Linux & Shell Interview Questions for Developers: 50 Q&A

Most production code at Indian product companies runs on Linux, whether on EC2, Kubernetes nodes or containers, and the first thing an on-call engineer does is open a shell. That is why Linux questions show up in backend, SRE and DevOps interviews, and increasingly in SDE-1 rounds as "how would you find out..." follow-ups. This guide covers 50 questions with precise answers and commands, and every log-processing one-liner was run against the sample log shown below.

Operating-system theory (scheduling, paging, deadlocks) is covered in our operating system interview questions. This guide is the practical, at-the-terminal companion.

Why Linux Questions Decide Backend and DevOps Interviews

Interviewers use Linux questions as a proxy for one thing: can this person investigate a problem on their own? A candidate who answers "I would check the logs" is fine. A candidate who says "I would run journalctl -u orders --since '10 min ago', then grep for the request ID across pods" gets hired. Specific commands, in a sensible order, beat vague descriptions every time.

Linux Process and Signal Interview Questions (Q1-10)

Q1. What is a process vs a thread in Linux?

A process has its own virtual address space, file descriptor table and PID. Threads within a process share the address space and file descriptors but have their own stacks and registers. On Linux both are created with clone() with different sharing flags; the kernel schedules threads as "tasks". ps -eLf or top -H shows threads.

Q2. How do you list and inspect processes?

ps aux                              # all processes: user, PID, %CPU, %MEM, command
ps -ef --forest                     # with parent/child tree
ps -o pid,ppid,stat,etime,rss,cmd -p 4242   # specific fields for one PID
pgrep -af java                      # PIDs + command lines matching "java"
top / htop                          # live view; press 1 for per-CPU, P/M to sort
ls -l /proc/4242/fd | wc -l         # how many file descriptors it holds
cat /proc/4242/status               # memory, threads, state

Q3. What do process states R, S, D, Z, T mean?

R running or runnable; S interruptible sleep (waiting for an event, the normal idle state); D uninterruptible sleep, usually blocked in disk or NFS I/O, cannot be killed until it returns; Z zombie; T stopped (Ctrl+Z or SIGSTOP). Many D-state processes are a strong hint of storage trouble.

Q4. SIGTERM vs SIGKILL vs SIGINT vs SIGHUP?

Use kill PID (SIGTERM) first, wait, and only then kill -9. Going straight to -9 skips flushing buffers, releasing locks and closing DB connections cleanly.

Q5. Zombie vs orphan process?

A zombie has exited but its parent has not called wait(), so its process table entry lingers (state Z). You cannot kill it; it is already dead. Fix the parent or kill it so the zombie is re-parented and reaped. An orphan is a still-running process whose parent died; it is adopted by PID 1 (or a subreaper), which reaps it when it exits. Zombies accumulating in containers is why you run an init like tini as PID 1.

Q6. How do you run a process that survives logout?

nohup ./job.sh > job.log 2>&1 & ignores SIGHUP and backgrounds it. disown removes a running job from the shell's job table. tmux/screen keep a whole session alive. For anything permanent, write a systemd service so it restarts on failure and logs to the journal.

Q7. What is a systemd unit? Show a minimal service.

[Unit]
Description=Orders API
After=network-online.target

[Service]
User=orders
WorkingDirectory=/opt/orders
ExecStart=/usr/bin/java -jar /opt/orders/app.jar
Restart=on-failure
RestartSec=5
Environment=SPRING_PROFILES_ACTIVE=prod
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now orders
systemctl status orders
journalctl -u orders -f --since "10 min ago"

Q8. What are nice and renice?

Niceness ranges from -20 (highest priority) to 19 (lowest); default 0. nice -n 10 ./backup.sh starts a low-priority job; renice 10 -p PID changes a running one. Only root can lower niceness. For I/O priority, ionice -c3 makes a job idle-class for disk.

Q9. What is the difference between &, jobs, fg, bg?

cmd & runs in the background. jobs lists the shell's jobs. Ctrl+Z stops the foreground job; bg %1 resumes it in the background; fg %1 brings it to the foreground. These are shell features, not kernel ones.

Q10. How do you find which process is using a port or a file?

ss -ltnp | grep :8080          # listening TCP sockets with owning process
lsof -i :8080                  # same via lsof
lsof /var/log/app.log          # who has this file open
fuser -v /mnt/data             # who is using this mount (why umount fails)

File Permissions and File System Questions (Q11-19)

Q11. Explain -rwxr-x--- and chmod numeric modes.

