Title: Linux Administration — LearnCoachAssist

Q: What does the ls command do in Linux?
A: The ls command lists directory contents. Common flags:
-l long format with permissions, owner, size, date
-a show hidden files (dotfiles)
-h human-readable sizes
-R recursive listing
-t sort by modification time

Q: How does grep search for patterns in files?
A: grep searches text using patterns.
Usage: grep [options] pattern [file...]
Key flags:
- -i case-insensitive
- -r recursive search
- -n show line numbers
- -v invert match
- -E extended regex (same as egrep)

Q: How do you use the find command to locate files?
A: find searches the directory tree.
Examples:
find /home -name "*.txt" — find by name
find . -type f -mtime -7 — files modified in last 7 days
find / -size +100M — files larger than 100MB
find . -perm 755 — find by permissions
find . -name "*.log" -exec rm {} \; — execute command on results

Q: What is awk and how is it used for text processing?
A: awk is a powerful text-processing language that operates on fields and records.
Examples:
awk '{print $1, $3}' file — print columns 1 and 3
awk -F: '{print $1}' /etc/passwd — set delimiter to colon
awk '$3 > 100 {print $0}' data.txt — conditional filtering
Built-in variables: NR (record number), NF (number of fields), FS (field separator)

Q: How does sed perform text substitution?
A: sed (stream editor) transforms text in a pipeline.
Common usage:
sed 's/old/new/' file — replace first occurrence per line
sed 's/old/new/g' file — replace all occurrences
sed -i 's/old/new/g' file — edit file in-place
sed -n '5,10p' file — print lines 5–10
sed '/pattern/d' file — delete matching lines

Q: What are the key directories in the Linux filesystem hierarchy?
A: Key directories:
- /etc — system configuration files
- /var — variable data (logs, spools, caches)
- /home — user home directories
- /usr — user programs and read-only data
- /tmp — temporary files (cleared on reboot)
- /proc — virtual filesystem for process/kernel info
- /dev — device files (block and character devices)

Q: What is the /proc filesystem in Linux?
A: /proc is a virtual filesystem that provides an interface to kernel data structures.
Key entries:
- /proc/cpuinfo — CPU details
- /proc/meminfo — memory usage
- /proc/[PID]/ — per-process info
- /proc/loadavg — system load averages
- /proc/filesystems — supported filesystems
It exists only in memory, not on disk.

Q: How do Linux file permissions work with chmod?
A: Permissions have three sets: owner, group, others, each with r(4), w(2), x(1).
Numeric: chmod 755 file → rwxr-xr-x
Symbolic: chmod u+x file → add execute for owner
chmod g-w file → remove write for group
chmod o=r file → set others to read only
chmod -R 644 dir/ → recursive

Q: What are SUID, SGID, and the sticky bit?
A: Special permission bits:
- SUID (4xxx) — file executes as the file owner. Example: chmod 4755 file. Shown as -rwsr-xr-x
- SGID (2xxx) — file executes as the group owner; on directories, new files inherit the group. chmod 2755 dir
- Sticky bit (1xxx) — only file owner can delete files in the directory. chmod 1777 /tmp. Shown as drwxrwxrwt

Q: What does umask control and how do you set it?
A: umask sets the default permission mask for newly created files and directories.
It subtracts permissions from the maximum (666 for files, 777 for dirs).
Example: umask 022 → new files get 644, new dirs get 755
umask 077 → new files get 600, new dirs get 700
View current: umask or umask -S (symbolic)
Set in ~/.bashrc or /etc/profile for persistence.

Q: How do you manage file ownership with chown and chgrp?
A: chown changes file owner and/or group:
chown user file — change owner
chown user:group file — change both
chown :group file — change group only
chown -R user:group dir/ — recursive
chgrp changes group only:
chgrp developers file
Only root can change file ownership; group members can use chgrp.

Q: How do you view and manage processes with ps and top?
A: ps shows a snapshot of processes:
ps aux — all processes, detailed
ps -ef — full-format listing
ps -u username — processes by user
top shows a real-time dynamic view:
- k — kill a process
- M — sort by memory
- P — sort by CPU
- q — quit
htop is an enhanced interactive alternative.

Q: How do you send signals to processes with kill?
A: kill sends signals to processes by PID.
Common signals:
- kill PID or kill -15 PID — SIGTERM (graceful shutdown)
- kill -9 PID — SIGKILL (force kill, cannot be caught)
- kill -1 PID — SIGHUP (reload configuration)
- kill -19 PID — SIGSTOP (pause process)
- kill -18 PID — SIGCONT (resume process)
Use kill -l to list all signals.

Q: What do nice and nohup do for process management?
A: nice sets process priority (niceness: -20 to 19, lower = higher priority):
nice -n 10 command — start with lower priority
renice -n 5 -p PID — change running process priority
nohup runs a command immune to hangup signals:
nohup command & — continues after terminal closes
Output goes to nohup.out by default.
Combine: nohup nice -n 10 long_task &

Q: How do you use job control with bg, fg, and jobs?
A: Job control manages background/foreground processes:
command & — start in background
Ctrl+Z — suspend foreground process
jobs — list current jobs with job numbers
bg %1 — resume job 1 in background
fg %1 — bring job 1 to foreground
disown %1 — detach job from shell (survives logout)
Job states: Running, Stopped, Done.

Q: What is systemd and how does systemctl work?
A: systemd is the init system and service manager for modern Linux.
systemctl controls it:
- systemctl start nginx — start a service
- systemctl stop nginx — stop a service
- systemctl restart nginx — restart
- systemctl enable nginx — start on boot
- systemctl status nginx — check status
- systemctl list-units --type=service — list services

Q: What is the structure of a systemd unit file?
A: A unit file (in /etc/systemd/system/) has three sections:
[Unit] — description, dependencies:
Description=My App
After=network.target
[Service] — how to run:
ExecStart=/usr/bin/myapp
Restart=always
User=www-data
[Install] — boot integration:
WantedBy=multi-user.target
Reload after changes: systemctl daemon-reload

Q: How do you use journalctl to view systemd logs?
A: journalctl queries the systemd journal:
journalctl -u nginx — logs for a specific unit
journalctl -f — follow (like tail -f)
journalctl --since "1 hour ago" — time-based filter
journalctl -p err — filter by priority (emerg, alert, crit, err, warning)
journalctl -b — logs from current boot
journalctl --disk-usage — check journal size
journalctl --vacuum-size=500M — clean up

Q: How do cron jobs work and what is crontab syntax?
A: cron schedules recurring tasks. Edit with crontab -e.
Format: MIN HOUR DOM MON DOW command
Examples:
0 2 * * * /backup.sh — daily at 2:00 AM
*/15 * * * * /check.sh — every 15 minutes
0 9 * * 1-5 /report.sh — weekdays at 9 AM
@reboot /startup.sh — run at boot
crontab -l — list current user's cron jobs

