CCNA Troubleshooting Questions

`ping 192.168.1.100` sends ICMP echo requests to the target and reports whether replies return, satisfying the reachability check, while its summary displays minimum, average and maximum round-trip times in milliseconds, meeting the measurement requirement. It works directly against the IPv4 address without needing name resolution.

The `iptables -L -v -n` command lists all rules in the current chains with verbose output (`-v`) showing packet and byte counters, and `-n` displays IP addresses and ports numerically to avoid DNS lookups. This allows the administrator to see which rules are matching traffic and potentially dropping packets. The counters are essential for identifying if a specific rule is blocking legitimate traffic.

vmstat reports the number of runnable processes in the r column and processes blocked in uninterruptible sleep in the b column. A persistently high r points to CPU saturation, while a high b points to I/O blocking. Sampling every second reveals which condition dominates.

`dmesg` reads the kernel ring buffer directly, exposing hardware and driver messages logged during the current boot. This satisfies the stem's requirement to inspect boot-time hardware errors, unlike journal or log-file tools that may aggregate or filter kernel output.

`mount | grep noexec` lists mounted filesystems and filters for the `noexec` mount option. If the filesystem containing the script is mounted with `noexec`, execution is blocked regardless of file permissions. This command directly reveals whether that option is active, explaining the 'Permission denied' error despite the execute bit being set.

Cron runs jobs with a minimal environment and a PATH that usually excludes /usr/local/bin and sometimes /usr/bin. When the script calls tar by name, the command is not found and the job fails silently unless output is captured. Defining PATH in the crontab or using absolute paths like /usr/bin/tar ensures the commands resolve, matching the manual-versus-cron discrepancy.

A high wa value in vmstat means CPUs are idle while waiting for I/O operations to complete. Low us and sy confirm the processors are not the constraint. This points to slow or overloaded storage, such as a failing disk, saturated array, or heavy write load, which matches the intermittent stalls and makes storage the correct diagnosis.

The kernel mounts the root filesystem using drivers supplied by the initramfs. If that image is corrupt or omits the storage or filesystem module, the root device cannot be mounted, producing exactly this unknown-block(0,0) panic during boot.

`journalctl -k` reads the kernel ring buffer through systemd's journal, filtering entries to kernel-originated messages only. Because the journal persists per-boot metadata, it can restrict output to the current boot, directly satisfying the requirement to inspect kernel messages from the present boot rather than earlier ones.

The ip -s link show command displays interface statistics, including RX/TX errors, dropped packets, and overruns. By specifying eth0, the administrator can see detailed counters that indicate whether the interface is experiencing errors or discards, which could explain dropped SSH sessions. This directly addresses the need to inspect error and discard statistics for a specific interface.

lsof +L1 lists all open files that have a link count less than 1, which indicates deleted files still held open by a process. This directly identifies the process preventing space from being reclaimed, allowing the administrator to restart or kill it to free the space. It is the precise tool for this scenario.

journalctl -u filters the journal by the specified systemd unit, showing all log entries for that service. This is the most direct way to see why the service failed. It includes messages from the service's startup, errors, and dependencies, making it ideal for troubleshooting a failed start.

The -r (or --resizefs) option to lvextend resizes the underlying filesystem together with the logical volume, so the root LV and its filesystem are extended in a single command. Using -l +100%FREE allocates all remaining free extents in the volume group. This is the correct and efficient way to grow the LV and filesystem without a separate resize2fs or xfs_growfs step.

`iostat -x` reports extended disk statistics, including average I/O wait time (await) and device utilisation percentage (%util), satisfying the stem's focus on both metrics. Plain `iostat` omits the extended columns, so the `-x` flag is what exposes per-device await and %util figures.

lsof +L1 lists all open files whose link count is less than 1, which indicates deleted files still held open by processes. This is exactly the situation where disk space is consumed but du cannot see it because the directory entry is gone. The +L1 filter is specifically designed to find these orphaned inodes, allowing the administrator to identify and restart the offending process.

This command summarizes the disk usage of each immediate item under /var/log in human-readable form, sorts them in descending order, and shows the top ten. It identifies the largest directories or files without modifying anything, which directly addresses the need to locate space consumers on the full partition.

`free -h` reads `/proc/meminfo` and prints a concise table of total, used, free, shared, buff/cache and available memory, with the `-h` flag scaling values into human-readable units such as MiB and GiB. This satisfies the stem's requirement for a brief summary that explicitly includes buffers and cache.

The lsof +L1 option lists open files with a link count less than one, which identifies deleted files still held open by a process. This directly reveals processes writing to unlinked files that continue to consume disk space. The output shows the PID, command, and file path with a (deleted) marker, giving the administrator exactly the information needed to restart or kill the offending process and reclaim space.

xfs_growfs expands an XFS filesystem online to fill its underlying block device. Because the logical volume was already enlarged with lvextend, running xfs_growfs against the mount point '/' resizes the filesystem to consume the new extents. This is the correct tool for XFS, which cannot be grown with resize2fs, and it works while the root filesystem is mounted.

Rescue mode boots a minimal environment where /data stays unmounted, allowing 'umount /dev/sdb1' to ensure no active references remain before 'fsck.ext4 -f' forces a full check and repair of the ext4 partition, satisfying the need to fix the dependency failure safely.

The NS record type queries the zone's authoritative name servers, so dig example.com NS returns exactly the delegation data required. Other record types such as A or MX would resolve addresses or mail routing instead, failing the stated troubleshooting goal.

iostat reports CPU utilisation and disk I/O statistics, and with interval arguments it samples repeatedly, building a historical record of CPU trends. It writes to stdout, so redirecting output to a file captures the data over time.

mpstat from the sysstat package reports per-processor statistics. The -P ALL option shows every core, and the interval argument refreshes output each second. It includes CPU utilization percentages and, in recent versions, load averages, making it ideal for observing whether a single core is saturated while others idle. This granularity helps identify unbalanced or single-threaded load causing unresponsiveness.

chage -l lists account aging information, including password expiration, account expiration, and last password change. It directly shows if the account has expired or is locked due to password aging. This is the correct tool to verify if the user's account is expired or locked, which would prevent SSH login even if the service is running.

dmesg prints the kernel ring buffer, which contains messages about hardware detection, driver loading, and kernel events. These messages are generated during boot and runtime. It is the primary tool for viewing kernel-level diagnostics, making it ideal for identifying hardware issues causing boot hangs.

The -x flag extends iostat output with per-device metrics including requests per second, average queue size and average wait time, while the 1 sets a one-second sampling interval. This directly satisfies the requirement for disk I/O statistics during high wait.

The du command estimates file space usage. With -s it summarizes each argument, and -h makes the output human-readable. Running du -sh /home/* expands to each top-level directory and file under /home, giving a per-item total. This directly answers which directories consume the most space without descending into every file, making it the appropriate first step for this scenario.

`chronyc sources -v` queries the running chronyd daemon and lists configured time sources with their state, stratum, and reachability. The verbose flag adds details such as mode, poll interval, and last sample statistics. This directly shows whether the configured NTP servers are reachable and at what stratum, allowing the administrator to diagnose why synchronization is not occurring despite chronyd running.

The -x flag extends iostat's report with per-device statistics, including %util (device busy percentage), await (average I/O wait), and r/s and w/s throughput. The 1 argument refreshes every second, exposing the sustained disk I/O pattern the engineer needs to diagnose.

iotop displays per-process I/O usage, and the -o option shows only processes actively performing I/O. With -d 5, it refreshes every five seconds, allowing the administrator to identify the process generating heavy disk activity during the 02:00 window. This directly addresses the need to attribute I/O to a specific process.