The first character is the type (- file, d directory, l symlink). Then three triplets for owner, group, others; r = 4, w = 2, x = 1. rwx = 7, r-x = 5, --- = 0, so this file is 750.

Q12. What do r, w, x mean on a directory?

r lists names; w creates, deletes and renames entries (so you can delete a file you cannot write, if you can write its directory); x lets you enter the directory and access entries by name. A directory with x but not r lets you open known filenames without listing them.

Q13. What is umask?

A mask of permission bits removed from new files and directories. New files start from 666 and directories from 777; with the common umask 022, files become 644 and directories 755. A umask of 077 makes new files private (600).

Q14. What are setuid, setgid and the sticky bit?

setuid (4xxx) on an executable runs it with the file owner's privileges: /usr/bin/passwd is setuid root so users can update their own password entry. setgid (2xxx) on a directory makes new files inherit the directory's group, handy for shared team folders. The sticky bit (1xxx) on a directory means only a file's owner can delete it, which is why everyone can write to /tmp (mode 1777) but cannot delete each other's files.

Q15. Hard link vs symbolic link?

A hard link is another directory entry pointing to the same inode: same data, same permissions, and the data survives until the last link is removed. It cannot span file systems or (normally) point to directories. A symlink is a small file containing a path; it can cross file systems and point to directories, but breaks if the target moves. ln -s /opt/app-1.4.2 /opt/app plus switching the link is a classic zero-downtime release trick.

Q16. What is an inode?

The on-disk structure holding a file's metadata: owner, permissions, size, timestamps, link count and pointers to data blocks. It does not store the filename; names live in directories. File systems have a fixed number of inodes, so millions of tiny files can exhaust inodes while df -h still shows free space; df -i reveals it.

Q17. Explain the key directories of the Linux file system.

/etc configuration; /var/log logs; /var/lib service state (databases, Docker); /tmp temporary files; /home users; /opt third-party apps; /usr/bin user programs; /proc and /sys virtual file systems exposing kernel and process information; /dev device files.

Q18. How do you find large files and directories?

df -h                                    # free space per file system
df -i                                    # inode usage
du -sh /var/* 2>/dev/null | sort -rh | head      # biggest directories under /var
find / -xdev -type f -size +500M -exec ls -lh {} + 2>/dev/null   # files over 500 MB
find /var/log -name "*.log" -mtime +7 -delete    # delete logs older than 7 days

Q19. How do you change ownership recursively, and when is that dangerous?

chown -R app:app /opt/app. Dangerous when run on the wrong path (a stray space in /opt/app /) or when it follows symlinks into system directories. Double-check the path, and prefer setting the correct ownership at deploy time over fixing it after.

grep, awk and sed Interview Questions with Real Log Examples (Q20-28)

All examples use this Nginx-style access log, where the last field is response time in seconds:

203.0.113.7 - - [10/Oct/2026:10:00:01 +0530] "GET /api/orders HTTP/1.1" 200 512 0.041
198.51.100.2 - - [10/Oct/2026:10:00:02 +0530] "POST /api/payments HTTP/1.1" 500 87 1.950
203.0.113.7 - - [10/Oct/2026:10:00:03 +0530] "GET /api/orders/42 HTTP/1.1" 404 33 0.012
192.0.2.10 - - [10/Oct/2026:10:00:04 +0530] "POST /api/payments HTTP/1.1" 200 140 0.820
203.0.113.7 - - [10/Oct/2026:10:00:05 +0530] "GET /api/orders HTTP/1.1" 502 0 3.010

With default whitespace splitting, awk sees $1 = IP, $7 = path, $9 = status, $NF = latency.

Q20. Find the top IP addresses by request count.

awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -3
#       3 203.0.113.7
#       1 198.51.100.2
#       1 192.0.2.10

Explain the pipeline: uniq -c only counts adjacent duplicates, which is why sort must come first. This single question is asked more than any other Linux text-processing question.

Q21. Show all 5xx responses with their paths.

awk '$9 >= 500 {print $7, $9}' access.log
# /api/payments 500
# /api/orders 502

Q22. Count 5xx errors per endpoint.

awk '$9 ~ /^5/ {count[$7]++} END {for (p in count) print count[p], p}' access.log | sort -rn

awk associative arrays are the tool for any "group by" question. Iteration order of for (p in count) is unspecified, hence the final sort.