Q: What is the difference between cron and at?
A: cron runs tasks repeatedly on a schedule (e.g., every day at midnight).
at runs a task once at a specified future time.
Usage of at:
at 14:30 → enter commands, then Ctrl+D
at now + 2 hours
at 10:00 AM tomorrow
atq — list pending at jobs
atrm 3 — remove job #3
Service must be running: systemctl status atd

Q: How do you connect to a remote server with SSH?
A: ssh provides encrypted remote access.
Basic: ssh user@hostname
With port: ssh -p 2222 user@host
Key-based auth:
ssh-keygen -t ed25519 — generate key pair
ssh-copy-id user@host — copy public key
Config file (~/.ssh/config):
Host myserver
  HostName 10.0.0.1
  User admin
  IdentityFile ~/.ssh/id_ed25519

Q: How do scp and rsync differ for file transfers?
A: scp — simple secure copy:
scp file.txt user@host:/path/
scp -r dir/ user@host:/path/
rsync — advanced sync with delta transfer:
rsync -avz src/ user@host:/dest/
Key flags: -a archive, -v verbose, -z compress, --delete remove extra files
rsync is preferred because it only transfers changed data, supports resume, and is much faster for large/repeated transfers.

Q: How do curl and wget differ for downloading?
A: curl — versatile data transfer tool:
curl -O https://example.com/file — download
curl -X POST -d '{"key":"val"}' URL — POST request
curl -I URL — headers only
wget — download-focused:
wget URL — download file
wget -r URL — recursive download
wget -c URL — resume download
curl supports more protocols and is better for APIs; wget is better for recursive downloads.

Q: How do you check network connections with ss and netstat?
A: ss (modern) and netstat (legacy) display socket statistics.
ss examples:
ss -tuln — TCP/UDP listening ports with numbers
ss -tp — TCP connections with process info
ss -s — summary statistics
netstat equivalents:
netstat -tuln — listening ports
netstat -anp — all connections with PIDs
ss is faster and recommended over netstat on modern systems.

Q: How do you use the ip command for network configuration?
A: ip replaces older ifconfig and route.
Common usage:
- ip addr show — show IP addresses
- ip link show — show network interfaces
- ip route show — show routing table
- ip addr add 10.0.0.5/24 dev eth0 — add IP
- ip link set eth0 up — bring interface up
- ip neigh show — show ARP table

Q: How do ping, traceroute, and dig help diagnose network issues?
A: ping — test connectivity and latency:
ping -c 4 google.com
traceroute — show the path packets take:
traceroute google.com (shows each hop)
dig — DNS lookup tool:
dig example.com — query A record
dig example.com MX — mail records
dig @8.8.8.8 example.com — use specific DNS server
dig +short example.com — concise output
nslookup is a simpler alternative to dig.

Q: How does package management work with apt on Debian/Ubuntu?
A: apt manages packages on Debian-based systems.
Commands:
- apt update — refresh package index
- apt upgrade — upgrade installed packages
- apt install nginx — install a package
- apt remove nginx — remove (keep config)
- apt purge nginx — remove with config
- apt search keyword — search packages
- apt list --installed — list installed
dpkg -i package.deb installs local .deb files.

Q: How does yum/dnf manage packages on RHEL-based systems?
A: dnf (successor to yum) manages packages on RHEL, Fedora, CentOS.
Commands:
- dnf install httpd — install package
- dnf remove httpd — remove
- dnf update — update all packages
- dnf search keyword — search
- dnf info httpd — package details
- dnf list installed — list installed
rpm -ivh package.rpm installs local .rpm files.
rpm -qa lists all installed RPM packages.

Q: How do you define variables and use them in shell scripts?
A: Variables in bash:
NAME="Linux" — assign (no spaces around =)
echo $NAME or echo "${NAME}" — use variable
readonly PI=3.14 — constant
Special variables:
- $0 — script name
- $1, $2... — positional arguments
- $# — number of arguments
- $? — last exit code
- $@ — all arguments
- $$ — current PID

Q: How do loops work in bash shell scripts?
A: For loop:
for i in 1 2 3; do echo $i; done
for f in *.txt; do wc -l "$f"; done
for ((i=0; i<10; i++)); do echo $i; done
While loop:
while [ $count -lt 10 ]; do
  echo $count; ((count++))
done
Read lines from file:
while IFS= read -r line; do
  echo "$line"
done < file.txt

Q: How do conditionals and if statements work in bash?
A: If/elif/else:
if [ "$x" -eq 5 ]; then
  echo "five"
elif [ "$x" -gt 5 ]; then
  echo "greater"
else
  echo "less"
fi
Test operators:
- -f file — file exists
- -d dir — directory exists
- -z "$str" — string is empty
- -n "$str" — string is not empty
- = — string equality
Use [[ ]] for advanced pattern matching.

Q: How do you define and use functions in bash?
A: Function definition:
greet() {
  echo "Hello, $1!"
  return 0
}
greet "World"
Key points:
- Arguments accessed via $1, $2, ...
- return sets exit status (0–255)
- Use local for local variables: local name="value"
- Capture output: result=$(greet "World")
Functions must be defined before they are called.

Q: What are exit codes and how are they used in scripts?
A: Every command returns an exit code (0–255).
0 = success, non-zero = failure.
Usage:
$? — check last exit code
exit 1 — exit script with error
Conditional execution:
cmd1 && cmd2 — run cmd2 only if cmd1 succeeds
cmd1 || cmd2 — run cmd2 only if cmd1 fails
In scripts:
set -e — exit on first error
set -o pipefail — catch pipe failures

Q: How do pipes and output redirection work in Linux?
A: Pipes (|) send stdout of one command to stdin of another:
cat file | grep "error" | wc -l
Redirection:
- > file — redirect stdout (overwrite)
- >> file — redirect stdout (append)
- < file — redirect stdin from file
- 2> file — redirect stderr
- 2>&1 — redirect stderr to stdout
- &> file — redirect both stdout and stderr
- cmd > /dev/null 2>&1 — discard all output

Q: What is /dev/null and how is it used?
A: /dev/null is a special file that discards all data written to it and returns EOF when read.
Common uses:
command > /dev/null — suppress stdout
command 2> /dev/null — suppress stderr
command > /dev/null 2>&1 — suppress all output
if command > /dev/null 2>&1; then ... — check if command succeeds silently
Often called the "bit bucket" or "black hole".

