Linux knowledge is expected for DevOps, backend, cloud, support and security roles. These Linux interview questions cover commands, files and permissions for freshers, then processes, services, networking, shell scripting, performance troubleshooting and the boot process for experienced engineers.
30 questions · Updated
Fundamentals, definitions and simple scenarios. Good for freshers and warm-ups.
ls to list files, cd to change directory, pwd to show the current directory, cp, mv and rm to copy, move and delete, mkdir to create directories, cat, less, head and tail to view files, grep to search text, find to locate files, chmod and chown for permissions, ps and top for processes, df and du for disk usage, and man to read documentation.
Each file has permissions for the owner, the group and others: read (r = 4), write (w = 2) and execute (x = 1). chmod 755 file gives the owner rwx and the group and others r-x. chown changes the owner and group.
For directories, execute means permission to enter it.
Special bits are setuid, setgid and the sticky bit, used on /tmp.
A hard link is another name for the same inode, so it still works if the original name is deleted, but it cannot cross file systems or link directories. A soft (symbolic) link is a separate file that points to a path, created with ln -s; it can link directories and cross file systems, but breaks if the target is removed.
/ is the root of everything. /etc holds configuration files, /home user directories, /root the root user's home, /var variable data such as logs (/var/log), /usr installed programs and libraries, /bin and /sbin essential commands, /tmp temporary files, /opt optional software, /dev device files, and /proc and /sys virtual file systems exposing kernel and process information.
An absolute path starts from the root, such as /var/log/nginx/error.log, and works from anywhere.
A relative path starts from the current directory, such as logs/app.log or ../config.
A single dot means the current directory, two dots the parent, and ~ the home directory.
Scripts should use absolute paths or paths based on the script location to avoid surprises.
find /var/log -name "*.log" -mtime -1 finds log files changed in the last day, and find . -size +100M finds large files. grep -rn "ERROR" /var/log/app searches text recursively with line numbers, -i ignores case, -v inverts the match and -c counts matches. locate searches a prebuilt index quickly, and ripgrep (rg) is a faster grep.
A pipe (|) sends one command's output into another's input, such as ps aux | grep nginx. > writes output to a file (overwriting), >> appends, < reads input from a file, 2> redirects errors, and 2>&1 sends errors to the same place as normal output. /dev/null discards output, and tee writes to a file and the screen at the same time.
Use the distribution's package manager: apt on Debian and Ubuntu (apt update, apt install nginx), dnf or yum on Red Hat, Fedora and Rocky Linux, zypper on SUSE, and apk on Alpine.
Package managers handle dependencies and updates.
Snap and Flatpak provide distribution-independent packages, and software can also be built from source.
useradd or adduser creates users, passwd sets passwords, usermod -aG docker ravi adds a user to a group, userdel removes users, and groups and id show membership. User accounts are stored in /etc/passwd, password hashes in /etc/shadow and groups in /etc/group. sudo lets permitted users run commands as root, configured with visudo.
Environment variables are name-value settings available to processes, such as HOME, USER and LANG. PATH lists the directories the shell searches for commands, so adding a directory to PATH lets you run its programs by name. export NAME=value sets a variable for the session and child processes, env lists them, and permanent settings go in files such as ~/.bashrc or /etc/environment.
tar -czf backup.tar.gz folder/ creates a gzip-compressed archive, tar -xzf backup.tar.gz extracts it, and tar -tzf lists its contents. -j uses bzip2 and -J uses xz for better compression. zip and unzip handle .zip files, and gzip and gunzip compress single files.
Applied problems, trade-offs and questions about your own projects.
I use top or htop to find the process and its PID, or ps aux --sort=-%cpu | head.
I check what it is with ps -fp PID or by looking at its logs.
Then I stop it gracefully with kill PID (SIGTERM) and only use kill -9 (SIGKILL) if it does not respond, since SIGKILL gives no chance to clean up.
If it is a service, I use systemctl stop or restart instead.
systemctl start, stop, restart and status control a service, systemctl enable makes it start at boot, and systemctl list-units --type=service lists services.
Logs are viewed with journalctl -u service-name, with -f to follow.
Custom services are defined in unit files under /etc/systemd/system, followed by systemctl daemon-reload.
df -h shows disk usage per file system and df -i shows inode usage. du -sh /var/* | sort -h finds the largest directories, and ncdu does this interactively. Common causes are large logs, old backups, Docker images or deleted files still held open by a process, which lsof +L1 reveals; restarting that process frees the space.
ip addr and ip route show interfaces and routes, ping checks reachability, traceroute or mtr shows the network path, ss -tulpn (or netstat) shows listening ports and the processes that own them, dig or nslookup checks DNS, curl -v tests HTTP endpoints, and tcpdump captures packets for deep analysis.
sed is a stream editor for transforming text, most often for substitutions: sed -i "s/old/new/g" config.txt replaces text in a file. awk processes text by columns: awk '{print $1}' access.log prints the first field, and awk '$9 == 500' access.log filters lines where the ninth field is 500. Together with grep, sort, uniq and cut, they make quick log analysis possible.
cron runs commands on a schedule. crontab -e edits the current user's jobs, each line having five time fields (minute, hour, day of month, month, day of week) followed by the command, so 30 2 * * * /opt/backup.sh runs at 2:30 every night. Output should be redirected to a log, scripts should use absolute paths since cron has a minimal environment, and systemd timers are a modern alternative.