Q23. Compute average latency and count slow requests.

awk '{sum += $NF; n++} END {printf "%.3f\n", sum/n}' access.log    # 1.167
awk '$NF > 1.0' access.log | wc -l                                  # 2

A good follow-up comment: averages hide tail latency. For a p99, sort the latency column and pick the value at the 99th percentile position, or better, use your metrics system.

Q24. grep options you should know.

grep -i "timeout" app.log            # case-insensitive
grep -v "healthcheck" access.log     # invert: exclude lines
grep -c '" 5[0-9][0-9] ' access.log  # count matching lines (2)
grep -n "ERROR" app.log              # with line numbers
grep -rn "PAYMENT_KEY" src/          # recursive search in code
grep -E "ERROR|FATAL" app.log        # extended regex alternation
grep -oE '"(GET|POST) [^ ]+' access.log | sort | uniq -c   # only the matched part
grep -A 5 -B 2 "NullPointerException" app.log   # context: 2 before, 5 after
zgrep "orderId=981" app.log.*.gz     # search rotated, gzipped logs

Q25. sed for substitution and in-place edits.

sed 's/foo/bar/' file              # first match per line
sed 's/foo/bar/g' file             # all matches
sed -i.bak 's/DEBUG/INFO/g' app.conf   # edit in place, keep a backup
sed -n '100,120p' big.log          # print only lines 100-120
sed '/^#/d; /^$/d' app.conf        # strip comments and blank lines
sed -E 's/([0-9]+\.){3}[0-9]+/x.x.x.x/' access.log   # mask IPs before sharing logs

Note: sed -i syntax differs between GNU (Linux) and BSD (macOS needs sed -i ''). Saying so shows real use.

Q26. cut, sort, uniq, wc, tr, head, tail: quick uses.

cut -d',' -f2,5 users.csv            # columns 2 and 5 of a CSV
sort -t',' -k3 -n users.csv          # sort by 3rd column numerically
sort -u emails.txt                   # sort + dedupe
wc -l access.log                     # line count
tr 'a-z' 'A-Z' < names.txt           # uppercase
tail -f app.log | grep --line-buffered ERROR   # live-filter a growing log
tail -n 1000 app.log | less          # last 1000 lines, scrollable

Q27. What does xargs do, and why use -0?

xargs turns lines of input into arguments for a command, batching them to avoid "argument list too long". Filenames with spaces break naive pipelines, so pair find -print0 with xargs -0:

find . -name "*.tmp" -print0 | xargs -0 rm -f
grep -rl "oldApiHost" src/ | xargs sed -i 's/oldApiHost/newApiHost/g'
cat hosts.txt | xargs -P 8 -I{} ssh {} uptime     # 8 in parallel

Q28. Count requests per minute from the log.

awk '{split($4, t, ":"); print t[2] ":" t[3]}' access.log | uniq -c
#       5 10:00

Splitting the timestamp field on : gives hour and minute. Since logs are already time-ordered, uniq -c works without sorting. This is how you spot a traffic spike at 2 a.m. without a dashboard.

Shell Scripting Interview Questions (Q29-35)

Q29. What does set -euo pipefail do?

-e exits on any failing command; -u errors on unset variables (so rm -rf "$DIR/" with an empty DIR does not become rm -rf /); -o pipefail makes a pipeline fail if any stage fails, not just the last. Put it at the top of every non-trivial script, and know its gotchas: -e is ignored inside if conditions and in commands joined with &&/||.

Q30. Write a safe deployment helper script.

#!/usr/bin/env bash
set -euo pipefail

APP_DIR="/opt/orders"
RELEASE="${1:?usage: deploy.sh <version>}"     # fail with message if missing
TARGET="$APP_DIR/releases/$RELEASE"

log() { printf '%s %s\n' "$(date -Is)" "$*"; }

[[ -d "$TARGET" ]] || { log "release $RELEASE not found"; exit 1; }

log "switching to $RELEASE"
ln -sfn "$TARGET" "$APP_DIR/current"              # atomic-ish symlink swap
sudo systemctl restart orders

for i in {1..10}; do
  if curl -fsS http://localhost:8080/health >/dev/null; then
    log "healthy after $i checks"; exit 0
  fi
  sleep 3
done

log "health check failed, check: journalctl -u orders -n 100"
exit 1

Talking points: ${1:?} for required arguments, quoting every expansion, [[ ]] in Bash, curl -f to fail on HTTP errors, a bounded retry loop, and a non-zero exit code so CI notices failure.

