Linux and Networking Interview - Onsite

What is the functional difference between a Linux system call and a Linux signal?

System call: a synchronous request from user-space moving up into the kernel to access restricted hardware (e.g., open(), read()). Signal: an asynchronous notification moving down from the kernel or OS to interrupt or terminate a process (e.g., SIGTERM, SIGKILL).

How does a heavy fork() call impact a process utilizing massive pools of RAM under high write loads?

It forces the kernel to duplicate page tracking tables. If the parent process continues writing to memory at a high rate, the kernel must duplicate those 4KB pages rapidly via Copy-on-Write (COW), triggering page faults, doubling memory usage, and risk an OOM panic.

What happens to a process during the execve() system call phase?

The kernel completely clears the calling process's virtual address space, heap, stack, and data segments, overwriting them entirely with the machine code of a new binary while preserving the original PID.

What is the structural purpose of a Linux cgroup (Control Group) versus a Linux Namespace?

Namespaces isolate what a process can *see* (e.g., separating PIDs, network interfaces, mount points); cgroups restrict and enforce how much a process can *consume* (e.g., capping maximum CPU allocation, memory limits, storage IOPS).

What is a zombie process, and how is it structurally cleaned up at the system layer?

A terminated process whose memory has been freed but whose entry remains in the kernel process table because the parent hasn't reaped it via wait(). You must kill or signal its parent process, forcing the zombie to be adopted by PID 1 (init) which automatically reaps it.

What triggers a CPU context switch, and why does excessive switching degrade cluster performance?

Triggers when the OS scheduler replaces a running process with another. It hurts performance because saving/loading registers and switching namespaces forces CPU instruction pipelines to flush and invalidates processor L1/L2/L3 caches (Cache Thrashing).

What does a high "Load Average" in Linux signify if CPU utilization is low?

It indicates that threads are not bottlenecked by processor execution power, but are instead queued up in an Uninterruptible Sleep (D) state waiting for blocked or saturated disk storage I/O operations.

What is the difference between memory fragmentation and running out of memory (OOM)?

Fragmentation means total free RAM is sufficient, but it is broken into tiny, non-contiguous blocks, causing allocations for large sequential blocks to fail. OOM means the total exhaustion of physical memory frames.

What information does /proc/buddyinfo provide to an SRE?

It exposes the kernel's internal page allocator state, showing the count of available contiguous memory blocks broken down by size orders (4KB, 8KB, 16KB... up to 4MB blocks) to diagnose memory fragmentation.

Explain how the Linux kernel calculates the oom_score for a process when memory is exhausted.

The kernel evaluates the percentage of raw physical RAM the process is consuming, combines it with the process's oom_score_adj priority weight configured in /proc, and terminates the process with the highest resulting score.

How do you safely secure a critical database process from being targeted by the Linux kernel's OOM Killer?

You write a negative priority offset value (down to -1000) directly into the process's /proc/PID/oom_score_adj system file to explicitly instruct the kernel to bypass that process during an out-of-memory crunch.

What is the purpose of vm.swappiness, and how does setting it to 1 impact a database server?

It tunes the kernel's aggressiveness in swapping anonymous memory to disk versus reclaiming Page Cache; setting it to 1 tells the kernel to aggressively keep database memory in RAM and avoid slow disk thrashing.

What is the purpose of the Linux cache pressure knob (vm.vfs_cache_pressure)?

It controls the kernel's tendency to reclaim memory used for caching directory entries and inodes (dentries/inodes) versus standard file Page Cache; low values preserve filesystem metadata in RAM, accelerating frequent directory scans.

What are "Huge Pages" (or Transparent Huge Pages), and why do database administrators often disable them?

Enlarged memory blocks (2MB or 1GB) designed to decrease translation table sizes. Transparent Huge Pages (THP) are disabled for databases because dynamic runtime allocation introduces severe locking delays and memory contention during sparse, random database I/O workloads. "We disable THP because it introduces background memory locks that freeze active database threads during memory cleanup, and it wastes system bandwidth by moving large 2MB pages when the database only requested a few kilobytes of data."

What is an inode, and what information does it store about a file?

An index node that stores file metadata (size, owner, permissions, timestamps, data block pointers). It does NOT store the file path or name (which are stored separately in directory files).

What happens to a physical file block on disk if a file is unlinked via "rm" while a database engine is actively reading it?

