CTLA key terms

A filesystem data structure that stores a file's metadata, including ownership, permissions, timestamps, and pointers to data blocks, but not the filename itself. Running out of inodes prevents new files from being created even when disk space remains.

An additional directory entry pointing to the same inode as an existing file. All links share content and metadata, deleting one does not remove the data while other links remain, and links cannot span filesystems.

A special file containing a path to another file or directory, resolved at access time. It can cross filesystems and point to nonexistent targets, producing a broken link.

A directory where a filesystem is attached into the single unified directory tree. Accessing paths beneath it reaches the mounted filesystem rather than the underlying directory contents.

The configuration file listing filesystems to mount at boot, with device identifiers, mount points, filesystem types, options, and dump and fsck order fields. Errors here can prevent a system from booting cleanly.

A unique identifier assigned when a filesystem is created. Referencing devices by UUID in configuration files is preferred over kernel device names, which can change when hardware is added or reordered.

A command that reports block device attributes such as filesystem type, label, and UUID by reading superblock information. Administrators use its output to build reliable fstab entries.

A technique where metadata changes are written to a log before being applied, so an interrupted write can be replayed or rolled back. It greatly reduces corruption and fsck time after an unclean shutdown.

Two disk-usage tools: df reports free and used space per mounted filesystem, while du sums space consumed by files under a path. Comparing them often reveals deleted-but-open files or hidden mounts.

A storage abstraction built on physical volumes grouped into a volume group, from which flexible logical volumes are carved. It allows resizing and spanning disks without repartitioning.

A point-in-time copy of a volume or filesystem that captures consistent data while the system keeps running. It is typically fast to create but must be copied elsewhere to serve as a real backup.

A backup exists to restore data after loss and is refreshed regularly, while an archive preserves records for long-term retention and is rarely modified. Confusing the two leads to untested or unretained data.

A scheduled exercise that recovers data from backups into a separate location and verifies its integrity and usability. Untested backups are assumed worthless because failures are usually discovered only during a real incident.

A file synchronization tool that transfers only differences between source and destination, optionally preserving permissions, ownership, and timestamps. Its trailing-slash semantics and --delete option are common sources of mistakes.

A configuration file describing a resource systemd manages, such as a service, timer, mount, or socket. Units declare dependencies and start conditions, replacing much of traditional init script logic.

The primary command for controlling systemd: starting, stopping, enabling, and inspecting units. Its status output summarizes unit state, recent log lines, and the main process identifier.

A command for querying the systemd journal, the binary log of system messages. It supports filtering by unit, boot, priority, and time, and can follow output live with -f.

A letter code in process listings describing what a process is doing, such as running, sleeping, stopped, or zombie. A zombie has exited but its parent has not yet collected the exit status.

A software interrupt delivered to a process, such as SIGTERM requesting termination or SIGKILL forcing it. SIGKILL cannot be caught or ignored, so it should follow a graceful attempt, not replace it.

Commands that adjust process scheduling priority. nice launches a process with a given niceness, and renice changes the niceness of a running process; higher values mean lower CPU priority.

Utilities for inspecting processes. ps prints a snapshot with selectable columns, while top refreshes a live view of CPU and memory consumers, useful for spotting runaway or resource-hungry processes.

A command listing open files, including regular files, sockets, and devices, along with the owning process. It is essential for finding what holds a deleted file's space or which process owns a port.

A chain of commands where the standard output of one becomes the standard input of the next. Pipelines let small tools cooperate, and their exit status usually reflects the final command unless pipefail is set.

Shell syntax that reroutes standard input, output, or error to files or other descriptors, such as >, >>, 2>&1, and <. It controls where command output and error messages actually go.

A numeric value a command returns to its parent, where zero conventionally means success and nonzero indicates failure. Scripts branch on it, and it is exposed as the special variable $?.

Shell options that make scripts fail fast: -e aborts on an unchecked failing command, and -u aborts when an unset variable is referenced. They expose errors early but can surprise in conditionals.

The use of single quotes, double quotes, and backslashes to control how the shell expands variables, globs, and word splitting. Unquoted variables are a leading cause of broken filenames and injection bugs.

A time-based scheduler and the file format that defines jobs by minute, hour, day, month, and weekday. Jobs run with a minimal environment, so paths and variables often must be set explicitly.

A text search tool paired with a pattern language for matching strings. Variants such as extended mode and fixed-string mode change which metacharacters are interpreted, affecting match results.

Stream-processing tools: sed edits text with scripted substitutions and deletions, while awk splits records into fields for pattern-action processing. Both are staples of log parsing and report generation.

A mechanism for running specific commands as another user, usually root, according to a policy file. Granting only needed commands limits the damage a compromised account or mistaken script can cause.

The read, write, and execute bits for owner, group, and others, plus a mask that removes default bits from newly created files. Together they determine who may access a file and how permissive new files are.

Special permission bits that make an executable run with the file owner's or group's identity rather than the caller's. They are powerful and a frequent target for privilege-escalation auditing.

A login method where a client proves possession of a private key matching an authorized public key on the server. It resists password guessing and is usually hardened by disabling password login.

A filter that permits or denies network traffic according to rules about addresses, ports, and protocols. Host-based firewalls complement network ones by restricting exposure per machine.

A network endpoint bound to an address and port, waiting to accept incoming connections. Enumerating listening sockets shows which services are reachable and is a basic exposure check.

A division of an IP network into smaller ranges, expressed as an address plus a prefix length such as /24. The prefix fixes the network and broadcast boundaries and the number of usable hosts.

The router address a host sends traffic to when no more specific route matches. A wrong or missing gateway leaves local traffic working while all remote connectivity fails.

The kernel's list of destination networks with the interfaces and next hops used to reach them. Longest-prefix matching decides which entry wins for a given destination address.

Translating hostnames into IP addresses through resolver configuration in /etc/resolv.conf and the nsswitch ordering. Failures here look like general network outages because names stop resolving.

A hypervisor runs guest operating systems on emulated hardware, isolating them from each other and from the host. Type 1 runs on bare metal, while Type 2 runs atop a host OS.

An isolated process environment sharing the host kernel, built from kernel namespaces and control groups. Containers start quickly and package dependencies but offer weaker isolation than virtual machines.

A virtual server provisioned on demand in a cloud provider's environment, typically billed by usage. Its lifecycle, networking, and storage are managed through provider interfaces rather than physical hardware.

A disciplined sequence: define the symptom, gather evidence, form a testable hypothesis, change one thing, and verify. It prevents random changes that obscure the original fault.

The practice of recording, reviewing, and scheduling modifications to production systems, with a rollback plan. It reduces outages caused by untracked edits and makes later diagnosis far easier.