Q: How do head, tail, cat, and tee work for viewing files?
A: cat — display entire file: cat file.txt
cat -n file.txt — with line numbers
head — first N lines: head -n 20 file.txt
tail — last N lines: tail -n 20 file.txt
tail -f /var/log/syslog — follow new lines in real time
tee — write to file AND stdout simultaneously:
command | tee output.log
command | tee -a output.log — append mode

Q: How do sort, uniq, wc, and cut process text?
A: sort — sort lines:
sort file, sort -n (numeric), sort -r (reverse), sort -k2 (by column 2)
uniq — remove adjacent duplicates:
sort file | uniq, uniq -c (count occurrences)
wc — count lines/words/chars:
wc -l file (lines), wc -w (words), wc -c (bytes)
cut — extract fields:
cut -d: -f1 /etc/passwd — first field, colon-delimited

Q: How do tr and xargs transform data in pipelines?
A: tr — translate/delete characters:
echo "hello" | tr 'a-z' 'A-Z' → HELLO
echo "a::b" | tr -s ':' → a:b (squeeze repeats)
tr -d '\r' < file — remove carriage returns
xargs — build commands from stdin:
find . -name "*.log" | xargs rm
cat urls.txt | xargs -I{} curl {}
find . -name "*.txt" | xargs -P4 gzip — parallel processing (4 jobs)

Q: What are environment variables and how do you manage them?
A: Environment variables are key-value pairs available to processes.
View: env or printenv
Set temporarily: export VAR="value"
Set for one command: VAR=value command
Important variables:
- PATH — executable search directories
- HOME — user home directory
- USER — current username
- SHELL — current shell
- LANG — locale setting
Persist in ~/.bashrc or /etc/environment.

Q: How do you add a directory to the PATH variable?
A: PATH is a colon-separated list of directories where the shell searches for executables.
Temporary (current session):
export PATH="$PATH:/new/directory"
Permanent (for user):
Add to ~/.bashrc or ~/.profile:
export PATH="$PATH:$HOME/bin"
Then: source ~/.bashrc
Check: echo $PATH
which command — shows which PATH entry is used

Q: How do df and du monitor disk usage?
A: df — disk free space on filesystems:
df -h — human-readable sizes
df -T — show filesystem type
df -i — show inode usage
du — disk usage of files/directories:
du -sh /var/log — summary of directory size
du -h --max-depth=1 / — size of top-level dirs
du -ah | sort -rh | head -20 — find largest files/dirs
Use ncdu for an interactive disk usage browser.

Q: How do mount and lsblk work for disk management?
A: lsblk — list block devices in tree format:
lsblk — shows disks, partitions, mount points
lsblk -f — include filesystem type and UUID
mount — attach a filesystem:
mount /dev/sdb1 /mnt/data
mount -t ext4 /dev/sdb1 /mnt
umount /mnt/data — unmount
Persistent mounts in /etc/fstab:
/dev/sdb1 /mnt/data ext4 defaults 0 2
mount -a — mount all entries in fstab

Q: How do you manage users in Linux?
A: User management commands:
- useradd -m -s /bin/bash john — create user with home dir
- passwd john — set password
- usermod -aG sudo john — add to sudo group
- userdel -r john — delete user and home dir
- id john — show UID, GID, groups
- whoami — current user
User info stored in /etc/passwd, passwords in /etc/shadow.

Q: How do you manage groups in Linux?
A: Group management:
groupadd developers — create group
groupdel developers — delete group
usermod -aG developers john — add user to group
gpasswd -d john developers — remove user from group
groups john — list user's groups
Key files:
- /etc/group — group definitions
- /etc/gshadow — group passwords
A user has one primary group and can belong to multiple supplementary groups.

Q: What important log files are in /var/log?
A: Key log files:
- /var/log/syslog (or messages) — general system log
- /var/log/auth.log (or secure) — authentication events
- /var/log/kern.log — kernel messages
- /var/log/dmesg — boot/hardware messages
- /var/log/apt/ — package manager logs
- /var/log/nginx/ — web server logs
View: tail -f /var/log/syslog
journalctl is the modern alternative on systemd systems.

Q: What is the difference between hard links and symbolic links?
A: Hard link: ln file hardlink
Points directly to the same inode on disk. Shares the same data; deleting the original doesn't affect the link. Cannot cross filesystems or link to directories.
Symbolic (soft) link: ln -s file symlink
Points to the file path (like a shortcut). Can cross filesystems and link to directories. Breaks if the target is deleted.
Check with: ls -li (shows inode numbers) or stat file.

Q: How does the chmod command work with symbolic notation?
A: Symbolic notation uses letters to modify permissions:
Who: u (user/owner), g (group), o (others), a (all)
Action: + (add), - (remove), = (set exactly)
Permission: r (read), w (write), x (execute)
Examples:
chmod u+x script.sh — make executable for owner
chmod go-w file — remove write for group and others
chmod a=r file — read-only for everyone

Q: How do you use tar to create and extract archives?
A: tar bundles files into an archive.
Create:
tar -czf archive.tar.gz dir/ — gzip compressed
tar -cjf archive.tar.bz2 dir/ — bzip2 compressed
Extract:
tar -xzf archive.tar.gz — extract gzip
tar -xzf archive.tar.gz -C /dest/ — extract to directory
List contents:
tar -tzf archive.tar.gz
Flags: c=create, x=extract, t=list, z=gzip, j=bzip2, f=file, v=verbose

Q: What does the /etc directory contain?
A: /etc holds system-wide configuration files.
Key files:
- /etc/passwd — user account info
- /etc/shadow — encrypted passwords
- /etc/group — group definitions
- /etc/fstab — filesystem mount table
- /etc/hosts — static hostname-to-IP mappings
- /etc/hostname — system hostname
- /etc/resolv.conf — DNS resolver config
- /etc/ssh/sshd_config — SSH server config

Q: What are systemd targets and how do they relate to runlevels?
A: Targets are systemd's replacement for SysV runlevels. They group units into system states.
Common targets:
- poweroff.target — halt (runlevel 0)
- rescue.target — single user (runlevel 1)
- multi-user.target — multi-user, no GUI (runlevel 3)
- graphical.target — with GUI (runlevel 5)
- reboot.target — reboot (runlevel 6)
systemctl get-default — view default target
systemctl set-default multi-user.target — change it

Q: What is the Linux kernel ring buffer and how do you read it?
A: The kernel ring buffer holds boot and kernel log messages in memory.
View it with:
dmesg — full buffer
dmesg -T — human-readable timestamps
dmesg -w — follow new messages (like tail -f)
dmesg -l err — filter by severity (emerg, alert, crit, err, warn, info, debug)
journalctl -k shows the same data on systemd systems. The buffer is circular — old messages are overwritten when full.

Q: What is the difference between a process and a thread in Linux?
A: A process has its own virtual address space, file descriptors, and signal handlers. A thread (POSIX pthread) is a unit of execution within a process that shares memory, file descriptors, and most resources with sibling threads but has its own stack and registers. Linux implements threads as lightweight tasks sharing the same task_struct group (visible as separate PIDs in /proc/[pid]/task/). ps -eLf shows threads; htop shows them under their process.

