Most Linux interview lists recycle the same 10 questions from a decade ago, and many of the “official” answers are outdated or no longer apply to modern Linux distributions.
While the fundamentals haven’t changed, Linux itself has evolved.
Tools like journalctl have replaced older logging methods on many distributions, ss has largely replaced netstat, and several traditional services and commands are no longer the default.
If you’re preparing for a Linux System Administrator, DevOps, or Site Reliability Engineer (SRE) interview, simply memorizing answers isn’t enough.
Interviewers often ask follow-up questions to see whether you truly understand the concepts and can solve real-world problems.
Being able to explain why something works and demonstrate it with the correct Linux command can make all the difference.
We originally published this interview guide several years ago, but it was due for an update.
Some of the services mentioned in the original version are no longer used on modern Linux distributions, and one of the answers was technically incorrect.
We’ve completely revised the guide to reflect today’s Linux environments, replacing outdated information with practical, accurate explanations and the commands you’ll actually use as a Linux administrator.
Whether you’re preparing for your first Linux interview or brushing up on your skills before your next role, these 15 interview questions will help you build the confidence to answer beyond textbook definitions and demonstrate real hands-on Linux knowledge.
Press Ctrl+Z while a process is running in the foreground.
This sends the SIGTSTP (Terminal Stop) signal, which pauses the process without terminating it and returns you to the shell prompt.
Once the process is suspended, you can manage it using the following job control commands:
For example, suppose you start a large rsync backup and then realize you need the terminal for another task.
Instead of stopping the transfer and starting over, press Ctrl+Z to suspend it, run bg to continue it in the background, and keep working in the same terminal.
If you later need to interact with the process again, use fg %1 (replace %1 with the appropriate job number) to bring it back to the foreground.
Ctrl+C sends the SIGINT signal, which interrupts (usually terminates) the process, whereas Ctrl+Z sends SIGTSTP, which merely pauses it.
The minimum partition required to install Linux is a single root (/) partition.
The system can boot and run with just this partition.
However, most production systems use a few additional partitions or volumes:
To troubleshoot boot problems or review what happened during startup, you can use these commands:
For example:
On older Linux distributions that used the SysV init system, boot logs were commonly stored in files such as /var/log/boot.log.
On modern Linux distributions that use systemd, however, journalctl is the primary tool for viewing boot logs and troubleshooting startup issues.
Years ago, the expected answer to this question was syslogd, because it was the standard system logging daemon on traditional Unix and Linux systems.
While you may still hear it mentioned in interviews, most modern Linux distributions have moved to newer logging solutions.
Today, the logging system depends on the Linux distribution you’re using:
Knowing which logging system your distribution uses is important because the commands for viewing logs are different.
For example, to check SSH login activity:
If you’re troubleshooting a service, you can also view its logs with:
Understanding the difference between rsyslog and systemd-journald shows that you’re familiar with how logging works on modern Linux systems, not just older distributions.
Before running fsck on the root filesystem, it must not be mounted in read-write mode.
Running fsck on an active, writable filesystem can lead to data corruption because the operating system may still be writing to the disk while the check is in progress.
The safest approaches are:
For example:
To force a filesystem check during the next boot:
On modern systemd-based distributions, you can also add the kernel boot parameter:
This tells the system to perform a filesystem check during startup.
A traditional Unix tool for copying an entire directory tree is cpio.
It preserves the directory hierarchy and can also retain file permissions and timestamps.
Although it isn’t used as frequently today, it still appears in certification exams such as The LFCS Certification Preparation Course and in some Linux interviews.
A classic example is:
Here’s what each part does:
Although cpio is still worth knowing for certifications and interviews, most Linux administrators now use rsync for this task because it’s simpler, faster, and can resume interrupted transfers.
For example:
The -a (archive) option preserves the directory structure, permissions, ownership, timestamps, symbolic links, and other important file attributes, making it the preferred choice for most real-world Linux systems.
The standard tool for automating log rotation on Linux is logrotate.
It manages log files by rotating, compressing, removing, and recreating them based on rules you define.
This prevents log files from growing indefinitely and consuming valuable disk space.
On most Linux distributions, including Ubuntu, Debian, RHEL, Rocky Linux, and Fedora, logrotate is installed by default and runs automatically through cron or a systemd timer.
Configuration files are stored in:
A typical logrotate configuration lets you control:
For example:
This configuration rotates the log every week, keeps four archived copies, compresses old logs, ignores missing log files, and skips rotation if the log file is empty.
