LPIC-1 101-500 cheat sheet

Boot sequence: firmware (BIOS/UEFI) → boot device → bootloader (GRUB 2) → kernel plus initramfs → init/systemd.

Legacy BIOS uses a 512-byte MBR with a 4-primary-partition limit and a 2 TiB disk limit; UEFI uses GPT plus a FAT32 EFI System Partition and allows 128 partitions.

Kernel modules reside in /lib/modules/$(uname -r)/; insmod loads a single file, modprobe resolves dependencies, lsmod reads /proc/modules, depmod rebuilds modules.dep.

Disable a module with a 'blacklist ' line in /etc/modprobe.d/*.conf; the same files carry 'options param=value' entries.

Runtime kernel parameters are exposed under /proc/sys and made persistent in /etc/sysctl.conf or /etc/sysctl.d/; boot parameters are visible in /proc/cmdline.

Coldplug devices exist at boot; hotplug events are handled by udev, which creates /dev nodes; udevadm info -a -n /dev/sda queries, udevadm monitor watches events.

systemd targets map to runlevels: poweroff=0, rescue=1, multi-user=3, graphical=5, reboot=6; systemctl isolate switches, systemctl get-default reports the default.

Hardware inventory commands: lspci (PCI), lsusb (USB), lscpu (CPU), with resources in /proc/interrupts, /proc/ioports, /proc/dma, /proc/cpuinfo.

dmesg or journalctl -k prints the kernel ring buffer; dmesg -T renders human-readable timestamps.

dpkg -i installs a .deb, -l lists installed packages, -L lists a package's files, -S finds the package owning a file, -r removes, -P purges including config files.

apt-get update refreshes indexes; upgrade never removes packages; dist-upgrade (apt full-upgrade) may add or remove packages; apt-get install -f repairs broken dependencies.

Debian repositories are configured in /etc/apt/sources.list and /etc/apt/sources.list.d/*.list; apt-cache search, policy, and show query the local index.

rpm -qa lists all installed packages, -ql lists files, -qf identifies a file's owner, -qi shows info, -ivh installs, -Uvh upgrades, -e erases, --test is a dry run.

yum and dnf read /etc/yum.repos.d/*.repo; SUSE uses zypper; all three resolve and install dependencies automatically unlike raw rpm or dpkg.

Shared libraries: /etc/ld.so.conf and ld.so.conf.d feed ldconfig, which regenerates /etc/ld.so.cache; ldd lists a binary's libraries; LD_LIBRARY_PATH overrides lookup at runtime.

rpm2cpio package.rpm | cpio -idmv extracts RPM contents without installing; alien converts between .deb and .rpm formats.

Naming conventions: Debian = name_version_arch.deb; RPM = name-version-release.arch.rpm; Debian package caches sit in /var/cache/apt/archives.

Streams: 0 = stdin, 1 = stdout, 2 = stderr; '2> file' redirects errors, '&> file' both, '2>&1' merges stderr into stdout, '>>' appends, '<' supplies input.

grep options: -i ignore case, -v invert match, -r recursive, -n line numbers, -c count, -E extended regex; egrep is equivalent to grep -E.

sed 's/old/new/g' substitutes globally and -i edits in place; awk '{print $1}' prints a field; cut -d: -f1 sets delimiter and selects field.

sort -n numeric, -r reverse, -k key, -u unique; uniq -c counts adjacent duplicates so input must be sorted first; tr translates or deletes characters.

find /path -name '*.conf' -type f -mtime -7 -exec cmd {} ; filters by name, type, and age; locate queries the updatedb database and can be stale.

Job control: 'cmd &' backgrounds, Ctrl-Z suspends, bg and fg resume, jobs lists; kill -9 = SIGKILL, -15 SIGTERM, -1 SIGHUP, -2 SIGINT, -19 SIGSTOP.

tar -cvf creates, -xvf extracts, -tvf lists, -z gzip, -j bzip2, -J xz; gzip, bzip2, and xz compress single files and delete the original unless -k or -c is used.

