CCNA Troubleshooting Questions

The -x flag extends iostat output to include per-device metrics such as average wait time (await) and queue size (aqu-sz), while the interval argument 1 refreshes these statistics every second, satisfying the real-time monitoring requirement in the stem.

dmesg reads the kernel ring buffer, exposing hardware detection and driver messages logged during boot, including errors. This directly satisfies the requirement to inspect boot-time hardware faults, unlike journalctl or log files that may not capture early kernel output.

ss -tlnp lists TCP sockets in listening state with numeric ports and the owning process, and the grep filter narrows output to port 22. This satisfies the stem's constraint of identifying services listening on TCP 22, showing the sshd process bound to that port.

This locates individual files larger than 500 MB while staying on the root filesystem thanks to -xdev, then lists them with sizes. Large single files such as runaway logs or core dumps are common causes of a full root volume, and this command pinpoints them quickly for review before deletion.

The -k flag restricts journalctl output to kernel messages only, drawing from the kernel ring buffer captured by systemd-journald. This directly satisfies the requirement to isolate kernel-related entries from the current boot session, excluding user-space service and application logs.

'strace -p <pid>' attaches to the running process and traces its system calls, exposing read, write and fsync activity that drives I/O wait. This satisfies the requirement to investigate a specific suspect process rather than system-wide I/O statistics.

Booting to rescue mode ensures the root filesystem is not mounted, which is required for a safe check. fsck -n performs a read-only check and reports problems without modifying anything; if errors appear, fsck -y repairs them automatically. This order verifies corruption before committing changes.

The initramfs carries the storage drivers needed to mount the root filesystem. If it is corrupted or lacks the correct driver, the kernel cannot locate the root device, producing exactly this unknown-block(0,0) panic before init runs.

vmstat reports run-queue, blocked-process and CPU columns including wa (I/O wait), letting the technician confirm whether processes are stalled on disk. Its r and b columns distinguish CPU saturation from storage-bound waiting, directly addressing the high I/O wait symptom.

Appending 'single' boots the kernel into single-user mode, which starts a root shell without launching the full init sequence. This bypasses the failing services that caused the panic, directly satisfying the requirement to reach a root shell for recovery.

rd.break interrupts boot before the initramfs hands control to systemd, dropping into a switch_root emergency shell with the real root mounted read-only at /sysroot. This lets the administrator remount it read-write and repair the corrupt initramfs, satisfying the temporary-boot-parameter constraint.

free -h reports total, used, free, shared, buffer/cache and available memory, with the -h flag scaling values into human-readable units. That satisfies the user-friendly requirement while still exposing buffers and cache, which plain free shows only in kilobytes.

strace attaches to the process and prints each system call with arguments and return values, exposing where startup fails, such as a missing file or denied permission. It satisfies the requirement to trace system calls made by the service binary.

systemctl list-dependencies displays a tree of the specified unit's dependencies, including requires, wants, and after/before relationships. This directly shows the administrator which services the failing unit depends on and their current state, helping identify the missing dependency.

On systems using systemd, the cron daemon runs as a unit, so journalctl -u cron retrieves its log entries. Adding --since "yesterday" limits output to the relevant window. This shows whether cron attempted to start the job, any errors it logged, and whether the job was skipped. It directly addresses why the scheduled backup did not execute.

top displays a live, sorted view of processes with CPU and memory usage, defaulting to the highest CPU consumers at the top. It lets the administrator quickly identify the process name and its PID during an active incident. This directly satisfies the requirement to find the process driving CPU usage before acting on it.

mtr continuously combines ping and traceroute by repeatedly probing each hop, refreshing latency and packet-loss statistics in real time. This satisfies the requirement for ongoing monitoring of intermittent connectivity, unlike one-shot ping or traceroute, which capture only a single snapshot and would miss transient faults.

The `lsof +L1` command lists open files with a link count less than 1, which indicates files that have been unlinked (deleted) but are still held open by a process. This directly addresses the scenario where deleted files consume space. It will show the process name and PID, allowing the administrator to restart the process and free the space.

The `-i eth0` flag binds capture to the specified interface, `-w capture.pcap` writes raw packets to a file rather than printing them, and `-n` suppresses DNS and service-name resolution, satisfying the no-hostname constraint. Together these flags match every requirement in the stem.

The permission string shows the group triad as r-x, meaning group members may read and traverse but not write. Because the user is confirmed in the owning group, granting the group write bit with chmod g+w directly resolves the denial without widening access to other users. This is the minimal, targeted change that matches the observed mode and group membership.