Q: What is the PID 1 special role in Linux?
A: PID 1 is the init process — the first userspace process started by the kernel after boot. It becomes the ancestor of every other process and adopts orphaned children. On modern systems this is systemd. PID 1 receives SIGCHLD and any orphaned signals (unlike other processes, which ignore them). It cannot be killed even with kill -9 — it must be re-executed or the system will halt. ps -p 1 -o comm= shows the init binary.

Q: How do you find which process is listening on a port?
A: Three common approaches:
ss -tulnp 'sport = :80' — modern, shows PID/program
lsof -i :80 — list open files including sockets
fuser 80/tcp — show PIDs using the port
netstat -tlnp — legacy equivalent of ss -tlnp
On systems without -p visibility, run as root or the user owning the process. ss reads kernel data directly via netlink and is faster than parsing /proc/net/tcp.

Q: What is a zombie process and how do you clean it up?
A: A zombie is a terminated process whose exit status has not been reaped. It appears as Z in ps or top STAT column. Zombies consume only a task_struct entry — no CPU or memory — but waste a PID slot. The parent must call wait() to reap the child. To clean up: send SIGCHLD to the parent (kill -s SIGCHLD <parent_pid>), or kill the parent process. Init (PID 1) automatically reaps adopted orphans.

Q: What is the load average and how should it be interpreted?
A: Load average is the average number of runnable + uninterruptible tasks over 1, 5, and 15 minutes, shown by uptime, top, and /proc/loadavg.
Interpretation:
• On a system with N CPU cores, a load of N means full utilization; above N means a queue is forming.
• Uninterruptible (D state) processes — usually blocked on I/O — count toward load even though they consume no CPU.
• A consistently rising load with stable CPU usage typically indicates I/O or memory pressure, not CPU saturation.

Q: How does Linux memory overcommit work and what is the OOM killer?
A: Linux's default vm.overcommit_memory=0 uses a heuristic allowing most allocations to succeed even when total virtual memory exceeds RAM + swap. If memory becomes truly exhausted, the OOM killer invokes oom_score_adj (per-process in /proc/[pid]/oom_score_adj, range -1000 to 1000) to pick a victim and kills it with SIGKILL.
Check kernel logs: dmesg | grep -i oom or journalctl -k | grep -i oom.
Disable with vm.overcommit_memory=2 (strict accounting) — risky for workloads that fork heavily.

Q: What is swap space and when should it be used?
A: Swap is disk space used to extend virtual memory when RAM is full. It can be a partition or a file.
Create a swap file:
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
Persistence: add to /etc/fstab.
Check: swapon --show, free -h.
Set swappiness (/proc/sys/vm/swappiness, default 60): lower values prefer keeping pages in RAM. Modern advice: size swap to RAM+2 GB for suspend, or skip it on servers with abundant RAM.

Q: What is the difference between tmpfs and ramfs?
A: Both are RAM-based filesystems, but:
• tmpfs can use both RAM and swap, has a size limit, supports chmod/chown, and is visible in df.
• ramfs has no size limit and can grow until memory is exhausted (no swap backing), offering no accountability.
Mount tmpfs: mount -t tmpfs -o size=512m tmpfs /mnt/tmp
Common tmpfs mounts: /run, /tmp, /dev/shm.
Use ramfs only when unbounded growth is genuinely safe (rare).

Q: What are inodes and how do you troubleshoot inode exhaustion?
A: An inode stores file metadata (permissions, timestamps, block pointers) except the name. Each file consumes one inode.
Check usage: df -i (inodes) vs df -h (blocks).
Find directories using many inodes: find / -xdev -type d -exec sh -c 'echo $(find "$1" | wc -l) "$1"' _ {} \; then | sort -rn | head
When inodes are exhausted you cannot create new files even with free blocks. Causes: millions of empty files (mail spools, session dirs, cache). Fix by removing small files or reformatting with a smaller bytes-per-inode ratio (mkfs.ext4 -i 8192).

Q: What is the purpose of the /sys filesystem?
A: /sys (sysfs) is a virtual filesystem exposing kernel objects (devices, drivers, buses, kernel parameters).
Examples:
/sys/class/net/eth0/ — network interface details
/sys/block/sda/ — block device info
/sys/kernel/debug/ — debug info (mount with -t debugfs)
Writing to certain files changes kernel state: echo 1 > /sys/class/leds/led0/brightness.
Many tools (lsblk, ip) read from /sys instead of calling ioctls. Never edit files unless you know what they do — the kernel offers no undo.

Q: How do you set kernel parameters at runtime with sysctl?
A: sysctl reads/writes /proc/sys/:
sysctl -a — list all parameters
sysctl net.ipv4.ip_forward — read one
sysctl -w net.ipv4.ip_forward=1 — set at runtime
Persist by editing /etc/sysctl.d/*.conf and running sysctl --system or sysctl -p /etc/sysctl.conf.
Common tunings: net.ipv4.tcp_tw_reuse=1, vm.swappiness=10, fs.file-max=100000.
Add a runtime sysctl via /proc/sys/ or by writing to /sys/module/.../parameters/ for some modules.

Q: How do Linux capabilities replace the root binary?
A: Capabilities split root's all-or-nothing power into discrete privileges (CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, ~40 total).
Examples:
setcap cap_net_bind_service=+ep /usr/bin/python3 — allow binding port 80 without root
getcap /usr/bin/python3 — show capabilities
getpcaps <pid> — show process capabilities
Use cases: bind low ports, mount, change ownership, raw sockets. Capabilities are inheritable, permitted, effective, bounding, ambient. sshd drops most capabilities in /etc/ssh/sshd_config via the PermitUserEnvironment + AmbientCapabilities mechanism.

Q: What are POSIX ACLs and how do they extend standard permissions?
A: ACLs (Access Control Lists) provide per-user and per-group permissions beyond owner/group/others.
Enable on filesystem: mount -o acl /dev/sda1 /mnt (often default on ext4).
Commands:
getfacl file — view ACL
setfacl -m u:alice:rw file — grant user alice read+write
setfacl -m g:dev:rwx dir/ — grant group dev full access on dir
setfacl -d -m u:alice:r dir/ — default ACL (inherited by new files)
setfacl -x u:alice file — remove an entry
setfacl -b file — remove all ACLs
When any ACL is set, ls -l shows a + after the mode.

Q: What is SELinux and how do you manage its modes?
A: SELinux (Security-Enhanced Linux) is a MAC (Mandatory Access Control) system using type enforcement to confine processes.
Modes: enforcing, permissive (log only), disabled.
Check status: getenforce, sestatus
Set mode: setenforce 0|1 (permissive or enforcing), or in /etc/selinux/config for persistence.
Tools:
ps -eZ — show process context
ls -lZ — show file context
chcon -t httpd_sys_content_t /var/www/html/file — change type
restorecon -R /var/www/html — reset to policy default
sealert -a /var/log/audit/audit.log — analyze denials
audit2why and audit2allow — generate policy from denials.

