Linux Operations

Most production incidents are not exotic — they are common symptoms of the same OS: out of space, memory eaten, a process hung, a service that will not come up, clocks drifting. A DevOps engineer is valued not for knowing rare flags but for hitting the precise command under incident pressure and understanding what it shows.

This large topic is a map of everyday administration: from where things live and how to read disk and memory, through managing processes and services (systemd, cron), to network, time, and security (permissions, PAM, firewall, MAC). The key traps are named right in the layers — du versus df, SIGTERM versus SIGKILL, VIRT versus RES, a transient ip addr add versus a persistent config.

Topic map

• Filesystem layout & inodes — where logs and configs live and what an inode actually holds.
• Disk usage — du versus df, finding large directories, and the deleted-open-file discrepancy.
• LVM — the PV/VG/LV layers and why a storage abstraction is useful.
• Memory inspection — free -h, the RES/VIRT/SHR columns, and free versus available.
• Swap & OOM — offloading pages to disk, swapon/swapoff, and the OOM killer.
• Process signals — SIGTERM versus SIGKILL and the right order to stop a process.
• systemd — the init system, PID 1, and managing services with systemctl.
• cron — the job scheduler and the cron.allow/cron.deny access gate.
• Package repositories — where APT/yum sources are configured and how to host your own.
• Network configuration — adding an IP and making it survive a reboot.
• Time synchronization — NTP, chrony/ntpd, and timedatectl.
• Permissions & sudo — /etc/sudoers, visudo, and the sticky bit.
• PAM — pluggable authentication and the module stack.
• Security tools — the firewall (iptables/firewalld) and MAC (SELinux/AppArmor).

Common traps

Interview relevance

The topic checks whether a candidate can be let near production without a babysitter. The interviewer gives short practical scenarios — "disk full", "out of memory", "service won't start" — and listens for whether you name the precise command and understand what stands behind it. The gap between "kill -9 fixes everything" and "SIGTERM first, SIGKILL for stuck ones" is immediately visible.

Typical checks:

• Disk and memory — du/df, free, RES versus VIRT, the du/df discrepancy.
• Processes and services — signals, systemd/PID 1, systemctl restart/enable.
• Configuration and security — persistent versus transient network config, sudoers, PAM, firewall versus MAC.

Common wrong answer: "to free space you delete the big files" or "ip addr add persists on its own". Behind such answers is usually a lack of practice on live servers — which is exactly what this topic exposes.