Linux Admin Interview — Fundamentals

Use for: entry-level Linux/sysadmin questions — processes, permissions, paths, disk usage, links, searching files, redirection.

Search keywords: linux fundamentals process thread chmod 644 permissions absolute relative path df du disk space hard link symbolic link find locate stdin stdout stderr grep cat less

Q1. What is the difference between a process and a thread?

A process is a running program with its own isolated memory space. A thread is a unit of execution that lives inside a process and shares that process's memory with its sibling threads. Creating a process is heavier (the kernel sets up a new address space), while threads are cheaper and can talk to each other directly through shared memory, which is also what makes them harder to get right.

What they're really testing: whether you understand isolation. Processes fail independently; one crashing thread can take down its whole process.

Q2. Explain chmod 644. What do those numbers mean?

Each digit is a permission set in octal, for owner, group, and others, in that order. Read is 4, write is 2, execute is 1, and you add them up. So 644 is read and write for the owner (6), read for the group (4), and read for others (4).

$ chmod 644 report.txt
$ ls -l report.txt
-rw-r--r-- 1 root root 6 Jun 17 06:42 report.txt
$ stat -c "%a %A %n" report.txt
644 -rw-r--r-- report.txt

The leading - in -rw-r--r-- is the file type (a dash for a regular file, d for a directory, l for a symlink).

What they're really testing: can you read a permission string at a glance, the way you will need to every time you debug an access error.

Q3. What is the difference between an absolute and a relative path?

An absolute path starts from the root and always begins with /, so /var/log/syslog points to the same file no matter where you are. A relative path is resolved from your current directory, so log/syslog means something different depending on where you stand. In scripts, prefer absolute paths or anchor relative ones deliberately, because a script that assumes the wrong working directory is a classic 2 a.m. bug.

Q4. How do you check disk space, and how is that different from file size?

df reports free space per mounted filesystem; du reports how much space a given path actually uses.

$ df -h /
Filesystem      Size  Used Avail Use% Mounted on
overlay         458G   23G  412G   6% /
$ du -sh /tmp/wk
12K /tmp/wk

The mnemonic that sticks: df is "disk free" (the whole filesystem), du is "disk usage" (a directory tree). They answer different questions, and confusing them is how people end up deleting the wrong thing.

Q5. What is the difference between a hard link and a symbolic link?

A hard link is a second name pointing at the exact same inode (the same physical data on disk). A symbolic link is a small separate file that just holds a path to another file.

$ ls -li original.txt hardlink.txt softlink.txt
616701 -rw-r--r-- 2 root root  5 Jun 17 06:42 hardlink.txt
616701 -rw-r--r-- 2 root root  5 Jun 17 06:42 original.txt
616702 lrwxrwxrwx 1 root root 12 Jun 17 06:42 softlink.txt -> original.txt

original.txt and hardlink.txt share inode 616701 and show a link count of 2. The symlink has its own inode and literally points at the name. The practical consequence: delete the original and the hard link still works (the data survives until the last name is gone), but the symlink becomes a dangling pointer. Hard links also cannot cross filesystems or link directories; symlinks can do both.

What they're really testing: do you understand that a filename is just a pointer to an inode, not the data itself. That idea pays off again in the "deleted-but-still-open" and "disk full but df shows space" troubleshooting questions.

Q6. How do you find files on a Linux system?

find for a live search by name, type, size, or modification time, and locate for a fast lookup against a prebuilt database when you just need a path quickly.

$ find /tmp/wk -type f -name "*.txt"
/tmp/wk/original.txt
/tmp/wk/report.txt
/tmp/wk/hardlink.txt

find is the one to know cold, because it composes: find /var/log -name "*.log" -mtime +7 -delete finds and removes logs older than a week in one line. The trade-off is that find walks the tree every time, while locate is instant but only as fresh as its last database update.

Q7. What are stdin, stdout, and stderr, and how do you redirect them?

Every process gets three streams by default: standard input (file descriptor 0), standard output (1), and standard error (2). The key insight for interviews is that normal output and error output are separate streams, so you can route them independently. command > out.log sends stdout to a file, 2> err.log sends stderr, and command > all.log 2>&1 merges both into one file. That last one trips people up: 2>&1 means "send stderr to wherever stdout is currently going", so order matters.

Q8. How do you view and search the contents of a file?

cat for short files, less for anything large (it pages without loading the whole file into memory), and grep when you know what you are looking for.

$ grep -E " (401|403)$" access.log
192.168.1.11 POST /login 401
192.168.1.42 GET /admin 403

For a senior answer, mention tail -f to watch a log live and grep -r to search a directory tree. Reaching for less instead of cat on an unknown file size is a small tell that you have been burned before.