I85PREP
⌘ K
CTLA study materials
CTLA study resources

CTLA: Storage, Filesystems, and Backup

CTLA · Work through your exam, one topic at a time.

All guide sections

Storage, Filesystems, and Backup

This domain tests the storage stack from block device to mounted filesystem, plus the backup habits that protect it. Expect questions on partitioning and LVM, /etc/fstab correctness, the difference between df and du, and why a snapshot is not automatically a backup.

Block devices and partitioning

lsblk shows the tree, blkid shows UUIDs and types, parted/fdisk manage tables. MBR is limited to four primary partitions and 2 TiB; GPT is the modern default. Prefer UUID or LABEL= in /etc/fstab over /dev/sdX, which can reorder across boots.

LVM

Physical volumes (pvcreate) aggregate into volume groups (vgcreate), which are carved into logical volumes (lvcreate -L 10G -n data vg0). Growth is online: lvextend -r -L +5G /dev/vg0/data resizes both the LV and the filesystem. Snapshots are copy-on-write and consume space as the origin changes.

Filesystems

mkfs.ext4 / mkfs.xfs; know that ext4 can shrink offline while XFS cannot shrink at all - a classic exam discriminator. Check with fsck (unmounted) or xfs_repair. Ext4 reserves 5% of blocks for root by default; tune2fs -m adjusts it.

Mounting and fstab

Entries take the form UUID=... /mount ext4 defaults,nofail 0 2. Test with mount -a before rebooting: a bad fstab entry can drop the system into an emergency shell. Options worth knowing: noatime, ro, nofail, x-systemd.automount.

Capacity triage

df -h reports filesystem-level usage; du -sh sums file sizes. df -i reports inode exhaustion, which produces "no space left on device" while bytes remain free. Backup tools: rsync -a, tar, dd for images; verify restores, not just backups.

Worked example

df -h shows /var at 100% while du -sh /var accounts for only 4 GB of 50 GB. Reasoning: the space is held by files that were deleted but are still open by a running process. lsof +L1 (or inspecting /proc/*/fd) lists them. Restarting or reloading the owning process - commonly a logging daemon - releases the blocks. Do not extend the volume before confirming the cause, and note the same symptom appears with inode exhaustion, which df -i distinguishes.

Traps

  • rsync src/ dst versus rsync src dst - the trailing slash changes whether the directory itself is copied.
  • Assuming XFS can be shrunk.
  • Editing fstab and rebooting without mount -a.
  • Treating a volume snapshot as an application-consistent backup.
  • Confusing df (filesystem) with du (directory contents).