>&1 must come after the file redirect.

awk '{print $2}' file. For a CSV use awk -F, '{print $2}' file or cut -d, -f2 file.

sed -i 's/old/new/g' file edits in place. Use sed -i.bak to keep a backup and test first without -i.

awk '{print $1}' access.log | sort | uniq -c | sort -rn | head shows the busiest clients.

A loop with ssh: for h in $(cat hosts); do ssh "$h" uptime; done. For real fleets use Ansible (ansible all -m ping), pssh or SSM Run Command.

The soft limit is what applies now and a user can raise it up to the hard limit. Only root can raise the hard limit. ulimit -Sn and ulimit -Hn show both.

Locally top, htop, vmstat, iostat, sar, ss and journalctl. For fleets, Prometheus with node_exporter and Grafana, Zabbix, Nagios, Datadog or CloudWatch, with alerts on CPU, memory, disk, inodes and service health.

last -x reboot shutdown shows reboot times, journalctl --list-boots then journalctl -b -1 -e shows the end of the last boot, and look for kernel panic, OOM, watchdog or a planned update in logs.

The shell reads and parses the line, expands aliases and globs, finds ls via PATH, calls fork() to create a child, the child calls execve() to load /usr/bin/ls, the kernel maps the binary and libraries, ls makes system calls like openat and getdents64 to read the folder and write to print, then exits, and the shell's wait() collects the exit status.

Both are tasks to the kernel, created by clone(). Threads share the address space, open files and signal handlers of their process; processes have separate memory. ps -eLf or top -H shows threads.

Control groups limit and account for CPU, memory, I/O and process counts for groups of processes. systemd and container runtimes use them. cgroup v2 is a single unified tree under /sys/fs/cgroup.

Kernel features that give a process its own view of PIDs, network, mounts, hostname (UTS), IPC, users and cgroups. Containers are processes with namespaces plus cgroups. lsns lists them and nsenter enters one.

Each process sees its own virtual address space split into pages (usually 4 KB). The MMU maps pages to physical RAM through page tables; missing pages cause page faults that load from disk or allocate memory. This allows isolation, overcommit, shared libraries and swap.

Pages of 2 MB or 1 GB instead of 4 KB, which reduce TLB misses for big memory apps like Oracle, SAP HANA or DPDK. Static huge pages are set with vm.nr_hugepages. Transparent Huge Pages are automatic, but many databases recommend turning THP off because of latency spikes.

Linux lets processes allocate more virtual memory than exists, assuming not all is used. vm.overcommit_memory=0 is heuristic, 1 always allows, 2 strict with overcommit_ratio. When real use exceeds RAM and swap, the OOM killer acts.

Load counts tasks in D state too. Check vmstat for b and wa, iostat -x for disk await and util, ps -eo stat,pid,cmd | grep '^D' for blocked tasks, and check NFS or storage latency. The fix is usually storage, not CPU.

For every resource (CPU, memory, disk, network) check Utilisation, Saturation and Errors. It is a quick checklist by Brendan Gregg that avoids random guessing during incidents.

The Linux profiler. perf top shows hot functions live, perf record -g -p PID then perf report shows call stacks, and perf stat counts CPU events. Flame graphs are built from perf data.

A safe way to run small programs inside the kernel. Tools from bcc and bpftrace like execsnoop, opensnoop, biolatency and tcpretrans give deep visibility with low overhead; Cilium and Falco use it for networking and security.

They order disk requests. Modern multi-queue options are none (best for NVMe), mq-deadline (good default for SSD and virtual disks), bfq (desktop fairness) and kyber. See and change via /sys/block/sda/queue/scheduler.

A RHEL service that applies tuning profiles like throughput-performance, latency-performance, virtual-guest or postgresql. tuned-adm list, tuned-adm active and tuned-adm profile NAME manage them.

net.core.somaxconn and tcp_max_syn_backlog for accept queues, net.ipv4.ip_local_port_range for outgoing ports, tcp_tw_reuse for many short connections, fs.file-max and LimitNOFILE for descriptors, and netdev_max_backlog for packet bursts. Change one at a time and measure.

A fatal kernel error that stops the system. Configure kdump (crashkernel= boot parameter and kdump service) to save a vmcore in /var/crash, then analyse it with the crash tool or send it to the vendor.

