LPIC-2 201-450 cheat sheet

Load average is the 1-, 5-, and 15-minute average count of runnable plus uninterruptible tasks; compare it with the number of logical CPUs reported by nproc.

vmstat columns: r = runnable, b = blocked, si/so = swap in/out, wa = I/O wait; sustained wa above roughly 20 percent points to a storage bottleneck.

iostat -x: %util near 100 means the block device is saturated; await is average request latency in milliseconds; r/s and w/s are request throughput.

free -m: available includes reclaimable page cache and is the figure to compare with workload demand; free counts only completely untouched RAM.

sar reads historical files under /var/log/sa/saDD; sar -u reports CPU, -r memory, -d disk, and -n DEV network; sadf -d converts data to CSV.

Capacity growth estimate: time_to_threshold = (threshold - current_usage) divided by average growth per sampling interval.

Per-process accounting: ps aux --sort=-%cpu or --sort=-%mem, top or htop for live views, and pidstat for per-process I/O statistics.

cgroup v2 limits: memory.max caps RAM, cpu.max sets quota and period, io.max caps block I/O; systemd slices expose these controls.

uname -r prints the running kernel release; loadable modules for that release reside in /lib/modules/$(uname -r).

lsmod lists loaded modules; modinfo shows parameters, aliases, license, and signature; modprobe resolves dependencies while insmod does not.

depmod regenerates modules.dep and associated maps after module files are added or removed under /lib/modules.

Configuration targets: make menuconfig (ncurses), make xconfig (Qt), make gconfig (GTK); make oldconfig reuses the existing .config.

Build sequence: make -jN, then make modules_install, then make install; the x86 kernel image is arch/x86/boot/bzImage, installed as /boot/vmlinuz-.

initramfs generators: dracut on RHEL and Fedora, mkinitrd wrapper, update-initramfs -u on Debian; lsinitrd or lsinitramfs lists archive contents.

Runtime parameters live under /proc/sys and are changed with sysctl; sysctl -w is immediate but nonpersistent, /etc/sysctl.d/*.conf persists.

Kernel messages: dmesg reads the kernel ring buffer, journalctl -k reads the kernel journal, and /var/log/kern.log receives them on rsyslog systems.

A blacklist line in /etc/modprobe.d/*.conf blocks automatic loading by alias but does not prevent an explicit modprobe of the module name.

Boot order: firmware, bootloader, kernel plus initramfs, then systemd as PID 1 or SysV init, ending at the default target or runlevel.

GRUB2 active configuration /boot/grub/grub.cfg is generated by grub-mkconfig -o from /etc/default/grub and executable scripts in /etc/grub.d.

GRUB_DEFAULT selects an entry by zero-based index, exact title, or saved; GRUB_TIMEOUT sets menu delay; GRUB_CMDLINE_LINUX adds kernel parameters.

grub-install writes the bootloader to a disk or EFI System Partition; efibootmgr lists, creates, deletes, and reorders UEFI boot entries.

systemd default target: systemctl get-default and set-default; graphical.target and multi-user.target correspond to old runlevels 5 and 3.

systemctl enable creates symlinks under /etc/systemd/system/.wants; disable removes them; mask links a unit to /dev/null.

SysV: /etc/inittab defines runlevels, telinit N changes runlevel, and chkconfig or update-rc.d manages the rc directory links.

Recovery: init=/bin/bash or rd.break starts an early shell, rescue.target gives a minimal system, and single-user mode is runlevel 1; remount root read-write before repairs.

LILO reads /etc/lilo.conf and requires running lilo after every change; SYSLINUX, EXTLINUX, and systemd-boot are alternate bootloaders.

/etc/fstab fields: device, mount point, type, options, dump, and fsck pass; UUID= or LABEL= keeps mounts stable when device names change.

mount -a mounts all fstab entries not marked noauto; findmnt displays the mount tree; mount -o remount,rw / changes options on a live mount.

Security mount options: noexec blocks execution, nosuid ignores setuid and setgid bits, nodev prevents device-node interpretation, ro mounts read-only.

ext4 checking: e2fsck -p for preen and -f to force; tune2fs -c sets maximum mounts and -i the interval; dumpe2fs prints superblock details.