The /proc/<PID>/status file includes the process's current resource usage fields such as VmRSS, Threads, and open file descriptor counts, along with many state details. Comparing these values against the limits in /proc/<PID>/limits helps confirm whether the process is approaching a ceiling. It provides a live snapshot of the specific process, which is exactly what is needed when investigating intermittent exhaustion of an already-running application.

The top command provides a dynamic, real-time view of running processes, typically sorted by CPU usage by default. It allows the administrator to identify processes with high CPU consumption, and it supports interactive commands to change sorting, kill processes, and more. This makes it ideal for live troubleshooting of CPU-bound issues on a server.

traceroute sends packets with incrementally increasing TTL values, causing each router along the path to return an ICMP Time Exceeded message. This reveals the hop-by-hop route packets take to the destination, exactly what the administrator needs to diagnose where connectivity fails.

strace attaches to systemctl and, with -f, follows forked child processes, while -o writes the captured system calls to /tmp/strace.log. This reveals the exact syscall returning EACCES, pinpointing the permission failure without flooding the terminal.

On a system using nftables, nft list ruleset prints every table, chain, and rule in the current ruleset, including any counter expressions attached to rules. This lets the administrator see whether an input rule is dropping the SYN packets and confirm it via the counter values, directly matching the symptom of received-but-unanswered SYNs.

strace attaches to the running process identified by PID via -p and reports each system call it makes, exposing blocking calls, file or socket waits and repeated retries. This directly targets the performance issue by revealing kernel-level activity of that process.

The server's routing table holds the default gateway entry, so 'ip route show' displays it directly, confirming whether 192.168.1.1 is configured as the default route for the 192.168.1.0/24 interface. This satisfies the requirement to verify gateway configuration rather than merely testing reachability.

Running top sorted by CPU usage immediately surfaces the processes consuming the most processor time, which is exactly what a high run-queue count with negligible I/O wait points to. It refreshes live, so the administrator can watch the offending process and confirm whether a single runaway task or many busy tasks are driving the load average far above the four-core capacity.

The ip addr command reads interface state and assigned addresses directly from the kernel, listing every interface with its UP/DOWN flag and IPv4/IPv6 addresses. It satisfies the requirement to verify which interfaces are up and their IPs.

ping -c 4 example.com sends four ICMP echo requests, testing IP-level reachability independently of HTTPS. Since curl returned nothing, this isolates whether the host responds at the network layer before investigating TLS, DNS resolution or the web service itself.

The `du -sh /*` command calculates the total disk usage of each top-level directory and displays it in human-readable format, while `sort -h` orders the results by size. This directly identifies which directories are consuming the most space, allowing the administrator to drill down further. It is the most efficient next step for locating large directories on a full filesystem.

/etc/resolv.conf lists the DNS servers (nameservers) that the system queries for hostname resolution. It is the primary configuration file for the resolver. Checking this file verifies which DNS servers are configured and if they are reachable. A missing or incorrect nameserver entry here would directly cause hostname resolution failures.

`du --inodes -s /*` summarizes inode counts for each top-level directory, and `sort -n` orders them numerically so the largest consumer appears last. This directly addresses inode exhaustion by pinpointing which directory tree holds the most inodes. Unlike disk-space tools, it counts inodes regardless of file size, making it ideal for finding directories filled with many small or empty files that exhaust the inode table.

The kernel mounts the root filesystem using drivers loaded from the initramfs. If that image is missing or corrupt, the required storage driver never loads, producing the unknown-block(0,0) panic. A missing or corrupt initramfs is therefore the likely cause.

tcpdump -i eth0 captures packets on the eth0 interface in real time. It is a standard command-line packet analyzer that allows filtering and inspection of network traffic. This directly addresses the need to capture packets for diagnosing intermittent connectivity issues. It provides detailed output that can be saved to a file for later analysis, making it a primary tool for network troubleshooting.

iotop -o displays only processes that are actively performing I/O, sorted by I/O usage. It provides real-time monitoring of disk read/write bandwidth per process, making it ideal for identifying the process causing heavy disk writes. The -o option filters out idle processes, focusing on active ones.

Successful pinging of 8.8.8.8 proves IP connectivity and routing work, isolating the fault to name resolution. An unreachable or misconfigured DNS server prevents resolving google.com to an IP address, exactly matching the symptom of numeric pings succeeding while hostname pings fail.

