Troubleshooting

A Linux server suddenly loses connectivity to a single peer host (10.0.5.20) on the same subnet, while all other hosts on that subnet remain reachable. Ping to 10.0.5.20 fails, but the interface is up and the default route is intact. You suspect the peer's NIC was recently replaced. Which command output would most directly confirm that a stale link-layer mapping is causing the failure?

After a kernel update, a RHEL 9 server fails to boot. The console displays a kernel panic with the message: 'VFS: Unable to mount root fs on unknown-block(0,0)'. You boot into the previous working kernel entry from the GRUB menu, and the system starts normally. Comparing /boot, you notice the initramfs file for the new kernel is 0 bytes. What is the most appropriate action to fix booting into the new kernel?

A web application server suddenly fails to connect to an external API, logging TLS errors like 'certificate is not yet valid'. The certificate has a valid date range confirmed by the API vendor, and DNS resolves correctly. You run 'timedatectl' and see the local time is set several days in the past, with NTP synchronization inactive. What is the MOST likely root cause of the connection failure?

A user reports that a newly provisioned Linux server can reach other hosts on its local subnet (192.168.10.0/24) but cannot reach any external hosts or the internet. Name resolution using an external DNS server also fails. You log in and run 'ping 8.8.8.8', which returns 'connect: Network is unreachable'. Which command output would most directly confirm the root cause of this problem?

A server hosting a software RAID 1 array (/dev/md0 built from /dev/sdb1 and /dev/sdc1) is still online but users report degraded performance. You suspect a disk problem. Which command will confirm whether the array is running in a degraded state and identify the failed member?

A web server's root filesystem is reporting 100% full, causing application errors. You delete a large 8 GB log file at /var/log/app/huge.log, but `df -h` still shows the filesystem as full. `du -sh /var/log/app` no longer accounts for the file's size. What is the most likely reason the space has not been reclaimed, and how can you confirm it?

A web application managed by the systemd unit 'appd.service' fails to start after a configuration change. Running 'systemctl status appd.service' shows the unit is in a 'failed' state with exit code 1, but the truncated output does not reveal the underlying cause. Which command will show the complete log output specific to this unit's most recent start attempt?

A user reports that files on a secondary data disk mounted at /data are intermittently unreadable, and dmesg shows repeated 'EXT4-fs error' messages referencing bad block references and directory corruption. The disk passes a SMART self-test with no reallocated sectors. You need to repair the filesystem structure safely. Which approach should you take?

A mail relay server suddenly refuses to write new files, and applications report 'No space left on device' errors. However, a colleague runs 'df -h' and reports that the root filesystem shows 47% used with plenty of gigabytes free. The /var/spool/mail directory contains millions of tiny message files. What command should you run to confirm the true cause of the write failures?

A logging daemon on a RHEL 9 server has stopped recording new entries, and several applications report intermittent errors when writing to /var/log. The root filesystem shows plenty of free space when you run 'df -h /'. However, 'df -h /var/log' reveals that /var/log is a separate mount at 100% usage. Before adding storage, you want to reclaim space quickly and safely. Which command gives you the most targeted information to identify what is consuming the space on the /var/log filesystem?

Users report intermittent I/O errors when writing to /dev/sdb on a database server. The filesystem occasionally remounts read-only, and journalctl shows repeated 'medium error' and 'unrecovered read error' messages referencing sdb. You suspect the physical drive is failing. Which command gives you the most direct insight into the drive's internal health and reallocated sector counts to confirm hardware failure?

Users report that a database server has become extremely sluggish, though the application processes appear healthy. Running 'top' shows CPU usage is mostly idle but the '%wa' (iowait) value is consistently above 40%. You need to identify which physical device is saturated and confirm high disk latency before escalating to the storage team. Which command provides the per-device utilization and average I/O wait/service time you need?

A monitoring alert reports that a database server has a load average of 24.0 on an 8-core system, yet top shows CPU usage is only about 15% with over 80% idle. Users report the application feels extremely sluggish. What is the MOST likely cause of the high load average?

A server fails to complete boot after a power outage. The console shows the system dropping into an emergency shell with the message: 'Failed to mount /data. Dependency failed for Local File Systems.' The root filesystem is mounted read-only. You need to identify the root cause before the system can boot normally. Which command should you run FIRST from the emergency shell to investigate why the /data mount failed?

Users at a branch office report that a web application hosted at the central data center is intermittently slow, with occasional timeouts, while local applications work fine. A ping from a branch Linux host to the data center gateway shows 0% loss, but pings to the application server occasionally drop replies. You need to identify at which network hop packet loss and latency are being introduced along the path. Which command is the BEST tool for this investigation?

A web application server intermittently becomes unresponsive, and a critical database process is being terminated without an obvious cause. The administrator suspects memory exhaustion. Which command will most directly confirm that the Linux kernel's Out-of-Memory killer terminated the process and identify which process it killed?

A newly attached external drive fails to mount. Running 'mount /dev/sdc1 /mnt/backup' returns: 'mount: /mnt/backup: wrong fs type, bad option, bad superblock on /dev/sdc1, missing codepage or helper program, or other error.' The device shows up in 'lsblk', and the partition is healthy. You suspect the kernel does not know how to handle this partition's filesystem. Which command sequence BEST identifies the actual filesystem so you can mount it correctly?

A user reports that an internal application server, app.corp.local, is unreachable from a Linux workstation, while other internal hosts work fine. From the workstation, 'ping app.corp.local' returns 'Name or service not known', but 'ping 10.20.5.42' (the server's IP) succeeds. Running 'dig app.corp.local' against the configured DNS server returns NXDOMAIN. Other administrators confirm the DNS record exists and resolves correctly from their machines. What is the MOST likely cause on this workstation?

A server that hosts an internal application suddenly loses network connectivity. From the local console, you run 'ip addr show eth0' and see the interface listed with 'state DOWN' and no carrier. The interface has a valid static IP configuration in its NetworkManager profile, and 'systemctl status NetworkManager' shows the service is active. Which command output would BEST confirm whether the physical link between the NIC and the switch is the root cause?

Users report that a web application on a Linux server can no longer write files, and application logs show 'Read-only file system' errors. The affected data resides on /dev/sdb1 mounted at /var/www/data. The kernel remounted the filesystem read-only after detecting errors. After confirming the underlying disk is healthy with SMART data, what is the correct sequence to restore normal read-write operation?