Quoting rules: single quotes preserve every character literally; double quotes still expand $VAR and $(cmd); a backslash escapes the following character.

ps aux or ps -ef snapshots processes, top is dynamic, pgrep/pkill match by name, free shows memory, uptime reports load averages for 1, 5, and 15 minutes.

Naming: /dev/sda (SATA/SCSI disk), /dev/sda1 (partition), /dev/nvme0n1p1 (NVMe), /dev/vda (virtio), /dev/sr0 (optical drive).

Block devices buffer data and transfer in blocks while character devices stream bytes; every node carries a major number (driver) and minor number (instance).

lsblk prints block devices as a tree, blkid prints UUID and filesystem type, fdisk -l or parted -l shows partition tables, partprobe re-reads the table.

dd if=source of=target bs=1M count=N conv=fsync copies raw blocks; used for disk images and MBR backups, but it prints no progress by default.

Hardware resources appear in /proc/interrupts (IRQs), /proc/ioports, and /proc/dma; lspci -v and lsusb -v describe attached PCI and USB devices.

udev rule files live in /etc/udev/rules.d/ and /lib/udev/rules.d/ with a .rules suffix; udevadm trigger re-applies rules and udevadm monitor streams events.

Terminals: /dev/tty is the current terminal and /dev/pts/N a pseudo-terminal; the tty command prints the active one; losetup binds a file to a loop device.

/proc/partitions and /sys/block expose block device details without extra tools; eject unmounts and ejects removable optical media.

/etc/fstab field order: device, mount point, filesystem type, options, dump flag (0 or 1), fsck pass (0 = skip, 1 = root, 2 = others).

mkfs.ext4 or mke2fs -t ext4 creates the filesystem; tune2fs -l shows the superblock, -c sets max mount count, -i the check interval; dumpe2fs dumps details.

ext4 is journaling; e2fsck or fsck.ext4 repairs it and must only run on an unmounted filesystem; use xfs_repair for XFS and xfs_growfs to grow it.

Mount options: ro, rw, noexec, nosuid, nodev, noatime, defaults, auto/noauto, user/nouser, _netdev; mount -a mounts everything listed in fstab.

Reference filesystems by UUID or LABEL from blkid so mounts survive device renaming, e.g. UUID=xxxx /mnt ext4 defaults 0 2.

Swap setup: mkswap /dev/sdX1, then swapon (swapoff to disable); swapon -s or free verifies it; the fstab type is 'swap' with options 'sw'.

A hard link shares the target's inode, must stay on one filesystem, and cannot point to a directory; a symlink stores a path and may dangle or cross filesystems.

df -h shows free space per filesystem, df -i shows inode usage, du -sh summarizes a directory tree, stat reports inode number, link count, and timestamps.

Quotas use quotacheck, quotaon/quotaoff, edquota, repquota; the LVM order is pvcreate → vgcreate → lvcreate, extended with lvextend then resize2fs; mdadm manages RAID.

The FHS classifies directories as shareable or unshareable and static or variable: /usr is shareable static, /var shareable variable, /etc unshareable static.

/bin, /sbin, and /lib hold essential binaries and libraries; on merged-/usr systems they are symlinks to /usr/bin, /usr/sbin, and /usr/lib.

/usr/local holds administrator-installed software that bypasses the package manager; /opt holds add-on application packages, each in its own subtree.

/var holds variable data: /var/log for logs, /var/spool for print and mail queues, /var/cache for cached data, /var/lib for persistent state, /var/tmp for temp files kept across reboots.

/tmp is world-writable and may be cleared at boot; /run (replacing /var/run) holds runtime PID and lock files; /proc and /sys are virtual kernel filesystems.

/mnt is for temporary manual mounts while /media is the standard mount point for removable media; /boot stores the kernel and bootloader files.

/srv holds data served by the system such as web or FTP content, /root is root's home directory, /home holds user home directories, /dev holds device nodes.