XFS repair uses xfs_repair, growth uses xfs_growfs, and XFS cannot be shrunk; Btrfs uses btrfs check and btrfs filesystem resize.

Swap setup: mkswap DEVICE, swapon DEVICE, swapoff DEVICE; /proc/swaps lists active swap; an fstab entry uses type swap and option sw.

LUKS: cryptsetup luksFormat, luksOpen, luksAddKey, and luksClose; /etc/crypttab automates unlocking at boot; back up the LUKS header.

df -h reports space, df -i reports inode usage, du -sh summarizes directory consumption, and lsblk or blkid identifies devices and filesystems.

mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1 creates a mirror; /proc/mdstat shows array state and resync progress.

RAID levels: 0 stripe with no redundancy and minimum 2 devices, 1 mirror minimum 2, 5 parity minimum 3 with one failure tolerance, 6 double parity minimum 4, 10 mirror plus stripe minimum 4.

mdadm --fail, --remove, and --add replace a failed member; --grow changes level or device count; mdadm.conf preserves array assembly.

LVM stack: pvcreate, then vgcreate, then lvcreate; pvs, vgs, and lvs report metadata; vgscan and vgchange -ay activate volume groups.

Extend with lvextend -L +10G -r /dev/vg/lv; ext4 is resized by resize2fs, XFS by xfs_growfs, and the -r option invokes the correct tool.

Thin provisioning uses lvcreate --thinpool and -V for virtual size; thin snapshots use copy-on-write and require free space in the pool.

hdparm -tT measures cached and buffered read speed, hdparm -S sets drive spin-down, sdparm adjusts SCSI device parameters.

Persistent names come from udev rules in /etc/udev/rules.d and from /dev/disk/by-id, by-uuid, and by-path; udevadm info --query=all shows attributes.

ip addr add CIDR dev IF, ip link set IF up, and ip route add default via GW configure interfaces and routes; ip -6 handles IPv6, ip route show lists routes.

/etc/resolv.conf holds nameserver and search directives; /etc/hosts provides static name mappings; /etc/nsswitch.conf sets the hosts lookup order.

hostnamectl set-hostname sets the static hostname; /etc/hostname persists it; /etc/hosts should map that name to 127.0.1.1 or the LAN address.

NetworkManager: nmcli connection add type ethernet ifname eth0 con-name eth0, then nmcli connection up eth0; nmtui is the text interface.

systemd-networkd reads /etc/systemd/network/*.network and *.link files; networkctl status and networkctl list show link state.

Debian ifupdown uses /etc/network/interfaces; RHEL legacy uses /etc/sysconfig/network-scripts/ifcfg-*; ifup and ifdown apply those configurations.

Diagnostics: ss -tulpn, ping, traceroute, mtr, tcpdump -i IF, and dig or host for DNS; ip -s link reports interface errors and drops.

Forwarding: sysctl -w net.ipv4.ip_forward=1 enables IPv4 forwarding immediately; persist it under /etc/sysctl.d; NAT also requires firewall rules.

Source build: ./configure --prefix=/usr/local, make, make install; DESTDIR redirects installation into a staging root, and checkinstall creates a package.

Shared libraries: ldconfig rebuilds the cache from /etc/ld.so.conf and /etc/ld.so.conf.d; LD_LIBRARY_PATH overrides the search path at runtime.

tar backups: tar -czf archive.tar.gz -C /path dir, with --exclude patterns, -p to preserve permissions, and -t to list archive contents.

rsync -aAX --delete SRC DEST preserves permissions, ACLs, and extended attributes and mirrors deletions; --dry-run previews the transfer.

Backup types: full copies everything, incremental copies changes since the last backup of any type, differential copies changes since the last full backup.

cron: /etc/crontab and files in /etc/cron.d include a user field; user crontabs are edited with crontab -e; anacron runs missed jobs after downtime.

logrotate configuration lives in /etc/logrotate.conf and /etc/logrotate.d; directives include daily, rotate N, compress, missingok, and postrotate.

User notices: wall broadcasts to all terminals, write targets one user, mesg y or mesg n controls reception; /etc/motd appears after login and /etc/issue before login.