The kernel reports a CPU stuck in kernel code for over 20 seconds (soft lockup) or a task in D state for over 120 seconds (hung task). Causes include storage stalls, driver bugs or an overloaded hypervisor.

On multi-socket servers memory is attached to each CPU socket; local access is faster than remote. numactl --hardware shows nodes, numastat shows misses and numactl --cpunodebind binds a process. Databases may need NUMA-aware settings.

VSZ is total virtual memory mapped. RSS is physical memory used including shared pages. PSS divides shared pages among users, so the sum of PSS is the real total. smem and /proc/PID/smaps_rollup show PSS.

Track RSS over time (ps or sar), look at /proc/PID/smaps for growing regions, use the language tool (pmap, valgrind, jmap for Java, tracemalloc for Python) and as a short-term fix set MemoryMax and restart on schedule while the bug is fixed.

fork() makes a copy of the current process (copy-on-write). exec() replaces the current program with a new one in the same PID. Shells use fork then exec to run commands.

After fork, parent and child share the same memory pages until one writes, and only then is that page copied. It makes fork fast and saves memory.

Signals are small async messages to a process: SIGTERM asks to stop, SIGKILL forces, SIGHUP often means reload, SIGINT is Ctrl+C, SIGCHLD tells a parent a child ended. Processes can catch or ignore most except SIGKILL and SIGSTOP.

A virtual file system showing kernel and process data. /proc/PID/status, cmdline, fd, limits and environ for a process; /proc/meminfo, cpuinfo, loadavg, mounts and /proc/sys for tunables.

Use kpatch on RHEL or Canonical Livepatch on Ubuntu to apply critical security fixes without reboot. You still reboot later in a maintenance window to load the full new kernel.

A minor fault maps a page already in memory (like a shared library or cache). A major fault needs disk I/O to load the page, which is slow. Many major faults mean memory pressure.

Confirm the symptom with curl -w timings from inside and outside. Check the server with uptime, top, free, df, iostat and ss -s. Read web and app logs for errors and slow requests, check the database (slow log, connections), DNS and any recent deploys. Fix the bottleneck found, communicate status, and write a post-mortem.

Network: ping, nc -zv host 22, security groups or firewall. Service: use the cloud console or serial console to check sshd status and logs. Auth: ssh -v for key errors, permissions on ~/.ssh, a full disk, a changed host key, or fail2ban bans. Also check whether the host is up at all.

Find growth with du -xh --max-depth=1 / | sort -h, check /var/log, /tmp, core dumps, old kernels and package cache. Check deleted-but-open files with lsof +L1. Clean safely (truncate big logs, vacuum the journal, dnf clean all), then fix the cause with logrotate, alerts or a bigger disk.

Boot to emergency mode (or use the cloud rescue instance), remount root rw with mount -o remount,rw /, fix or comment the bad line, use UUIDs and nofail, run mount -a to test and reboot.

Check systemctl status and journalctl -u name -n 50, test the config with the app's own check (nginx -t, httpd -t, sshd -t), check file permissions, SELinux denials and port conflicts, then roll back to the last good config if needed.

top or pidstat 1 to find the process, top -H -p PID for the thread, perf top or a language profiler (jstack for Java, py-spy for Python) for the hot code. Check for loops after a deploy, crypto miners, or a traffic spike. Use renice or limits only as a stopgap.

Confirm with vmstat si and so, find the biggest users by RSS, check for leaks or a too-large cache setting (like JVM heap or DB buffer), and add RAM or reduce memory. Lower swappiness only after the real fix.

From the app host: resolve the name (getent hosts), test the port (nc -zv db 5432), check firewall and security groups, check database listen address and max connections, test credentials with the client (psql or mysql), and read both app and DB logs.

dig talks to DNS directly but apps use the system resolver through nsswitch. Check /etc/nsswitch.conf, /etc/hosts, systemd-resolved (resolvectl status), search domains, IPv6 AAAA issues, and app-level DNS caching like the JVM TTL.

Check crond is running, the cron log (journalctl -u crond or /var/log/cron), the crontab syntax and user, that the script is executable, uses full paths (cron has a tiny PATH), and that % signs are escaped. Redirect output to a log to see errors.

SELinux or AppArmor labels, ACLs, a parent folder missing x, the file system mounted read-only or noexec, immutable attributes (lsattr shows i), wrong group until re-login, or NFS root squash.

