Frequently asked Linux and Bash interview questions on commands, permissions, processes, services, cron, networking, disk space, troubleshooting and shell scripting, with hints and answers.
23 questions · Updated
Ubuntu is not the kernel.
The kernel is the core that manages hardware, memory and processes. A distribution such as Ubuntu or Red Hat packages the kernel with tools, a package manager and defaults.
Add 4, 2 and 1 for each of three groups.
The owner has 7 (rwx), the group has 5 (r-x), and others have 4 (r--). So the owner can do anything, the group can read and execute, and everyone else can only read.
find has a size condition.
find / -type f -size +100M 2> /dev/null. The redirect hides permission errors.
Streams have numbers.
It sends stream 2 (stderr) to wherever stream 1 (stdout) is going. In cmd > all.log 2>&1, both output and errors go to the file. It must come after the >.
Inside files, or the files themselves?
grep searches the text inside files. find searches for files by name, type, size or age.
Sort first, then signal.
Use top, or ps aux --sort=-%cpu | head to find the PID. Send kill PID, and use kill -9 PID only if it does not stop.
Four tools in a pipe.
awk '{print $1}' file | sort | uniq -c | sort -nr | head -n 5
awk has END.
awk -F, '{sum += $3} END {print sum}' file.csv
Which one can be caught?
SIGTERM (15) asks a process to stop, so it can clean up. SIGKILL (9) ends it immediately, and it cannot be caught.
Now, or at boot?
start runs the service now. enable makes it start at boot. enable --now does both.
Minute comes first.
30 2 * * * /home/asha/backup.sh >> /home/asha/backup.log 2>&1
Compare the environments.
cron has a minimal environment, so PATH is short and .bashrc is not loaded. Use full paths, cd in the script, and log the output to see the error.
Which key goes where?
The public key is in the server's ~/.ssh/authorized_keys. Your client proves that it holds the private key by signing a challenge. The private key is never sent.
ss or lsof.
sudo ss -ltnp | grep :8080, or sudo lsof -i :8080.
Start wide, then go deeper.
df -h shows which file system is full, and du -h --max-depth=1 / | sort -hr finds the biggest folders. Check logs and caches. If du shows much less than df, run lsof +L1 to find deleted files that are still open.
What if the value has a space?
Without quotes, Bash splits the value into words and expands wildcards. rm $file with a file called my report.txt tries to remove two files. rm "$file" is correct.
Three separate settings.
-e stops on a failed command, -u makes unset variables an error, and -o pipefail makes a pipeline fail if any command in it fails.
Which shell runs it?
./script.sh runs in a child process, so its variables are lost when it ends. source runs in the current shell, so its variables stay.
Load, CPU, memory, disk, network, logs.
Check uptime, then top for CPU and iowait, free -h for memory and swap, df -h for disk, and iostat for disk activity. Then read the logs of the busy process.
Firmware, loader, kernel, PID 1.
Firmware starts the boot loader (GRUB), which loads the kernel and initial RAM disk. The kernel mounts the root file system and starts PID 1, usually systemd, which starts the services.
Two system calls.
The shell parses the line and finds the program through PATH. It calls fork to make a child, and the child calls exec to load the program. The parent waits, and stores the exit code in $?.
Isolate and limit.
Namespaces isolate what a process can see, such as its PIDs, network and mounts. cgroups limit what it can use, such as CPU and memory.
Memory.
The kernel's OOM killer may have ended it when memory ran out. Check journalctl -k or dmesg for "Out of memory".