Top 10 Essential Linux Ops Questions Every Interviewer and Engineer Should Master

1. System Resource Monitoring & Diagnosis

How to precisely monitor system resource usage?

Exam focus: ability to build a performance‑monitoring framework and anticipate failures.

Deep dive tools (the "dynamic monitoring trio"): top -H -d 1 -b -n 5 – thread‑level monitoring, 1‑second interval, 5 samples. htop --tree – visual process‑tree display. glances --process-short-name – full‑screen dynamic monitor (requires installation).

Advanced tricks: shift+P/M/T to sort by CPU/memory/time and F2 to customize displayed columns.

Memory analysis toolchain: free -h -t – show total memory. smem -s rss -r – sort by actual physical memory usage. sar -r -f /var/log/sa/saXX – historical memory‑usage trends.

Disk I/O diagnosis: iostat -dx 1 – device‑level I/O wait. iotop -oP – real‑time process‑level I/O monitoring. pidstat -d 1 – process‑level I/O statistics.

Typical scenario: when %wa (I/O wait) stays above 20 %, immediately check disk health with smartctl -a /dev/sda.

2. Process‑Level Deep Diagnosis

Advanced command combinations for complex fault isolation

Exam focus: complex fault‑location capability.

ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head -n 10   # Top 10 CPU‑intensive processes
pmap -x PID | grep total                         # View process memory map
perf top -p PID                                 # Dynamic hotspot function tracing

Debug tricks:

Trace file operations with strace -f -T -tt -e trace=open,read,write -p PID.

Detect real‑time memory leaks using gdb -p PID.

3. Network & Permission Management

Port conflict resolution

Advanced investigation workflow:

1. lsof -i :80 -s TCP:LISTEN        # Verify listening state
2. ss -tunlp sport = :80            # Show TCP/UDP listening ports
3. netstat -antp | awk '/:80/{print $7}' | cut -d/ -f1 | xargs -I{} ps -fp {}

Emergency handling: fuser -k 80/tcp – force‑kill the occupying process.

Permission system deep dive

UGO permission model examples:

Numeric permissions: chmod 755 script.sh (owner rwx, group r‑x, others r‑x).

Sensitive file: chmod 640 config.conf.

Special permissions: chmod +s /usr/bin/passwd (SUID), chmod g+s /project (SGID directory inheritance).

ACL advanced configuration: setfacl -m u:devops:rwx /data (fine‑grained user rights) and getfacl /data (audit).

4. Filesystem & Storage Management

Link mechanism deep comparison

Key differences between symbolic and hard links:

Storage structure – symbolic links have independent inodes storing target paths; hard links share the same inode.

Cross‑filesystem support – symbolic links ✔️, hard links ❌.

Directory linking – symbolic links ✔️ (requires root), hard links ❌.

After original file deletion – symbolic link becomes invalid ❌, hard link remains accessible ✔️.

Inode number – different for symbolic, identical for hard.

Typical use cases – symbolic links for versioned paths or cross‑partition references; hard links for file mirroring and fast backup.

Example: ln -sT /mnt/nfs_share/data /local/mirror creates a forced‑path replacement soft link.

5. System Boot & Log Analysis

Boot process deep analysis

Modern boot architecture:

UEFI initialization – replaces legacy BIOS, supports GPT partitions.

GRUB2 bootloader – configuration file /boot/grub2/grub.cfg; rescue mode via grub> set prefix=(hd0,msdos1)/grub2.

Initramfs stage – inspect with lsinitrd /boot/initramfs-$(uname -r).img | less.

Systemd service orchestration – analyze startup time with systemd-analyze blame and view dependency tree with systemctl list-dependencies.

Log auditing system

Layered log architecture:

System layer: journalctl -k --since "2025-06-08" – kernel logs.

Application layer: journalctl -u nginx.service -f – service log tail.

Security layer: ausearch -m AVC -ts recent – SELinux audit logs.

Log rotation example:

/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
}

6. Automation & Operational Skills

Crontab best practices

Pitfall‑avoidance guide:

Use absolute paths:

0 3 * * * /usr/bin/python3 /home/user/backup.py > /dev/null 2>&1

.

Set environment variables explicitly, e.g., SHELL=/bin/bash and a comprehensive PATH.

Prevent concurrent runs with file locking: * * * * * flock -n /tmp/backup.lock -c "/path/to/script".

Advanced file search techniques

Precise search strategy combining multiple criteria:

find /var/log -type f -name "*.log" -mtime +7 -size +100M -exec ls -lh {} \;   # multi‑condition

Content search optimization:

grep -rnw --color=auto -B 3 -A 2 'error' /app/logs/   # context lines with highlighted matches

Enterprise‑grade solution using locate database:

updatedb                     # refresh database
locate -i '*.conf'           # fast fuzzy search

7. Performance Tuning Methodology

High‑load handling workflow

Standardized steps:

Load confirmation: uptime | awk '{print $10}' | cut -d, -f1 – fetch 1‑minute load.

Process analysis: pidstat -u -l 1 5 > pidstat.log – per‑process CPU stats.

Resource bottleneck identification:

CPU: mpstat -P ALL 1 Memory: vmstat 1 I/O: iostat -x 1 Advanced diagnostics: perf top -g (flame graph) and tcpdump -i eth0 port 80 -w http.pcap (packet capture).

Optimization case – kernel parameter tuning:

sysctl -w vm.swappiness=10          # reduce swap tendency
sysctl -w net.core.somaxconn=65535   # increase connection backlog