It is in D state waiting on I/O (often NFS or a failing disk) or it is a zombie whose parent has not reaped it. Fix the storage, unmount NFS with -f or -l, or restart the parent; sometimes only a reboot clears it.

Logs go out of order, TLS and token checks fail, and clusters can split. Check timedatectl and chronyc tracking, make sure chronyd is enabled and can reach NTP on UDP 123, and use the cloud provider's time source like 169.254.169.123 on AWS.

Treat it as hardware failure: check smartctl -a, move traffic away, take a backup or snapshot if possible, replace the disk (or the instance in cloud) and rebuild RAID. Do not run fsck repeatedly on a failing disk.

Choose the previous kernel in the GRUB menu, boot, then set it as default with grubby and investigate (missing driver, initramfs issue). Remove or fix the bad kernel and keep at least two kernels installed.

The remote side closed but your application has not closed its socket, which is an application bug (missing close or stuck threads). Restarting helps for now, but the code must be fixed.

If auditd watched it, ausearch -f path shows the user and command. Otherwise check shell histories, sudo logs in secure or auth.log, application logs and backups. For the future add an audit rule.

Find it with lsof | grep deleted, note the PID and fd number, then copy it back with cp /proc/PID/fd/N /restore/path.

ip -s link and ethtool -S eth0 for NIC drops, netstat -s or nstat for TCP retransmits and listen overflows, ss -lnt for full accept queues, and conntrack -S if the conntrack table is full. Tune buffers, queues or scale out.

Raise net.netfilter.nf_conntrack_max and the hash size, reduce timeouts for short connections, or skip tracking for high-volume traffic with notrack rules. It is common on NAT gateways and busy load balancers.

Isolate it from the network but keep it running for evidence, take a memory and disk snapshot, check last, w, unusual processes, crontabs, new users, authorized_keys, outbound connections (ss -tp) and recently changed binaries (rpm -Va). Inform security, rotate credentials and rebuild from a clean image rather than cleaning in place.

Different environment: limited PATH, no HOME or proxy variables, different user, no terminal, different working folder and SELinux context. Use full paths, set variables explicitly and log stdout and stderr.

Compare that node: curl the health URL locally, check the service, disk, memory and logs, firewall rules, time sync, recent config drift and whether it was deployed with a different version. Remove it from rotation while fixing.

Write a blameless timeline (detection, impact, actions), the root cause and contributing factors, what went well and badly, and action items with owners and dates, like alerts, runbooks or automation. Share it and track the actions.

Minimal install, patch fully, create named admin users with sudo, SSH keys only and no root login, firewall default deny, SELinux enforcing, disable unused services, set password and lockout policy, enable auditd, time sync and central logging, and scan with a CIS benchmark tool such as OpenSCAP.

A free community guide of security settings for each OS, with Level 1 (safe for most) and Level 2 (stricter) controls. Tools like OpenSCAP or Ansible roles apply and check it.

Pluggable Authentication Modules let programs like sshd and sudo use stacked modules from /etc/pam.d/ for auth, account, password and session steps. Examples: pam_faillock for lockout, pam_pwquality for password rules, pam_limits for ulimits.

Do not store them in scripts or Git. Use a vault (HashiCorp Vault, AWS Secrets Manager or SSM Parameter Store), give access through roles, keep files at 600 owned by the service user, and rotate regularly.

Join servers to a directory: FreeIPA or Active Directory through SSSD and realmd (realm join). This gives one place for users, groups, sudo rules, Kerberos SSO and SSH keys.

LUKS with cryptsetup: cryptsetup luksFormat /dev/sdb, cryptsetup open /dev/sdb secure, then mkfs and mount /dev/mapper/secure. Use /etc/crypttab for boot, and Clevis with a TPM or Tang server for automatic unlock. In cloud, use the provider's encrypted volumes.

rpm -Va compares installed files to package checksums (debsums on Debian). AIDE builds a baseline database and reports changes on later runs.

Give each user and service only what it needs: service accounts with nologin, narrow sudo rules for specific commands, file permissions 640 or 600 for secrets, SELinux confinement, and no shared root passwords.

In /etc/sudoers.d/web: %webops ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx, /usr/bin/systemctl status nginx. Avoid giving editors, shells or wildcards that allow escaping to root.