Q31. Why should you quote variables?

Unquoted $file undergoes word splitting and glob expansion: a filename my report.pdf becomes two arguments, and * expands to every file in the directory. Write "$file", and "$@" to pass arguments through intact.

Q32. $@ vs $*, $?, $$, $!, $#?

"$@" expands to each argument as a separate word (what you almost always want); "$*" joins them into one string. $? is the last command's exit status (0 means success); $$ the script's PID; $! the PID of the last background job; $# the argument count; $0 the script name.

Q33. Explain stdin, stdout, stderr and redirection order.

cmd > out.log 2>&1     # both to file: stdout to file first, then stderr to "where stdout points"
cmd 2>&1 > out.log     # stderr to terminal! (2 copied stdout's target before it moved)
cmd &> out.log         # Bash shorthand for both
cmd 2>/dev/null        # discard errors
cmd | tee -a run.log   # show and append to a file

Redirections are processed left to right, and 2>&1 copies the target of fd 1 at that moment. This is a favourite trick question.

Q34. How do you schedule jobs? Explain a cron expression.

# ┌ min ┌ hour ┌ day-of-month ┌ month ┌ day-of-week
  30    2      *              *       *     /opt/scripts/backup.sh >> /var/log/backup.log 2>&1
  */5   *      *              *       1-5   /opt/scripts/poll.sh    # every 5 min, Mon-Fri

Cron gotchas: a minimal PATH and environment (use absolute paths), no output unless redirected, and overlapping runs if a job takes longer than its interval (guard with flock -n /tmp/backup.lock). systemd timers are a modern alternative with logging built in.

Q35. Single vs double quotes, and command substitution?

Single quotes are fully literal. Double quotes allow $var, $(cmd) and backslash escapes but prevent word splitting. Use $(cmd) over backticks for command substitution; it nests cleanly: echo "Deployed $(git -C /opt/app rev-parse --short HEAD) at $(date)".

Linux Networking Commands Interview Questions (Q36-42)

Q36. How do you check if a service is listening and reachable?

ss -ltnp                          # what is listening locally, on which address
curl -v http://localhost:8080/health      # local check, verbose headers
nc -zv db.internal 5432           # can I open a TCP connection to the DB?
curl -sv https://api.partner.com 2>&1 | grep -E "Connected|SSL|HTTP/"

A key diagnostic: if ss shows 127.0.0.1:8080, the app is bound to localhost only and unreachable from other machines or containers; it should bind 0.0.0.0.

Q37. Debug "connection refused" vs "connection timed out".

Refused: the host is reachable but nothing is listening on that port (or a firewall actively rejects): the TCP SYN got an RST back. Check the service is running and the port is right. Timed out: no response at all, usually a firewall or security group silently dropping packets, wrong routing, or the host being down. The distinction tells you whether to look at the app or the network.

Q38. How do you debug DNS issues?

dig api.example.com +short        # what does it resolve to?
dig @8.8.8.8 api.example.com      # ask a specific resolver
cat /etc/resolv.conf              # which resolvers is this host using?
getent hosts api.example.com      # resolve the way applications do (includes /etc/hosts)

getent matters because dig bypasses /etc/hosts and the system resolver configuration, so the two can disagree.

Q39. ping, traceroute and mtr?

ping tests ICMP reachability and round-trip time, but many cloud networks block ICMP, so a failed ping does not prove a host is down. traceroute shows the hop path; mtr combines both continuously and is better for spotting where packet loss starts.

Q40. What does netstat/ss show about connection states?

ss -tan state established | wc -l       # current established TCP connections
ss -tan | awk 'NR>1 {print $1}' | sort | uniq -c   # count by state

Thousands of TIME_WAIT sockets on a client usually mean it opens a new connection per request; use keep-alive or a connection pool. Many CLOSE_WAIT sockets mean your application is not closing connections the peer already closed, which is an application bug.

