XK0-006 Troubleshooting Practice Question
A Linux server's /var/log partition is 100% full and rsyslogd has stopped writing logs. The administrator needs to find which directories under /var/log consume the most space without deleting anything. Which command should the administrator run?
⚠ Common exam trap
The trap here is reaching for df, which confirms the partition is full but cannot identify which subdirectory or file is consuming the space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
du -sh /var/log/* | sort -rh | head -n 10
To find what is filling a filesystem, aggregate usage per directory and sort by size. du -sh with a glob gives one line per item under /var/log, and sort -rh orders them largest first, so the top offenders are immediately visible. df only shows the filesystem total, find -delete destroys data, and recursive ls provides no aggregation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ls -laR /var/log | less
Why it's wrong here
A recursive ls lists every file with metadata but does not aggregate sizes by directory. On a busy log partition this produces an enormous, unhelpful listing that makes it difficult to identify the largest consumers. It also does not sort by size, so the administrator must manually compare numbers.
- ✓
du -sh /var/log/* | sort -rh | head -n 10
Why this is correct
This command summarizes the disk usage of each immediate item under /var/log in human-readable form, sorts them in descending order, and shows the top ten. It identifies the largest directories or files without modifying anything, which directly addresses the need to locate space consumers on the full partition.
- ✗
df -h /var/log
Why it's wrong here
df reports the overall utilization of the filesystem holding /var/log, not the breakdown within that directory. It would confirm the partition is full, which the administrator already knows, but it cannot reveal which subdirectories or files are responsible for consuming the space.
- ✗
find /var/log -type f -size +100M -delete
Why it's wrong here
This command deletes files larger than 100 MB under /var/log. Besides being destructive, which the scenario explicitly forbids, it does not provide a usage summary. It also may remove active log files still held open by rsyslogd, causing further service disruption.
Go deeper
Related to this question
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.