One important point worth mentioning in an interview is that systemd journal logs are not managed by logrotate.
Instead, systemd-journald manages its own logs.
To reduce journal logs to a maximum size:
Permanent journal storage limits are configured in:
For example, you can set options such as SystemMaxUse to limit how much disk space the journal is allowed to use.
The at command schedules a one-time task to run at a specified date and time.
To view pending jobs, use at -l or its equivalent atq.
The output displays the job number, scheduled execution time, and the user who created the job.
Example:
(Replace 3 with the appropriate job number.) If you no longer need a scheduled job, you can remove it with:
This command deletes the specified job from the queue.
Interviewers often ask this question to test whether you understand the difference between at and cron.
For example, if you’re asked to schedule a one-time database backup at 2:00 AM tonight without modifying the system crontab, at is the correct tool.
To list the contents of a tar archive without extracting any files, use the tar command with the -t (list) option.
Here’s what each option does:
A typical output looks like this:
Listing an archive before extracting it is a good practice because it lets you verify the files it contains and their directory structure.
One useful detail is that modern GNU tar automatically detects common compression formats such as gzip (.tar.gz), bzip2 (.tar.bz2), and XZ (.tar.xz).
This means you usually don’t need to specify options like -z, -j, or -J explicitly.
For example, these commands all work with modern GNU tar:
Older versions of tar often required compression-specific options, which is why you’ll still see commands like tar -ztvf archive.tar.gz in older documentation.
A page fault occurs when a running process tries to access a memory page that is not currently mapped into physical RAM.
Contrary to a common misconception, page faults do not occur when a program exits, they happen while a program is actively running and requesting memory.
When a page fault occurs, the Linux kernel determines whether the required page can be mapped immediately or whether it must first be loaded from disk.
There are two types of page faults you should know:
You can monitor system-wide memory and swap activity with:
Pay attention to the si (swap in) and so (swap out) columns.
Consistent activity in these columns may indicate that the system is under memory pressure.
To view page fault statistics for a specific process, use:
Here:
A high number of major page faults often indicates that the system is running low on available memory and spending time reading pages from disk instead of RAM.
A return code, also known as an exit status, is the value a program returns to the shell when it finishes executing.
By convention:
To check the exit status of the last command, use:
If grep finds a match, echo $? returns 0.
If no match is found, it returns a non-zero exit status.
Exit codes are especially useful in shell scripts, where you can control what happens next based on whether a command succeeds or fails.
For example:
This makes it easy to automate tasks and handle errors without writing complex logic.
Both hard links and symbolic (soft) links provide another way to access a file, but they work differently.
A hard link is another directory entry that points to the same inode as the original file.
Since both names refer to the same data on disk, deleting the original filename does not remove the file as long as at least one hard link still exists.
A symbolic link (or symlink) is a special file that stores the path to another file or directory.
If the original file is deleted or moved, the symlink becomes broken because its target no longer exists.
Create them using:
There are a few important differences:
In practice, symbolic links are used far more often because they’re flexible and can point to files or directories anywhere on the system.
Hard links are mainly used when multiple filenames need to reference the same underlying file without duplicating its data.
The kill command sends signals to processes.
The two signals most commonly discussed in interviews are SIGTERM (15) and SIGKILL (9).
In most cases, you should try SIGTERM first.
In fact, if you don’t specify a signal, kill sends SIGTERM by default.
For example:
Use SIGKILL only when a process is completely unresponsive and does not exit after receiving SIGTERM.
Forcefully killing applications such as databases can interrupt ongoing operations and may leave data in an inconsistent state.
The recommended tool for viewing network connections on modern Linux systems is ss.
It has replaced netstat on most distributions because it’s faster and reads socket information directly from the kernel.
To display all listening TCP and UDP ports along with the owning process, run:
The options mean:
Example output:
If a service fails to start, one of the first things to check is whether another process is already using the required port.
For example:
This quickly tells you whether the service is listening on the expected port or if another application has already claimed it.
The Out-Of-Memory (OOM) killer is a Linux kernel feature that automatically terminates a process when the system runs out of available memory and cannot recover by using swap space.
Its goal is to free memory and keep the system running instead of allowing it to become completely unresponsive.
The OOM killer does not choose a process at random.
The kernel assigns each process an OOM score based on factors such as its memory usage and other criteria.