Q: How does AppArmor differ from SELinux?
A: AppArmor (default on Ubuntu) is path-based MAC, simpler and more tractable than SELinux's label-based model. Profiles live in /etc/apparmor.d/.
Commands:
aa-status — current state
aa-complain /usr/bin/firefox — log but don't enforce
aa-enforce /usr/bin/firefox — enforce profile
apparmor_parser -r /etc/apparmor.d/usr.bin.firefox — reload profile
Profiles are easier to author: /usr/bin/firefox { /home/*/Downloads/** r, }.
AppArmor is one process confinement tool of several; SELinux also covers kernel-level objects and is more granular.

Q: How do you configure sudo and sudoers safely?
A: Edit /etc/sudoers with visudo (NEVER edit directly — it validates syntax).
Syntax: user host=(runas) commands
Examples:
root ALL=(ALL:ALL) ALL
%sudo ALL=(ALL:ALL) ALL — all members of group sudo
alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx — passwordless for one command
alice ALL=(ALL) NOPASSWD: ALL
Place custom rules in /etc/sudoers.d/.
Defaults: Defaults env_reset, Defaults timestamp_timeout=5, Defaults log_input, log_output.
Audit: journalctl -u sudo or grep sudo /var/log/auth.log.

Q: What are SSH host keys and how do you regenerate them?
A: When sshd starts, it generates a host key pair identifying the server. The client stores the public key in ~/.ssh/known_hosts; if it changes, you get a MITM warning.
Locations: /etc/ssh/ssh_host_ed25519_key, ssh_host_ecdsa_key, ssh_host_rsa_key.
Regenerate:
ssh-keygen -A — regenerate all default key types
Then remove stale entries on clients: ssh-keygen -R hostname
Supported key types: rsa (≥2048 bits), ed25519 (preferred), ecdsa. ed25519 is the modern recommendation for both host and user keys.

Q: How do you set up SSH key-based authentication?
A: 1. Generate on client: ssh-keygen -t ed25519 -C "alice@laptop" (default path ~/.ssh/id_ed25519). Optionally add a passphrase.
2. Install a passphrase agent: eval $(ssh-agent -s); ssh-add ~/.ssh/id_ed25519.
3. Copy public key to server: ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host (appends to ~/.ssh/authorized_keys, mode 600, dir 700).
4. Test: ssh user@host — no password prompt.
5. Disable password auth in /etc/ssh/sshd_config: PasswordAuthentication no, then systemctl restart sshd.

Q: What are the key sshd_config hardening options?
A: Edit /etc/ssh/sshd_config, then systemctl restart sshd (or reload).
Recommended:
Protocol 2 (implicit in modern versions)
PermitRootLogin no — disable root SSH
PasswordAuthentication no — keys only
PubkeyAuthentication yes
AllowUsers alice bob or AllowGroups sshusers
Port 2222 — change default port (security through obscurity, but reduces noise)
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2 — disconnects idle sessions
AllowTcpForwarding no if not needed
X11Forwarding no
Test config: sshd -t.

Q: What is the SSH agent and how does it forward keys?
A: The ssh-agent keeps decrypted private keys in memory so you don't re-enter passphrases. Start with eval $(ssh-agent), add keys with ssh-add.
Agent forwarding (ssh -A user@host) lets the remote server use your local agent when you SSH onward. Risky: anyone with root on the intermediate host can use your agent.
Safer alternative: ProxyJump (ssh -J jumphost target) or ~/.ssh/config with ProxyCommand.
Confirm: ssh-add -l, SSH_AUTH_SOCK env var.

Q: What is fail2ban and how does it protect services?
A: fail2ban monitors log files (e.g., /var/log/auth.log, /var/log/nginx/error.log) and bans IPs with too many failed attempts using firewall rules.
Install: apt install fail2ban.
Configure: /etc/fail2ban/jail.local overriding jail.conf:
[sshd]
enabled = true
maxretry = 3
findtime = 600
bantime = 3600
Commands: fail2ban-client status, fail2ban-client status sshd, fail2ban-client unban <ip>.
Default action uses iptables; on modern systems configure with nftables or ufw.

Q: How does the Linux firewall (nftables) work?
A: nftables is the modern Linux firewall (replacing iptables).
Basic table+chain:
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet filter input iif lo accept
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input tcp dport 22 accept
Persistence: nft list ruleset > /etc/nftables.conf, then enable nftables.service.
Modern front-ends: ufw (Ubuntu), firewalld (RHEL).

Q: How does ufw simplify firewall management?
A: ufw (Uncomplicated Firewall) is a front-end to nftables on Ubuntu.
Usage:
ufw status
ufw allow 22/tcp
ufw allow from 10.0.0.0/24 to any port 3306
ufw deny 23
ufw default deny incoming
ufw default allow outgoing
ufw enable / ufw disable
ufw delete allow 80
ufw reset — clear all rules
Enable logging: ufw logging on (logs to /var/log/ufw.log).
Rules stored in /etc/ufw/.

Q: What is firewalld and its zone concept?
A: firewalld (RHEL family) manages firewall via zones — predefined trust levels for interfaces.
Commands:
firewall-cmd --get-zones
firewall-cmd --get-active-zones
firewall-cmd --list-all
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-service=https --permanent
firewall-cmd --reload
Common zones: public, internal, dmz, trusted, block, drop.
Runtime vs permanent: omit --permanent for runtime only (lost on reload).

Q: What is a TCP three-way handshake and how is it observed?
A: The handshake opens a TCP connection:
1. SYN — client sends SYN to server
2. SYN-ACK — server replies
3. ACK — client acknowledges
After this, data flows. Termination uses FIN-ACK-FIN-ACK (or RST for abrupt close).
Observe with:
tcpdump -i eth0 port 80 -nn
ss -tin (timer state column)
Connection states visible in /proc/net/tcp (ESTABLISHED=01, SYN_SENT=02, SYN_RECV=03, TIME_WAIT=06, CLOSE_WAIT=08).
Time-wait: net.ipv4.tcp_fin_timeout (default 60s).

Q: What is the difference between TCP and UDP?
A: TCP (Transmission Control Protocol) is connection-oriented, reliable, ordered, with flow and congestion control. Used for HTTP, SSH, SMTP, databases. Header overhead ~20 bytes; overhead from handshakes and ACKs.
UDP (User Datagram Protocol) is connectionless, unreliable, unordered, but fast and lightweight. Header 8 bytes. Used for DNS, NTP, VoIP, video streaming, gaming.
Check open ports: ss -tuln shows both.
Services can run over either (HTTP/3 uses QUIC/UDP).