Q41. How do you test an HTTP API from the shell?

curl -s -X POST https://api.example.com/v1/orders \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"sku":"A12","qty":2}' | jq .

curl -o /dev/null -s -w "dns=%{time_namelookup} connect=%{time_connect} tls=%{time_appconnect} ttfb=%{time_starttransfer} total=%{time_total}\n" https://api.example.com/health

The -w timing breakdown tells you whether slowness is DNS, TCP, TLS or the server itself.

Q42. How do you copy files between servers?

scp for quick copies, rsync -avz --progress src/ host:/dst/ for anything large or repeated (only transfers differences, resumable with --partial). Note the trailing slash on src/: it copies the contents rather than the directory itself.

Debugging a Production Linux Server: Scenario Questions (Q43-50)

Q43. "The server is slow." Walk me through your first 60 seconds.

1. uptime: load averages for 1, 5, 15 minutes. Rising or falling? Compare with core count (nproc).
2. top (press 1): which process uses CPU? Look at %us (user), %sy (kernel), %wa (I/O wait), %st (stolen by the hypervisor).
3. free -m: is available memory low? Is swap in use?
4. vmstat 1 / iostat -xz 1: run queue, swapping (si/so), disk utilisation and latency (await, %util).
5. df -h and df -i: a full disk breaks everything in strange ways.
6. dmesg -T | tail: OOM kills, disk errors, network driver issues.
7. Application logs and ss -s: errors, connection counts.

This mirrors the well-known "Linux performance analysis in 60 seconds" checklist popularised by Brendan Gregg, and following a fixed order is exactly what interviewers want to hear.

Q44. High load average but CPU is mostly idle. Why?

Linux load average counts processes in uninterruptible sleep (D state) as well as runnable ones. High load with idle CPU and high %wa means processes are stuck on I/O: a slow or saturated disk, an NFS mount hanging, or heavy swapping. Check iostat -xz 1 and ps -eo state,pid,cmd | grep "^D".

Q45. free shows almost no free memory. Is that a problem?

Usually not. Linux uses spare RAM as page cache (buff/cache) and gives it back when applications need it. Look at the available column. A real problem looks like low available, swap activity in vmstat (si/so non-zero), or the OOM killer in dmesg.

Q46. A process was killed and dmesg says "Out of memory: Killed process". Explain.

The kernel ran out of memory it could reclaim and the OOM killer chose a victim by its oom_score (mostly how much memory it uses, adjustable via oom_score_adj). In containers, the cgroup memory limit triggers the same thing at the container level (Kubernetes reports OOMKilled, exit code 137). Fix the leak, right-size limits, and for JVMs ensure heap plus metaspace plus thread stacks fit inside the limit.

Q47. Disk is 100% full but du can't find the space.

lsof +L1                         # open files with link count 0 (deleted but held open)
lsof | grep '(deleted)'

Someone deleted a huge log file while the application still writes to it; the space is only freed when the file descriptor closes. Restart or signal the process to reopen logs, or truncate via : > /proc/PID/fd/N. Prevent with logrotate using copytruncate or apps that reopen logs on SIGHUP. Also check inodes with df -i.

Q48. "Too many open files." What do you do?

The process hit its file descriptor limit (sockets count too). Check usage with ls /proc/PID/fd | wc -l and limits with cat /proc/PID/limits. If usage keeps climbing, it is a leak (connections or files not closed). If it is legitimately high (a busy proxy), raise LimitNOFILE in the systemd unit or nofile in /etc/security/limits.conf; ulimit -n only changes the current shell.

Q49. A process is hung. How do you see what it is doing?

strace -p 4242 -f -tt -e trace=network,file   # live system calls
cat /proc/4242/wchan; cat /proc/4242/stack    # where the kernel has it blocked (root)
jstack 4242       # JVM thread dump: look for BLOCKED threads and deadlocks
py-spy dump --pid 4242   # Python stacks without restarting

A process sitting forever in a read() on a socket is waiting for a dependency that never answers: a missing timeout.

Q50. How do you find what changed when an incident starts?

Correlate timelines: journalctl --since "2026-10-10 09:50" --until "10:10", deploy history, last and /var/log/auth.log for logins, package history (/var/log/apt/history.log or dnf history), and recently modified config files (find /etc -mmin -60). Most incidents start with a change; find it and roll it back before root-causing.

A One-Week Linux Practice Routine for Developers

Frequently Asked Questions

Pranjal Jain

Ex-Microsoft SDE · IIT Kanpur · Founder of Prepflix. Helps engineers crack startup and product company interviews across India.