A symbolic link (or symlink) is a special file that stores the path to another file or directory. If the original file is deleted or moved, the symlink becomes broken because its target no longer exists.
$ vmstat 1
$ find /var/log -mtime -1
When a page fault occurs, the Linux kernel determines whether the required page can be mapped immediately or whether it must first be loaded from disk.
# Older Linux systems
$ touch /forcefsck
# Send SIGTERM (default)
$ kill 1234
# Equivalent to the above
$ kill -15 1234
# Forcefully terminate the process
$ kill -9 1234
If you’re preparing for Linux interviews, keep this guide as a quick reference and revisit these concepts regularly. A solid understanding of the basics is often what sets successful candidates apart.
1. How do you Suspend a Running Process and Move it to the Background?
# Modified exactly one day ago
$ find /var/log -mtime 1
# Modified more than one day ago
$ find /var/log -mtime +1
# Create a hard link
$ ln target_file hardlink
# Create a symbolic link
$ ln -s target_file symlink
Netid State Recv-Q Send-Q Local Address:Port Process
tcp LISTEN 0 128 0.0.0.0:22 users:((“sshd”,pid=892,fd=3))
tcp LISTEN 0 511 0.0.0.0:80 users:((“nginx”,pid=1215,fd=6))
For example, to find files modified within the last hour:
Configuration files are stored in:
2. What’s the Minimum Partition Setup to Install Linux, and How do You Check boot Messages?
We’ve completely revised the guide to reflect today’s Linux environments, replacing outdated information with practical, accurate explanations and the commands you’ll actually use as a Linux administrator.
Although it isn’t used as frequently today, it still appears in certification exams such as The LFCS Certification Preparation Course and in some Linux interviews.
/(root) – Stores the operating system and applications.- /boot – Contains the kernel and bootloader files. This is often kept separate, especially on systems that use full-disk encryption.
- Swap – Provides virtual memory when RAM is low and is also used for hibernation. Modern systems typically don’t need the old “swap = 2× RAM” rule. A small swap partition or swap file is enough for most workloads.
/etc/systemd/journald.conf
For example, these commands all work with modern GNU tar:
For example, these commands all work with modern GNU tar:
For example, these commands all work with modern GNU tar:
For example, these commands all work with modern GNU tar:
For example, these commands all work with modern GNU tar:
For example, these commands all work with modern GNU tar:
For example, these commands all work with modern GNU tar:
# Remount the root filesystem as read-only
$ mount -o remount,ro /
# Run a filesystem check (replace the device as needed)
$ fsck /dev/sda2
Spend some time practicing each command on a Linux machine, experiment with different options, and try to understand the output instead of simply memorizing it. That hands-on experience will make it much easier to answer follow-up questions with confidence.
Exit codes are especially useful in shell scripts, where you can control what happens next based on whether a command succeeds or fails.
A return code, also known as an exit status, is the value a program returns to the shell when it finishes executing. By convention:
To troubleshoot boot problems or review what happened during startup, you can use these commands:
For example:
-1000– Prevents the process from being selected by the OOM killer.0– Uses the default behavior.1000– Makes the process much more likely to be terminated.
The recommended tool for viewing network connections on modern Linux systems is ss. It has replaced netstat on most distributions because it’s faster and reads socket information directly from the kernel.
If you’re preparing for a Linux System Administrator, DevOps, or Site Reliability Engineer (SRE) interview, simply memorizing answers isn’t enough.
15. How do You Find Files Modified in the Last 24 Hours?
atrm 3
or
at -r 3
Before running fsck on the root filesystem, it must not be mounted in read-write mode. Running fsck on an active, writable filesystem can lead to data corruption because the operating system may still be writing to the disk while the check is in progress.
find /var/log– Searches for files under the /var/log directory.-mtime -1– Finds files modified less than one day ago.
Most Linux interview lists recycle the same 10 questions from a decade ago, and many of the “official” answers are outdated or no longer apply to modern Linux distributions.
A traditional Unix tool for copying an entire directory tree is cpio. It preserves the directory hierarchy and can also retain file permissions and timestamps.
Today, the logging system depends on the Linux distribution you’re using:
One useful detail is that modern GNU tar automatically detects common compression formats such as gzip (.tar.gz), bzip2 (.tar.bz2), and XZ (.tar.xz). This means you usually don’t need to specify options like -z, -j, or -J explicitly.
Conclusion
One important point worth mentioning in an interview is that systemd journal logs are not managed by logrotate. Instead, systemd-journald manages its own logs.
at -l
or
atq
$ dmesg | less
$ journalctl -b
$ journalctl -b -p err
# Reduce journal size to 500 MB
$ journalctl –vacuum-size=500M
# To remove journal entries older than two weeks:
$ journalctl –vacuum-time=2weeks
Permanent journal storage limits are configured in:
