Advanced Linux Interview Questions and Answers

The firmware (UEFI or BIOS) starts a boot loader such as GRUB, which loads the kernel and an initial RAM disk. The kernel sets up hardware, mounts the root file system, and starts PID 1, usually systemd. systemd then starts services until it reaches the target, such as multi-user.target.

The shell parses the line, expands variables and wildcards, and looks for the command among aliases, functions and builtins, then in PATH. It calls fork to create a child, and the child calls exec to load /usr/bin/ls. The parent waits, and stores the exit status in $?.

A number that a process uses to refer to an open file, socket or pipe. 0, 1 and 2 are stdin, stdout and stderr. Limits are shown by ulimit -n, and "too many open files" means that a process hit the limit. /proc/PID/fd lists them.

A process has its own memory space. Threads share the memory of their process, so they are cheaper to create and communicate faster, but they need synchronisation.

Namespaces isolate what a process can see (PIDs, network, mounts). cgroups limit what it can use (CPU, memory). Together they are the kernel features behind containers such as Docker.

A virtual file system that presents kernel and process information as files. /proc/cpuinfo, /proc/meminfo and /proc/PID/ are common examples. /sys is similar, for devices and kernel settings.

Linux uses spare memory for disk cache, so "free" is often low, and that is normal. The available column is the true estimate of memory for new programs. Heavy swap use is the real warning sign.

When the system runs out of memory, the kernel picks a process and kills it, to keep the system alive. Check with dmesg or journalctl -k. A sudden process death with no error log is a common sign.

setuid makes a program run with its owner's rights, which is how passwd updates a root-owned file. The sticky bit on a folder such as /tmp means that only a file's owner can delete it.

Check uptime for load, then top for CPU and memory, separating user time from iowait. Use free -h for memory and swap, df -h for disk, iostat and iotop for disk activity, and ss and sar for network. Then read the logs of the busy process.

Check DNS with dig, reachability with ping, and the port with nc -zv host 443. Use curl -v for the HTTP answer. On the server, check systemctl status, ss -ltn, the firewall, disk space, and the application logs.

Tasks are waiting, usually on disk or network I/O. Look for processes in state D, and check iowait in top.

It may have the immutable attribute (check with lsattr, and clear with chattr -i), the file system may be mounted read-only, or a disk error may have forced it to read-only.

It is in uninterruptible sleep (D), usually waiting for I/O, such as a hung network disk. Or it is a zombie, which is already dead, and needs its parent to read its status.

strace -p PID, or strace command. It helps when a program hangs or fails silently, for instance on a file it cannot open. Use it with care in production, because it slows the process.

Update packages, create a normal user with sudo, use SSH keys, disable password and root login, enable a firewall with only the needed ports, install fail2ban, turn on automatic security updates, and run services as unprivileged users.

Commands in ( ), pipelines and $( ) run in a child process, so variables set there are lost. { ...; } and source run in the current shell.

File names can contain spaces, newlines and other special characters. Use globs (for f in *), or find -print0 | xargs -0.

It does not trigger for commands in if or while tests, or before && and ||, and failures in $( ) can be hidden, especially inside local x=$(cmd). Explicit checks are still needed for important steps.

Make it idempotent: use mkdir -p, check for existing state, write to a temporary file and mv it into place, and take a lock with flock.