Find affected hosts from inventory (package versions), assess exposure, test the patch on staging, roll out in waves with automation (Ansible, SSM Patch Manager, Satellite), restart or live patch as needed, verify versions and report compliance.

chroot changes the root folder a process sees. It is useful for rescue and builds, but a root process can escape it, so it is not a strong security boundary; use containers with namespaces or VMs.

Root power split into pieces like CAP_NET_BIND_SERVICE (bind low ports) or CAP_SYS_ADMIN. Give a program only one with setcap cap_net_bind_service=+ep /usr/bin/app or AmbientCapabilities= in systemd.

Add options like NoNewPrivileges=yes, ProtectSystem=strict, ProtectHome=yes, PrivateTmp=yes, ReadWritePaths=/var/lib/app and CapabilityBoundingSet=. systemd-analyze security name scores the result.

SSH uses asymmetric keys (like ed25519) to authenticate and agree on a session key through key exchange, then fast symmetric ciphers (like AES or ChaCha20) encrypt the traffic.

Keep keys in central config (Ansible, IPA or SSH certificates), add the new key, test login, then remove the old key from authorized_keys everywhere. SSH certificates with short expiry avoid manual rotation entirely.

Set nproc limits in /etc/security/limits.conf, use TasksMax in systemd slices, and memory limits per user slice.

Look at crontab -l for each user (or /var/spool/cron), /etc/crontab, /etc/cron.d, cron.daily and friends, plus systemctl list-timers. Compare with configuration management.

Servers are never patched by hand; you build a new image (Packer, golden AMI) and replace instances. Admins focus on image pipelines, config as code and automated rollouts instead of fixing snowflake servers.

Ship them off the host in real time (rsyslog over TLS, a log agent, or SIEM), store them in write-once storage, and restrict who can delete logs centrally.

A setting that limits crypto to FIPS 140 validated algorithms, needed in some government and finance work. On RHEL enable it with fips-mode-setup --enable and reboot; test apps because some old ciphers stop working.

Ship logs to a central tool with role-based access, or give a group read access with ACLs on the log folder and a limited sudo rule for journalctl -u app, without full shell or root.

Authentication proves who you are (password, key, MFA). Authorisation decides what you are allowed to do (permissions, sudo rules, SELinux policy).

Use pam_google_authenticator or a vendor PAM module, set KbdInteractiveAuthentication yes and AuthenticationMethods publickey,keyboard-interactive in sshd_config. Keep a break-glass path tested.

Run OpenSCAP (oscap xccdf eval with a CIS or STIG profile) or tools like Lynis, export the report, and fix gaps through Ansible so drift is corrected on every run.

An emergency admin login kept sealed (password in a safe or vault, heavy alerting on use) for when SSO or keys fail. Test it regularly and rotate after any use.

At least two servers in different zones behind a load balancer with health checks, stateless apps with sessions in Redis or a DB, shared or replicated storage, config from code, auto scaling, monitoring and tested failover.

The classic Linux HA cluster stack. Corosync handles membership and quorum, Pacemaker moves resources like a VIP, file system or database between nodes. Fencing (STONITH) is required to avoid split brain.

Two cluster nodes both think they are primary and write data independently. Prevent it with quorum (odd number of voters or a witness), fencing to power off the lost node, and reliable cluster networks.

A daemon that uses VRRP to float a virtual IP between two or more servers (like HAProxy or Nginx nodes) and runs health check scripts to move the IP on failure.

Decide RPO and RTO, back up data and configs (not just disks), use the 3-2-1 rule, automate with tools like restic, Borg, Bacula or cloud snapshots, encrypt, monitor job results, and test restores regularly.

RPO (recovery point objective) is how much data loss is acceptable, like 15 minutes. RTO (recovery time objective) is how long you can be down, like 1 hour. They drive backup frequency and DR design.

Configuration management such as Ansible, Puppet, Chef or Salt, with code in Git, code review, idempotent roles, inventory from the cloud API, and regular runs to correct drift.

Running the same task many times gives the same result without extra changes, like ensure a package is installed rather than install again. It makes automation safe to rerun.

Group servers into waves, drain each from the load balancer, patch and reboot, run health checks, add back, then continue. Automate with Ansible serial, SSM maintenance windows or rolling instance refresh, and stop on failure.