The `ps aux --sort=-%cpu` command lists all processes sorted by CPU usage in descending order, and piping to `head -n 5` shows the top five. This provides a snapshot of the processes with the highest CPU consumption. It is a non-interactive alternative to `top` and is useful for scripting or quick checks.

tcpdump -i eth0 host 10.0.0.1 -w capture.pcap binds capture to eth0, applies a host filter matching traffic in either direction to or from 10.0.0.1, and writes raw packets to capture.pcap for later analysis, satisfying all three requirements.

The `ss -tlnp` command uses the `-t` flag to filter only TCP sockets, `-l` to show only listening sockets, `-n` to display numeric addresses and ports without DNS resolution, and `-p` to reveal the process identifier and name. This directly replaces `netstat -tlnp` by reading socket information from the kernel’s `/proc/net/tcp` and `/proc/net/tcp6` files, satisfying the stem’s requirement to check services listening on TCP ports.

`strace -p <PID>` attaches to an already-running process via ptrace and prints each system call it makes, satisfying the requirement to trace a misbehaving process without restarting it. The `-p` flag targets the live PID directly, which is exactly what the scenario demands.

'free -h' reads /proc/meminfo and prints total, used and available RAM alongside swap usage, with the -h flag scaling values into human-readable units such as MiB and GiB. This directly satisfies the requirement for readable free memory and swap figures.

top presents a live, self-refreshing process list ordered by CPU consumption by default, also showing per-process memory usage. Its interactive display satisfies the requirement to identify the heaviest CPU and memory consumers in real time.

Successful access by IP address proves network routing and the web service function correctly, isolating the failure to name-to-address translation. DNS resolution is therefore the fault, since the client cannot map the domain to the reachable IP.

ip route queries the kernel's routing table through the modern iproute2 suite, listing destination networks, gateways and egress interfaces. It replaces the deprecated route command and satisfies the requirement to inspect current routing entries on the system.

traceroute sends packets with incrementally increasing TTL values, causing each router along the path to return an ICMP Time Exceeded message. This reveals every hop to the remote server plus the round-trip time per hop, exactly matching the diagnostic requirement.

The -I flag makes curl issue a HEAD request, returning only the HTTP response headers without the body. This directly satisfies the administrator's goal of inspecting server headers to diagnose why one site fails while others load.

mount -o remount,rw /mnt/usb remounts the filesystem at /mnt/usb with the read-write option, without unmounting. This is the standard way to change mount options on a live filesystem, assuming the underlying device supports it and there are no errors.

`arping -D` sends ARP probes in duplicate address detection mode. If another host replies, a duplicate IP is present. Specifying the interface with `-I eth0` and the target IP checks that address on the local segment. This is a direct and reliable method to detect IP conflicts because ARP operates at layer 2 and will receive a response from any host claiming the same address.

This command sequence first brings the interface `ens33` up using `ip link set ens33 up`, then assigns the IP address with `ip addr add`. This is the correct approach because the interface must be administratively up to pass traffic. The `&&` ensures the second command runs only if the first succeeds, which is good practice.

The `nslookup` utility queries DNS servers directly and returns A records mapping a hostname to its IPv4 address, satisfying the requirement to verify DNS resolution for the web server. It supports both interactive and non-interactive modes, letting the administrator specify the target hostname and confirm the resolved address.

chronyc ntpdata displays detailed NTP packet information for each configured source, including the source address, mode, stratum, and whether packets are being received. When a source shows '?', it indicates that no valid packets have been received recently. ntpdata will reveal if packets are being sent but not returned, or if there are errors, helping diagnose firewall, routing, or server issues.

Shows TCP listening sockets with process info.

The wa column in vmstat reports the percentage of CPU time spent idle while waiting for I/O completion. Persistently high wa values indicate processes blocked on storage operations, so the bottleneck lies in the disk I/O subsystem.

ip addr show displays all network interfaces and their assigned IP addresses, including subnet masks. It is the modern replacement for ifconfig and provides detailed information about interface state. In this scenario, it directly shows whether the interface has an IP, which is essential for diagnosing connectivity loss. It does not show the routing table, but it is one of the required commands.

mtr combines ping and traceroute, continuously probing each hop between the host and example.com. It reports per-hop latency, jitter and packet loss, pinpointing whether slowness arises on the local network, an intermediate router or the destination itself.

ss -tlnp lists TCP sockets in listening state with their local addresses and owning processes. If the web service shows 127.0.0.1:80 instead of 0.0.0.0:80 or the host address, it is bound only to loopback, explaining why remote clients fail while localhost succeeds.

dmesg reads the kernel ring buffer, which retains hardware detection, driver and error messages logged by the kernel. After a crash, this buffer holds the relevant hardware diagnostics, satisfying the requirement to inspect kernel-level error output.