Q: How do you capture network traffic with tcpdump?
A: tcpdump -i eth0 — capture on interface
tcpdump -i any port 80 — any iface, port 80
tcpdump -w file.pcap host 10.0.0.5 — save to file (open in Wireshark)
tcpdump -r file.pcap — read pcap
tcpdump -nn -A port 443 and host api.example.com — name resolution off, ASCII payload
tcpdump -nn -s 0 -c 1000 -w cap.pcap — full packet, 1000 packets
Privileged: requires root or CAP_NET_RAW.
For deeper analysis: tshark (CLI Wireshark) or ngrep for pattern matching.

Q: How does DNS resolution work and what is in /etc/resolv.conf?
A: Resolution order on most systems: /etc/nsswitch.conf hosts: line → usually files dns, so /etc/hosts first, then DNS.
DNS configuration files:
/etc/resolv.conf — nameservers and search domains:
nameserver 8.8.8.8
search example.com
options ndots:2 timeout:2
Tools: dig example.com, host example.com, nslookup example.com.
On systemd, NetworkManager or systemd-resolved can overwrite /etc/resolv.conf.
Check status: resolvectl status.

Q: What is systemd-resolved and how does it interact with /etc/resolv.conf?
A: systemd-resolved provides local DNS caching and validation.
It listens on 127.0.0.53:53 and may symlink or stub /etc/resolv.conf to /run/systemd/resolve/stub-resolv.conf.
Tools: resolvectl status, resolvectl query example.com, resolvectl dns eth0 8.8.8.8.
Config: /etc/systemd/resolved.conf with DNS=, FallbackDNS=, DNSSEC=yes.
Disable if you run a custom resolver (dnsmasq, unbound): systemctl disable --now systemd-resolved and write a static /etc/resolv.conf.

Q: How does HTTPS / TLS work in practice for sysadmins?
A: TLS (Transport Layer Security) encrypts a TCP stream. Sysadmins care about:
• Issuing certificates with Let's Encrypt via certbot: certbot --nginx -d example.com
• Cert locations: /etc/letsencrypt/live/, /etc/ssl/certs/
• Inspect: openssl s_client -connect example.com:443 -servername example.com
• View cert: openssl x509 -in cert.pem -text -noout
• Generate private keys: openssl genrsa -out key.pem 2048 or openssl genpkey -algorithm ed25519
• Create CSR: openssl req -new -key key.pem -out csr.pem
• Self-signed: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
• Test config: openssl s_client -showcerts

Q: How do you manage time and NTP on Linux?
A: Time accuracy matters for logs, certs, and distributed systems.
Read hardware clock: hwclock -r
Sync from NTP:
• systemd-timesyncd: timedatectl, timedatectl set-ntp true
• chrony: chronyc tracking, chronyc sources — better for VMs and intermittent connectivity
• ntpd: legacy, ntpq -p
Time zones: timedatectl list-timezones, timedatectl set-timezone Europe/Zagreb. /etc/localtime is symlinked to /usr/share/zoneinfo/....
date -s "2026-01-01 12:00" sets system time; usually avoided in favor of NTP.

Q: What is the purpose of /etc/fstab and what is its syntax?
A: /etc/fstab lists filesystems to mount at boot.
Columns: device|spec mount-point fs-type options dump pass
Example:
UUID=abc... /home ext4 defaults,noatime 0 2
tmpfs /tmp tmpfs defaults,noexec,nosuid 0 0
• dump: 0=ignore, 1=use dump
• pass: 0=skip fsck, 1=root, 2=other
Test before reboot: mount -a (mount all).
Prefer UUID= over /dev/sdX (stable across boots).
Get UUIDs: blkid, lsblk -f.

Q: What is LVM and how do you manage logical volumes?
A: LVM (Logical Volume Manager) layers abstraction over disks: PV (Physical Volume) → VG (Volume Group) → LV (Logical Volume).
Setup:
pvcreate /dev/sdb
vgcreate vg0 /dev/sdb
lvcreate -L 50G -n data vg0
mkfs.ext4 /dev/vg0/data
mount /dev/vg0/data /mnt
Operations:
lvextend -L +10G -r /dev/vg0/data — grow with filesystem resize (-r)
vgextend vg0 /dev/sdc — add disk
vgreduce vg0 /dev/sdb — remove disk
Status: pvs, vgs, lvs.
LVMs can be snapshotted (lvcreate -s) and resized online.

Q: What are Linux software RAID levels?
A: mdadm manages software RAID.
Levels:
• RAID 0: striping, no redundancy, fastest
• RAID 1: mirroring, 50% capacity, 1 disk failure tolerated
• RAID 5: striping + single parity, (N-1) capacity, 1 disk failure tolerated
• RAID 6: double parity, (N-2) capacity, 2 failures tolerated
• RAID 10: striped mirrors, 50% capacity, fast + redundant
Create: mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb /dev/sdc
Status: cat /proc/mdstat, mdadm --detail /dev/md0
Save config: mdadm --detail --scan >> /etc/mdadm/mdadm.conf

Q: What is the difference between GPT and MBR partitioning?
A: MBR (Master Boot Record): 4 primary partitions, max 2 TiB disk, BIOS boot.
GPT (GUID Partition Table): 128 partitions, 8 ZiB max, required for UEFI, stores backup header + partition table at disk end for redundancy.
Tools: fdisk (MBR & GPT now), gdisk (GPT), parted (both).
Check: fdisk -l /dev/sda shows "Disklabel type: gpt" or "dos".
Convert: gdisk /dev/sda can convert MBR→GPT; always back up first.
UEFI systems require an ESP (EFI System Partition) — FAT32, ~256-512 MB, flagged as esp.

Q: How do you partition a disk with fdisk and parted?
A: fdisk /dev/sdb — interactive:
• g — new GPT table
• n — new partition
• t — change type (e.g., 8e for LVM, 82 for swap)
• w — write
parted /dev/sdb mklabel gpt — scriptable
parted /dev/sdb mkpart primary ext4 0% 100%
Refresh kernel: partprobe /dev/sdb
Format: mkfs.ext4 /dev/sdb1, mkfs.xfs /dev/sdb1, mkfs.btrfs /dev/sdb1.
Always back up before repartitioning.

Q: What is the difference between ext4, xfs, and btrfs?
A: ext4: mature, default on many distros. Supports extents, journaling, max 1 EiB. Online resize and defragmentation (e4defrag).
XFS: high-performance 64-bit journaling FS, default on RHEL. Excellent for large files, parallel I/O, online defragmentation. Cannot shrink filesystem, only grow.
btrfs: copy-on-write FS with built-in subvolumes, snapshots, compression, RAID. Tools: btrfs subvolume create, btrfs filesystem defragment, btrfs scrub.
Tune ext4: tune2fs -o journal_data_writeback /dev/sda1, list with tune2fs -l.
XFS admin: xfs_info, xfs_repair.
Snapshot tool independent of FS: LVM snapshots.

