Linux Filesystems & Storage
Inodes and links, filesystem types, RAID levels, LVM, mounts and fstab, disk I/O analysis, and the buffer/cache in free output.
9 questions
JuniorTheoryVery commonWhat do the rwx permission bits mean, and how do you read a chmod octal like 754?
What do the rwx permission bits mean, and how do you read a chmod octal like 754?
Each file has three permission triads — owner, group, others — each with read (r=4), write (w=2), execute (x=1). An octal digit sums those bits, so 754 is owner rwx (7), group r-x (5), others r-- (4). On a directory, x grants the right to enter and traverse it, not to execute.
Common mistakes
- ✗Reading octal digits left to right as r, w, x instead of as owner, group, others
- ✗Summing the wrong bit values (r=4, w=2, x=1) so 7 is not rwx
- ✗Thinking x on a directory means execute rather than the right to traverse it
Follow-up questions
- →What does the execute bit allow on a directory versus on a regular file?
- →How would you add write for the group without changing the other bits?
JuniorTheoryVery commonName common Linux filesystem types (ext4, XFS, Btrfs) and one difference between them.
Name common Linux filesystem types (ext4, XFS, Btrfs) and one difference between them.
ext4 is the mature general-purpose default — reliable and simple, but cannot shrink online and has no snapshots. XFS is a high-performance journaling filesystem strong at large files and parallel I/O; it grows online but never shrinks. Btrfs is copy-on-write with built-in snapshots, checksums, and subvolumes.
Common mistakes
- ✗Assuming every filesystem can be shrunk online (XFS cannot)
- ✗Attributing Btrfs snapshots and checksums to ext4
- ✗Thinking these filesystems skip journaling and need fsck on each mount
Follow-up questions
- →Why might you pick XFS over ext4 for a large-file, high-throughput workload?
- →What do Btrfs (or ZFS) snapshots give you that ext4 does not?
JuniorTheoryCommonWhat is the difference between a hard link and a symbolic link in Linux?
What is the difference between a hard link and a symbolic link in Linux?
A hard link is another directory entry for the same inode, so both names are equal peers and data survives until the link count hits zero. A symlink is a separate file holding a path to a target — it can cross filesystems and point at directories but dangles if the target is deleted. A hard link cannot cross filesystems.
Common mistakes
- ✗Believing a hard link stores a path rather than sharing the inode
- ✗Thinking a symlink keeps its target alive, so it can never dangle
- ✗Expecting a hard link to work across different filesystems
Follow-up questions
- →Why can a hard link not cross filesystem boundaries but a symlink can?
- →What happens to a hard-linked file's data when you delete one of its names?
JuniorTheoryCommonWhat is an inode in a Linux filesystem, and what does it store versus not store?
What is an inode in a Linux filesystem, and what does it store versus not store?
An inode is the on-disk record for one file: its metadata — size, owner, permissions, timestamps, link count, and pointers to the data blocks — but NOT the filename or the contents. Inodes are a fixed count, so tiny files can exhaust them while df still shows free space; check df -i.
Common mistakes
- ✗Thinking the filename is stored in the inode rather than the directory entry
- ✗Assuming a filesystem can never run out of inodes while
dfshows free space - ✗Believing the inode holds the file's data instead of pointers to data blocks
Follow-up questions
- →How can a filesystem be out of inodes while
dfstill shows free space, and vice versa? - →Why do millions of tiny files strain a filesystem more than a few large ones?
JuniorTheoryCommonWhat is a mount, and how does /etc/fstab make a mount survive a reboot?
What is a mount, and how does /etc/fstab make a mount survive a reboot?
Mounting attaches a filesystem (on a device like /dev/sda1) onto a directory — the mount point — in the one unified tree; mount does it at runtime, but that is lost on reboot. /etc/fstab lists what to mount at boot by device or UUID with mount point, type, and options, so they return automatically.
Common mistakes
- ✗Assuming a runtime
mountpersists across a reboot without/etc/fstab - ✗Thinking mounting copies files rather than attaching a filesystem into the tree
- ✗Not knowing
/etc/fstabcan reference a stableUUIDinstead of a/devname
Follow-up questions
- →What is a bind mount, and when would you use one?
- →Why prefer a
UUIDover/dev/sdXin/etc/fstab?
JuniorTheoryOccasionalWhat does ls -l tell you about a file, and what does stat add?
What does ls -l tell you about a file, and what does stat add?
ls -l shows per-file metadata: type and permission bits, hard-link count, owner and group, size, and mtime, plus the name. stat reads the same inode but adds more — the inode number, block count, exact atime/mtime/ctime timestamps, and the device. Both read inode metadata, not file contents.
Common mistakes
- ✗Thinking
ls -lorstatreads file contents rather than inode metadata - ✗Believing
statshows less detail thanls -l - ✗Confusing mtime (data changed) with ctime (inode metadata changed)
Follow-up questions
- →What is the difference between mtime, ctime, and atime?
- →Why does the hard-link count in
ls -lmatter when you delete a file?
MiddleCodeOccasionalWrite a one-liner that finds the 10 largest files under a directory tree.
Write a one-liner that finds the 10 largest files under a directory tree.
Recurse for regular files and rank by size. Use find /var -type f printing each file's byte size and path, piped to sort -rn | head -10 — files only, largest first. A quick alternative is du -ah /var | sort -rh | head, though du also lists directories. ls cannot recurse a subtree.
Common mistakes
- ✗Expecting
ls -Sto recurse and rank a whole subtree's files - ✗Using
df(free space on a mount) to rank individual files by size - ✗Sorting human-readable sizes with
sort -ninstead ofsort -rh
Follow-up questions
- →If
duanddfdisagree on used space, what should you suspect? - →How would you restrict the search to only files larger than 100 MB?
MiddlePerformanceOccasionalA host shows high I/O wait and sluggish response — how do you find the responsible process and device?
A host shows high I/O wait and sluggish response — how do you find the responsible process and device?
High iowait means CPUs stall waiting on disk, so the bottleneck is storage, not CPU. Confirm with iostat -x 1 — a device near 100% %util with high await is saturated. Attribute it with iotop or pidstat -d 1 to see which process drives the I/O, then map the busy device to its mount and remedy it.
Common mistakes
- ✗Reading high iowait as CPU-bound and adding cores instead of fixing storage
- ✗Not attributing the I/O to a process with
iotop/pidstatbefore acting - ✗Confusing
%util(device busy time) with the free disk space remaining
Follow-up questions
- →If
duanddfdisagree after you clear files, what would you check withlsof? - →How do
awaitand%utiliniostat -xdistinguish a slow disk from a busy one?
JuniorTheoryRareIn RAID 6, how many disks can fail without data loss, and what is the usable capacity of N disks?
In RAID 6, how many disks can fail without data loss, and what is the usable capacity of N disks?
RAID 6 uses double distributed parity, so any two disks may fail without data loss and usable capacity is N−2 disks. By contrast RAID 0 stripes with no redundancy, RAID 1 mirrors at half capacity, RAID 5 is single parity (N−1, survives one loss), and RAID 10 mirrors then stripes at half capacity.
Common mistakes
- ✗Confusing RAID 6 (two-disk tolerance, N−2) with RAID 5 (one-disk, N−1)
- ✗Thinking RAID 0 provides redundancy rather than pure striping
- ✗Assuming parity RAID keeps full capacity with no space cost
Follow-up questions
- →Why does RAID 6 protect against a second failure during a RAID 5 rebuild window?
- →When would you choose RAID 10 over RAID 6 despite the capacity cost?
