You SSH into a misbehaving Linux server. What are the first things you check?
What they are really testing: Whether you have a fast, repeatable triage routine that covers the big four (CPU, memory, disk, logs) instead of poking randomly. They want a mental checklist.
A real interview question
You SSH into a misbehaving Linux server. What are the first things you check?
What most people say
drag me
“I would check the application logs to see what is wrong.”
App logs are one input, but if the box is out of disk, memory, or CPU, the app logs may be a symptom, not the cause. A senior checks the host vitals first to know which layer is failing.
The follow-ups they ask next
Where do you look for an OOM (out-of-memory) kill?
dmesg or journalctl -k shows the kernel "Out of memory: Killed process" line with the victim. It means memory pressure, set limits or right-size, and find the leak/spike.
Everything seems fine on the host but the app is still slow. Now what?
Look outward: a slow dependency (DB, downstream API), DNS, or network latency; check connections (ss), and trace a slow request. The bottleneck is off-box.
What the interviewer is listening for
- Has a CPU/mem/disk/logs routine
- Checks df -i not just df -h
- Knows where OOM kills appear
- Checks the service is listening
What sinks the answer
- Only reads app logs
- No host-vitals routine
- Misses disk/inode/OOM as causes
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I sweep vitals first: [load/CPU via top], [memory via free -h + dmesg for OOM], [disk via df -h and df -i], [logs via journalctl + /var/log + dmesg], then [the service: systemctl status + ss -tlnp + its dependencies]. That tells me [which layer is failing] before I assume it is the app.”
Keep going with linux
Foundation
Explain Linux file permissions. What does chmod 644 mean, and what would 755 be for?
Foundation
How do you find a running process and stop it? What is the difference between SIGTERM and SIGKILL?
Foundation
Explain PATH, environment variables, and how pipes and redirection work in the shell.
Junior
A server reports the disk is full. Walk me through finding what is using the space.
Junior
A systemd service will not start. How do you investigate?
Junior
How do you check what is listening on a port, and test whether you can reach a remote service?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free