Q: How do you check and repair filesystems?
A: Unmount first, then run fsck:
fsck /dev/sda1 — checks ext family
fsck.ext4 /dev/sda1 — explicit
xfs_repair /dev/sda1 — for XFS
btrfs scrub start /mnt — read+verify all data on btrfs
Boot-time fsck is controlled by the pass column in /etc/fstab (1 = root first, 2 = parallel).
Force on next boot: touch /forcefsck (legacy) or systemctl reboot --firmware-setup.
Recover from bad superblock on ext: mkfs.ext4 -n /dev/sda1 lists backup superblocks, then fsck.ext4 -b 32768 /dev/sda1.

Q: What is the Linux boot process from power-on to login?
A: 1. BIOS/UEFI runs POST, then locates a boot device.
2. Bootloader (GRUB) loads: /boot/grub/grub.cfg (BIOS) or /boot/efi/EFI/... (UEFI).
3. Kernel + initramfs (initial RAM filesystem) are loaded into memory. initramfs provides early modules (storage drivers, LVM, LUKS).
4. Kernel executes /sbin/init (always PID 1) → systemd.
5. systemd reads its targets, mounts filesystems from /etc/fstab, brings up networking, starts services in dependency order.
6. getty (or display manager) spawns a login prompt on TTYs.
Debug: journalctl -b, dmesg, edit GRUB line and append init=/bin/bash or systemd.unit=rescue.target.

Q: How do you troubleshoot GRUB boot problems?
A: Recovery:
• Boot from a Live USB.
• Mount root: mount /dev/sda2 /mnt
• Mount boot: mount /dev/sda1 /mnt/boot
• mount --bind /dev /mnt/dev and same for /proc, /sys.
• chroot /mnt
• Reinstall GRUB: grub-install /dev/sda
• Regenerate config: grub-mkconfig -o /boot/grub/grub.cfg
In GRUB menu press e to edit a boot entry; add single or init=/bin/bash for shell.
Persistent: /etc/default/grub holds kernel parameters; GRUB_TIMEOUT, GRUB_CMDLINE_LINUX_DEFAULT.

Q: How do you troubleshoot a system that fails to boot to multi-user.target?
A: After seeing kernel logs and the emergency shell:
1. systemctl --failed — list failed units.
2. journalctl -xb -p err — boot logs filtered to errors.
3. Drop to rescue.target: at kernel cmdline, append systemd.unit=rescue.target or boot into single-user mode.
4. From rescue, mount -o remount,rw /, then systemctl default to attempt boot, or fix the failing unit and systemctl daemon-reload.
5. emergency.target is even more minimal: read-only root, no init scripts.
6. Common culprits: broken /etc/fstab, missing initramfs modules, full disk, broken network service blocking dependency.

Q: What is a Linux rescue/initramfs and how do you rebuild it?
A: The initramfs (initial RAM filesystem) is a compressed cpio archive loaded by the kernel before the real root. It contains modules and scripts to mount root, unlock LUKS, assemble RAID, activate LVM.
Rebuild:
Debian/Ubuntu: update-initramfs -u (current kernel) or -c (new).
RHEL: dracut -f or dracut --force /boot/initramfs-$(uname -r).img $(uname -r).
Inspect contents: lsinitramfs /boot/initrd.img-$(uname -r) (Debian) or dracut --list.
Force mkinitcpio rebuild (Arch): mkinitcpio -P.
Build config: /etc/initramfs-tools/initramfs.conf (Debian), /etc/dracut.conf.d/.

Q: What is the difference between a service unit and a target unit in systemd?
A: Service units (*.service) define how a long-running daemon is started, stopped, and supervised (ExecStart, Restart=, Type=simple|notify|forking|oneshot).
Target units (*.target) are synchronization points grouping other units — they have no process of their own. Targets express "the system is at state X." Examples: multi-user.target, graphical.target, network-online.target.
Targets list their members via WantedBy= / RequiredBy=. Requires= enforces hard deps (failure aborts), Wants= is best-effort (most common).

Q: How do systemd timers replace cron?
A: A timer unit (*.timer) activates a service at intervals.
Example: /etc/systemd/system/backup.timer
[Unit]
Description=Nightly backup
[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
[Install]
WantedBy=timers.target
Pair with backup.service containing ExecStart=/usr/local/bin/backup.sh.
Commands: systemctl list-timers, systemctl start backup.timer, systemctl enable backup.timer.
OnCalendar format: Mon..Sun, *-*-*, hourly, daily.
Advantages over cron: integrated logging, dependencies, missed-run catch-up (Persistent=true), monotonic timers (OnBootSec).

Q: How do you make systemd journal persistent across reboots?
A: By default the journal lives in /run/log/journal/ and is lost on reboot.
Persist:
1. mkdir -p /var/log/journal
2. systemctl restart systemd-journald
3. (Optional) chown -R systemd-journal:systemd-journal /var/log/journal
Journal data is owned by the systemd-journal group, readable by members.
Set retention: in /etc/systemd/journald.conf:
SystemMaxUse=500M
MaxRetentionSec=30day
Then systemctl restart systemd-journald.
View members: getent group systemd-journal.

Q: What are cgroups and how do they relate to systemd?
A: cgroups (control groups) organize processes into hierarchies and apply resource limits — CPU shares, memory caps, I/O weights, PIDs max.
systemd auto-creates a cgroup per service at /sys/fs/cgroup/systemd.slice/<name>.service/.
In a unit file:
[Service]
CPUQuota=50%
MemoryMax=512M
IOWeight=500
TasksMax=100
Inspect: systemd-cgtop (top-like), systemctl status myservice shows cgroup path, cat /proc/<pid>/cgroup.
cgroups v2 (unified hierarchy) is the default on modern distros; enable with systemd.unified_cgroup_hierarchy=1 kernel param.

Q: How do you find which process is using the most resources?
A: CPU: top -c (then P to sort), ps -eo pid,user,pcpu,comm --sort=-pcpu | head, pidstat -u 1 (per-CPU).
Memory: ps -eo pid,user,pmem,rss,comm --sort=-rss | head, smem -rs rss for PSS (more accurate).
Disk I/O: iotop, pidstat -d 1.
Open files: lsof -p <pid>.
File descriptors: lsof -p <pid> | wc -l.
Network: nethogs (per-process bandwidth).
Aggregate: atop records historical system state.

Q: What is the difference between vmstat, iostat, and mpstat?
A: vmstat: virtual memory, CPU, I/O, system. vmstat 1 5 — sampled every second, 5 times. Columns: r runnable, b blocked, si/so swap in/out, bi/bo blocks in/out, us/sy/id/wa/st CPU percentages.
iostat: per-device disk I/O. iostat -xz 1 (extended, hide zero-utilization devices).
mpstat: per-CPU stats. mpstat -P ALL 1 shows all cores.
All part of sysstat: install sysstat package.
Persistent: enable sysstat service and edit /etc/sysstat/sysstat to set HISTORY retention.