Generate a key pair with ssh-keygen -t ed25519, copy the public key to the server with ssh-copy-id, and log in without passwords. To harden the server, disable password authentication and root login in /etc/ssh/sshd_config, allow only specific users, use a firewall and fail2ban, and keep keys protected with passphrases. ~/.ssh/config stores host shortcuts and options.
Processes can be running (R), sleeping (S), in uninterruptible sleep usually waiting on disk (D), stopped (T) or zombie (Z, finished but not yet collected by the parent). Signals tell processes to act: SIGTERM (15) asks politely to stop, SIGKILL (9) forces it, SIGHUP often reloads configuration, SIGINT is Ctrl+C and SIGSTOP pauses.
Run it in a terminal multiplexer such as tmux or screen, which keeps sessions alive and lets you reattach later, or use nohup command & so it ignores the hang-up signal. Long-running services should instead be proper systemd services, which restart on failure, start at boot and log to the journal. jobs, bg and fg manage background jobs in the current shell.
An inode is a data structure that stores a file's metadata: owner, permissions, size, timestamps and where its data blocks are, but not its name.
Directory entries map names to inode numbers.
A file system has a fixed number of inodes, so millions of tiny files can exhaust them while disk space remains; df -i shows inode usage and ls -i shows inode numbers.
Swap is disk space used as overflow memory when RAM is full; it prevents crashes but is much slower, so heavy swapping makes a server crawl.
When memory runs out completely, the kernel's out-of-memory killer terminates a process, chosen by its oom_score, to keep the system alive, which shows up in dmesg or the journal.
Fixes include adding memory, setting limits and fixing memory leaks.
System design, deep internals, leadership and tough follow-ups.
The script reads usage with df, for example df --output=pcent / | tail -1 | tr -dc '0-9', compares it with a threshold in an if statement, and sends an alert by email or a webhook such as Slack when it is higher.
I add set -euo pipefail for safety, log the result, and schedule it with cron or a systemd timer.
In production, a monitoring tool such as Prometheus does this better.
I check load average with uptime, then CPU and memory with top or htop, memory and swapping with free -h and vmstat, disk I/O with iostat and iotop, and network with ss and iftop.
I look at logs with journalctl and dmesg for errors such as OOM kills or disk problems.
The goal is to find which resource is the bottleneck, then which process is causing it.
The firmware (BIOS or UEFI) runs hardware checks and loads the bootloader, usually GRUB, which loads the kernel and the initramfs. The kernel initialises hardware and drivers, mounts the root file system and starts the first process, PID 1, which is systemd on most distributions. systemd then starts services and targets until the system reaches a login prompt or graphical target.
Logical Volume Manager adds a flexible layer between physical disks and file systems.
Physical volumes are grouped into volume groups, from which logical volumes are created.
Logical volumes can be resized while in use, span several disks and be snapshotted for backups, so you can grow a full /var partition by adding a disk without reinstalling.
They are mandatory access control systems that restrict what programs can do even if they run as root.
SELinux, used on Red Hat-based systems, labels files and processes and enforces policies; AppArmor, used on Ubuntu and SUSE, uses path-based profiles per program.
They limit damage if a service is compromised.
Problems should be fixed with correct labels or policies, not by disabling them.
sysctl views and changes kernel parameters at runtime, such as net.core.somaxconn for connection backlogs, vm.swappiness, or enabling IP forwarding, with permanent settings in /etc/sysctl.d/. ulimit sets per-process resource limits, such as the maximum number of open files (nofile), which busy servers and databases often need raised; systemd services set it with LimitNOFILE.
Work up the layers: check the interface and IP address (ip addr), the route (ip route), whether the gateway and target respond (ping, mtr), DNS resolution (dig), whether the port is reachable (nc -zv host 443 or curl -v), whether the service is listening (ss -tulpn), and firewall rules on both sides (nftables, iptables, ufw, firewalld and cloud security groups). tcpdump shows whether packets arrive.
Keep packages updated with automatic security updates, remove unused services and packages, use SSH keys only and disable root login, enable a firewall allowing only needed ports, run services as dedicated non-root users, enable SELinux or AppArmor, set up fail2ban, centralise logs and audit with auditd, use disk encryption where needed, and take tested backups. Benchmarks such as CIS help check settings.
See all DevOps Engineer interview questions, covering Linux, Git, Docker, Kubernetes, CI/CD (GitHub Actions, Jenkins) and more.