Processes with a higher score are more likely to be terminated.
To view the OOM score of a process, run:
You can also influence how likely a process is to be selected by adjusting its oom_score_adj value:
The value ranges from -1000 to 1000:
For example, to protect a critical process:
If a system is repeatedly invoking the OOM killer, it’s usually a sign that it needs more available memory, a larger swap space, or applications that use less memory.
To find files that were modified within the last 24 hours, use the find command with the -mtime option:
Here’s what it means:
You can also search for other time ranges:
If you need more precise control, use -mmin, which works in minutes instead of days.
For example, to find files modified within the last hour:
This command is especially useful when troubleshooting issues.
If a service suddenly stops working, you can quickly identify log files, configuration files, or other files that were recently modified and investigate what changed before the problem occurred.
Linux interview questions are designed to test more than your ability to memorize commands.
Interviewers want to know whether you understand how Linux works, can explain key concepts clearly, and know which commands to use when troubleshooting real systems.
The 15 questions in this guide cover topics you’ll encounter in many Linux system administrator, DevOps, and cloud engineering interviews.
Spend some time practicing each command on a Linux machine, experiment with different options, and try to understand the output instead of simply memorizing it.
That hands-on experience will make it much easier to answer follow-up questions with confidence.
If you’re preparing for Linux interviews, keep this guide as a quick reference and revisit these concepts regularly.
A solid understanding of the basics is often what sets successful candidates apart.
10 Core Linux Interview Questions and Answers – Part 4
10 Linux Interview Questions with Examples – Part 3
Top 15 VsFTP Server Interview Questions with Detailed Answers
15 Linux Interview Questions with Answers (Level Up) – Part 2
15 Basic Linux Interview Questions with Answers (Entry-Level)
25 Apache Interview Questions for Beginners and Intermediate Users
In yum client not access to server , I’m getting the error “access denied” I checked iptables services and configuration files also.
all are correct.
the error is”ftp://192.168.231.131/pub/rhel6/repodata/repomd.xml: [Errno 14] PYCURL ERROR 67 – “Access denied: 530”
..
what to do
Q: 2…………
Minimum 2 partitions are needed for installing Linux.
The one is / or root and another is swap
Q7.
How to know who has scheduled the job?
As per your answer #at –l command please let know clarity about it.
Acutely I am not aware of it please…
Thank you,
Sathish
8 – I would choose tar -tf archive.tar 🙂 or tar -atf archive.tar.[bz2|gz|xz] 😉
and on question 2, I suppose space is missed between / and root: /root 🙂
And regarding 2nd, cool thing about partitions I didn’t knew, will double check, but I think it has limitation on Partition Table, not just type of disk 😉
Thanks 🙂
Welcome @ Anno.
Keep Connected!
1.
^Z suspends a program, but does not run it in the background.
To run it in the background you use another command.
(You *do* know what it is, don’t you?)
2.
/root is not a partition; it is a directory in the root partition; the root partition is /.
5.
Why not cp -a?
10.
Return codes are not a feature of the shell.
All programs leave a return code whetehr they are run by the shell or not.
TCPflow – Analyze and Debug Network Traffic in Linux
nload – Monitor Linux Network Bandwidth Usage in Real Time
How to Install Icinga2 Monitoring Tool on Debian
Setting Up Real-Time Monitoring with ‘Ganglia’ for Grids and Clusters of Linux Servers
How to Setup Rsyslog Client to Send Logs to Rsyslog Server in CentOS 7
How to Install Nagios Monitoring in RHEL, Rocky, and AlmaLinux
Fish – A Smart and User-Friendly Interactive Shell for Linux
How to Install and Use Chrony in Linux
How to Kill a Process in Linux from Command Line
How to Transfer Files Between Two Computers using nc and pv Commands
Assign Read/Write Access to a User on Specific Directory in Linux
Find Out All Live Hosts IP Addresses Connected on Network in Linux
10 Top Open Source Caching Tools for Linux in 2024
5 Best Open-Source eLearning Platforms for Linux in 2024
7 Best Audio and Video Players for Gnome Desktop
3 Best Document Collaboration Platforms for Linux in 2024
10 Best Clipboard Managers for Linux
10 Tools to Monitor Linux Disk Partitions and Usage in Linux
—
**📚 Original Source:**
[15 Linux Interview Questions and Answers for System Administrators](https://www.tecmint.com/linux-interview-questions-with-answers/)
About The Author