Q: What is strace and how do you use it for debugging?
A: strace traces system calls a process makes.
Attach to a running process: strace -p <pid>
Trace a new command: strace -f -o trace.log ls /tmp (-f follows forks).
Filter to specific calls: strace -e openat,read,write ls /
Time each call: strace -ttt -T command (-ttt epoch µs, -T duration).
Count calls: strace -c command.
Common use: "why is this hanging?" → strace -p PID to see if it's blocked on futex, read, connect.
Use ltrace for library calls; perf trace for high-performance tracing.

Q: What is perf and how do you sample CPU performance?
A: perf is the Linux profiling subsystem.
Profile a command: perf stat ls / (counters), perf record -F 99 -a -g ls / (sample at 99 Hz, call graph).
View: perf report.
Top-like: perf top.
Tracepoints: perf list shows events; perf trace -e 'syscalls:sys_enter_openat' ls.
CPU-specific: perf record -c 100000 -e cycles:u ls.
Compare baseline vs patched: perf record -b ./baseline; perf record -b ./patched; perf diff.
Requires linux-tools package and usually root.

Q: What are common SSH tunneling patterns?
A: Local port forward: ssh -L 8080:internal.host:80 user@bastion — access internal.host:80 via localhost:8080.
Remote port forward: ssh -R 8080:localhost:80 user@bastion — exposes local port 80 on bastion as port 8080.
Dynamic SOCKS proxy: ssh -D 1080 user@host — point browser SOCKS5 to localhost:1080.
ProxyJump: ssh -J jumphost target (multi-hop).
Persistent in ~/.ssh/config:
Host internal
  HostName 10.0.0.5
  ProxyJump bastion
  LocalForward 8080 localhost:80
Reverse tunnels: keep alive with ServerAliveInterval 60 + autossh.

Q: How do you use rsync over SSH for efficient backups?
A: rsync -avz -e ssh /data/ user@backup:/backups/data/
Flags:
-a — archive (recursive, preserve perms, symlinks, times)
-v — verbose
-z — compress during transfer
--progress — show progress
--delete — remove extra files at destination (mirroring)
--exclude='*.tmp'
--dry-run — preview
Trailing / on source: /data/ copies contents; /data copies the directory itself.
Resume partial files (default since 2.6.4+).
Bandwidth limit: --bwlimit=5000 (KB/s).
Hard-link backups: rsync -a --link-dest=/prev /data/ backup:current/.

Q: What is a Linux cgroup and namespace and how do containers use them?
A: Namespaces (man namespaces) provide isolation: pid (process IDs), net (network), mount, uts (hostname), ipc, user (UID mapping), cgroup.
cgroups provide resource limits.
Together they form the basis of containers: each container has its own PID, network, mount, and UID namespaces plus cgroup-enforced CPU/memory limits.
Tools: unshare --pid --fork bash enters a new PID namespace; nsenter -t 1 -m -u -i -n -p bash enters host's namespaces.
Inspect container: cat /proc/1/cgroup, ls -l /proc/1/ns/.
Container runtimes: runc, crun, containerd.

Q: How does Linux network bridging work?
A: A bridge (virtual switch) connects multiple interfaces at Layer 2.
Create: ip link add br0 type bridge
Add iface: ip link set eth0 master br0
Bring up: ip link set br0 up
Assign IP to bridge: ip addr add 10.0.0.1/24 dev br0
This is the default for VMs (libvirt, VirtualBox) and containers (Docker uses docker0).
Show forwarding database: bridge fdb show
VLAN-aware bridges: ip link add br0 type bridge vlan_filtering 1, then bridge vlan add dev eth0 vid 10.

Q: What is a VLAN and how do you configure 802.1Q tagging?
A: VLANs segment a Layer 2 network. 802.1Q tags frames with a 12-bit VLAN ID (1–4094).
Create a tagged interface: ip link add link eth0 name eth0.10 type vlan id 10
Assign IP: ip addr add 10.10.0.1/24 dev eth0.10
The base interface eth0 can carry multiple VLANs side-by-side.
Delete: ip link delete eth0.10
Show: ip -d link show eth0.10.
Persistent: in /etc/network/interfaces or via NetworkManager with vlan.id connection property.
VLAN IDs 0 and 4095 are reserved.

Q: How do you configure a Linux host as a router?
A: 1. Enable forwarding: sysctl -w net.ipv4.ip_forward=1; persist in /etc/sysctl.d/router.conf.
2. Configure interfaces: assign IPs to each subnet.
3. Add firewall/NAT: with nft:
nft add table ip nat
nft add chain ip nat postrouting { type nat hook postrouting priority 0 \; }
nft add rule ip nat postrouting oifname "eth0" ip saddr 10.0.0.0/24 masquerade
4. On clients, set this host as default gateway.
5. Optionally run dnsmasq for DHCP+DNS and kea for IPv6.
Verify routes: ip route show, traceroute from a client.

Q: What is systemd-resolved split DNS?
A: Split DNS returns different answers per source network.
Configure per-link DNS in /etc/systemd/resolved.conf or via resolvectl dns eth0 10.0.0.1.
Route specific domains to specific servers: /etc/systemd/resolved.conf.d/split.conf:
[Resolve]
DNS=10.0.0.1 1.1.1.1
Domains=~internal — tilde means "and subdomains"
Then systemctl restart systemd-resolved. Queries for *.internal go to 10.0.0.1, others to 1.1.1.1.
Verify: resolvectl query host.internal (shows which server answered).

Q: How do you monitor log files in real time?
A: tail -f: tail -f /var/log/syslog
Multiple files: tail -F /var/log/{syslog,auth.log} (-F survives log rotation).
less equivalent: less +F /var/log/syslog (Shift+F to stop, F to resume).
multitail: multitail /var/log/syslog /var/log/auth.log — split-screen viewer.
lnav: lnav /var/log/ — advanced log navigator with SQL-like queries and histograms.
On systemd: journalctl -f.
For long-term aggregation use a log shipper (rsyslog, promtail, fluentd).

Q: What is logrotate and how is it configured?
A: logrotate rotates, compresses, and prunes log files.
Config: /etc/logrotate.conf + per-service files in /etc/logrotate.d/.
Example (/etc/logrotate.d/nginx):
/var/log/nginx/*.log { daily; rotate 14; compress; delaycompress; missingok; notifempty; create 0640 www-data adm; sharedscripts; postrotate [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid); endscript }
Test: logrotate -d /etc/logrotate.conf (debug, no changes).
Run: logrotate -f /etc/logrotate.conf.
Daily cron: /etc/cron.daily/logrotate.