The filename mapping is unlinked from the directory immediately (link count decrements via unlink()), but the kernel protects the raw data blocks and preserves the allocated disk space until the database process explicitly closes its active file descriptor or terminates.

Explain why database engines use Direct I/O (O_DIRECT) instead of relying on standard Linux Buffered I/O.

Buffered I/O copies data from application memory into the kernel Page Cache; O_DIRECT completely bypasses this kernel layer to execute direct storage writes, eliminating data copying CPU overhead and cache duplication.

What is the role of the Linux Page Cache, and how does it utilize free RAM?

It caches disk blocks in unallocated physical RAM to make file read and write operations run at memory speeds instead of slow storage disk speeds. Linux uses almost all free RAM for this, yielding it instantly if apps request memory.

How does the mmap() system call work, and why do some database engines prefer it over standard read()/write() calls?

It maps file contents directly into an application's virtual memory address space, allowing the app to access data via raw pointers and avoiding the CPU performance overhead of copying data between kernel space and user space.

What does the "dirty pages" metric mean, and what do the dirty_background_ratio and dirty_ratio parameters control?

Dirty pages are data blocks in the Page Cache modified by an application but not yet written to disk. dirty_background_ratio defines the RAM % where kernel background threads start flushing data asynchronously; dirty_ratio is the hard limit where writing apps stall to write directly to disk.

Why do databases frequently issue the fsync() system call? What does it guarantee?

It forces the operating system to immediately flush modified data from volatile kernel caches (RAM) onto the underlying physical, non-volatile storage media, guaranteeing durability against power loss.

Why is random I/O significantly more expensive than sequential I/O on traditional hard drives, and how does this change on NVMe SSDs?

Traditional HDDs require physical mechanical head movement and platter rotation to find sectors; NVMe SSDs use flash with zero moving parts, making random I/O significantly faster (though sequential remains slightly faster due to controller design and read-ahead tuning).

What is the block size of a filesystem versus the sector size of a physical disk?

Sector size is the absolute minimum hardware read/write physical unit of the storage drive (e.g., 512B or 4KB); block size is the logical abstraction chunk size managed by the filesystem software (typically 4KB in Linux).

Why does a process drop into an Uninterruptible Sleep (D) state, and what is its operational risk?

The process is blocked waiting directly on synchronous hardware I/O (like a disk read or network filesystem response); while in this state, it ignores all kernel signals and cannot be terminated by kill -9.

What is the purpose of the Linux Virtual Filesystem (VFS) layer under the hood?

It provides a uniform, abstract kernel interface defining standard operations (open, read, write) so that applications can interact with entirely different filesystems (EXT4, XFS, NFS) using identical system calls.

What happens inside the Linux kernel network stack when a physical network interface card (NIC) receives a packet?

The NIC copies the packet into a kernel memory ring buffer (RX Ring Buffer) via Direct Memory Access (DMA) and triggers a hard interrupt (IRQ) to inform the CPU that data has arrived.

What is the role of NAPI (New API) in modern Linux network drivers?

It prevents a high-throughput network link from crashing the CPU via an "interrupt storm" by converting hard CPU interrupts into a high-speed polling mechanism (softirqs) when packet arrival rates cross a specific threshold.

What does a high value in the "dropped" column of /proc/net/dev signify?

It proves that the kernel's network ring buffers (netdev_max_backlog) are completely full because the CPU is not processing incoming network packets fast enough, forcing the network driver to drop packets at the hardware layer.

What is the difference between net.core.rmem_max and net.ipv4.tcp_rmem?

rmem_max dictates the absolute maximum memory allocation limit for *any* network socket buffer, while tcp_rmem defines the min, default, and max memory allocation thresholds specifically tuned for individual TCP sockets.

What is Direct Server Return (DSR) in load balancing?

A network routing architecture where the load balancer only handles incoming requests; it forwards packets to backend servers without altering the source IP, allowing backends to reply directly to the client and bypassing the balancer's egress bottleneck.

Walk through the steps and flags used in the TCP 3-way handshake.

The client sends a SYN packet containing its Initial Sequence Number (ISN); the server responds with a SYN-ACK packet acknowledging the client's sequence and sending its own ISN; the client finishes with an ACK packet to establish sequence numbers and allocate kernel socket buffers.