VMs virtualise hardware and each runs a full kernel. Containers share the host kernel and isolate processes with namespaces and cgroups, so they start in milliseconds and are lighter but share kernel risk.

cgroups and namespaces, container runtimes (containerd, crictl), networking (iptables or nftables, IPVS, CNI, DNS), storage mounts, kubelet logs in journald, kernel parameters and resource pressure like OOM and disk pressure.

Use Packer to start from a base image, apply hardening and agents with Ansible, run tests (CIS scan, smoke tests), then publish a versioned AMI or template. Rebuild monthly or on critical CVEs.

CPU and load per core, memory available and swap, disk space and inodes with prediction, disk latency, network errors, service up checks, certificate expiry, failed systemd units, time drift and backup success. Alert on symptoms that need action, not on every spike.

A service level objective is a target like 99.9 percent of requests under 300 ms. Ops work (capacity, patching, alerts) is planned to protect it, and the error budget decides how much risk changes can take.

Collect trends for CPU, memory, disk and network, find the peak and growth rate, keep headroom (often 30 to 40 percent), load test before big events, and use auto scaling where possible.

Inventory packages and configs, check app support for the new versions (Python, OpenSSL, systemd), build a new server with automation rather than in-place upgrade, test, migrate data, switch DNS or the load balancer, and keep the old server for rollback. Leapp exists for in-place upgrades between RHEL majors.

Ship structured logs with an agent (Fluent Bit, Vector), set retention by type, sample noisy debug logs, index only needed fields, archive to cheap object storage and alert on log errors, not log volume alone.

Scaling up gives one server more CPU or RAM; it is simple but has limits and a single failure point. Scaling out adds more servers behind a load balancer; it needs stateless design but gives resilience.

Name the alert, the impact, quick checks with exact commands, decision steps, the fix, how to verify, the escalation contact and links to dashboards. Keep it short, tested and in version control.

Measure repeated manual tasks, automate them (scripts, Ansible, self-healing with systemd restarts or auto scaling), remove noisy alerts, standardise images and give teams self-service tools.

Schedule game days: restore backups to a clean environment, fail over a region or cluster, measure actual RTO and RPO, record gaps and fix them. A plan never tested is only a guess.

Desired state for servers and apps lives in Git; pipelines or agents apply it automatically, and every change is a reviewed commit that can be rolled back.

Pair on real incidents, share runbooks, review their scripts and changes, give them safe lab environments, explain why behind commands and encourage blameless learning.

Consider vendor support and certification (SAP, Oracle on RHEL), team skills, package freshness, lifecycle length, cost of subscriptions, cloud integration (Amazon Linux on AWS) and the tooling your company already standardised.

Use the STAR format: the Situation and impact, your Task, the Actions with real commands and reasoning (for example finding a deleted log held open with lsof that filled the disk), and the Result with numbers plus the prevention you added.

Describe the business impact in plain words (for example the payment site could be down for 2 hours), the chance it happens, the cost and time of the fix, and give a clear recommendation with options.

They are typical and commonly reported questions. Each company and interviewer is different, so learn the idea, not the exact words.

30 to 60 seconds for most questions; up to 3 minutes for scenarios and design.

Read them for ideas, but focus on beginner and the first half of mid level.

Practise on both if you can. Many companies use RHEL family servers; Ubuntu is common on cloud.

Say so honestly, then say how you would find out and what you would check first.

Not always, but RHCSA is widely respected because it is hands-on.

About two to three weeks at one group per day plus hands-on practice.

Yes in most Indian interviews, as long as technical terms are correct and clear.

Who owns the file and its mode with ls -l, and whether you need sudo.

tail -n 50 -f file.

ip a or hostname -I.

systemctl status name.

Create a swap file with fallocate, chmod 600, mkswap, swapon, and add it to fstab.

rpm -qf /path or dpkg -S /path.

journalctl -b -1, with persistent journal enabled.

sshd -t.

Check last -x and journalctl -b -1 for the end of the last boot, dmesg and BMC or cloud logs for hardware, kernel panic or OOM, and kdump for vmcores.

Scale out for stateless, horizontally splittable work and resilience; scale up for stateful or license-bound workloads, with cost and failure blast radius in mind.

Saturation and errors that affect users: disk and inode usage trend, memory pressure (PSI), load versus CPUs, service health checks, error rates and latency SLOs.

Timeline, impact, root and contributing causes, what went well, action items with owners and dates, and no personal blame.