`ps aux --sort=-%cpu` lists every process with its CPU percentage, sorted descending by that column, so the heaviest consumers appear first. This directly satisfies the stem's requirement to identify which processes are consuming the most CPU on the Linux server, giving an immediate ranked snapshot without interactive monitoring.

The ip route command queries the kernel's routing table via the iproute2 suite, listing destination networks, gateways and interfaces. It satisfies the requirement to display current routes, unlike legacy netstat -r or route, which are deprecated on modern Linux distributions.

journalctl's -u flag filters entries to the sshd unit, and -n 20 limits output to the last 20 lines, satisfying both stem constraints in one invocation. This queries the systemd journal directly, showing recent sshd startup failures without piping to another utility.

`mtr target` continuously combines ping and traceroute, refreshing hop-by-hop latency and packet-loss statistics in real time. This satisfies the stem's requirement for an ongoing test monitoring both path and loss, unlike one-shot `traceroute` or plain `ping`, which cannot show per-hop loss across the route simultaneously.

`ip addr` queries the kernel's netlink interface and lists every network interface with its assigned IPv4 and IPv6 addresses, satisfying the requirement to view all current IPv4 addresses. Unlike `ifconfig`, it is part of the modern iproute2 suite and remains available on current distributions.

The ethtool command queries and controls network driver and hardware settings. Running ethtool eth0 displays the link status, speed, duplex mode, and other low-level parameters. It directly shows whether the interface is running at full or half duplex, which is critical for diagnosing a duplex mismatch that can cause packet loss and intermittent connectivity.

ip route get performs a route lookup for a specific destination and reports which interface, source address, and gateway the kernel would actually use. This directly answers whether the new static route wins over the default gateway. Unlike listing the routing table, it shows the resolved decision, making it the right verification tool here.

`iostat -x 1` reports extended disk statistics per device, including await (average wait time in milliseconds) and %util (percentage of time the device had I/O in flight), refreshed every second. This directly satisfies the stem's requirement for both metrics, unlike `vmstat` or `top`, which omit per-device await and %util.

`ps aux --sort=-%mem` lists every process with its resident memory percentage, sorted descending, so the heaviest consumer appears first. This directly satisfies the stem's need to identify processes consuming excessive memory, letting the administrator confirm a suspected leak by watching a process's RSS climb over successive samples.

lsof lists open files, and the -p flag restricts output to the specified process ID, directly exposing the file descriptors that process holds. This satisfies the stem's constraint of listing open files tied to a specific PID, revealing leaked descriptors such as unclosed sockets or handles.

ip monitor route subscribes to kernel routing notifications and prints every route addition, deletion, or change as it happens. This directly captures the intermittent install and removal events the administrator suspects, including which prefix and gateway are affected, without polling or restarting services.

The wa column in vmstat reports the percentage of CPU time spent idle while waiting for I/O operations to complete. A persistently high value therefore indicates processes blocked on disk I/O, identifying storage as the bottleneck causing the elevated load average.

journalctl -u filters logs for a specific systemd unit. The -n 50 option shows the last 50 lines. This directly provides the recent log messages for the failing service, which is exactly what is needed. Exit code 203 often indicates an exec failure, and the logs will reveal the exact error.

df -h displays disk space usage for all mounted filesystems in human-readable units (e.g., GB, MB). It shows total size, used space, available space, and mount point. This directly answers the need to check free disk space across all mounts in an easily readable format. It is the standard command for this purpose and is available on all Linux distributions.

/etc/resolv.conf holds the active DNS resolver configuration, listing nameserver entries the system queries. On RHEL 8, NetworkManager or systemd-resolved may rewrite it dynamically, so it reflects the current resolver state rather than static intent. Examining it directly satisfies the administrator's need to view live DNS settings causing intermittent connectivity.

The du command estimates file space usage. The -s option summarizes each argument, and -h makes the output human-readable. Running du -sh /* shows the total size of each top-level directory, quickly identifying which directory is using the most space. This is a fast and effective way to pinpoint the largest consumers.

The -u flag filters journalctl output to a single systemd unit, matching the requirement to see logs for one specific service. Without it, journalctl returns the full merged journal, which obscures the failing unit's recent entries.