LFCS Essential Commands Practice Question
A system administrator monitors a server that periodically becomes unresponsive for a few seconds. Investigation reveals that the kernel OOM killer is being invoked, but standard memory usage monitoring tools like 'free' and 'top' show less than 50% memory usage. The server runs a web server and a database. Which of the following is the most likely cause and diagnostic step?
⚠ Common exam trap
Many exam-takers assume OOM kills are always due to user-space memory exhaustion, overlooking that kernel slab caches can consume significant memory and trigger the OOM killer even when 'free' and 'top' show low usage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The kernel is using a large amount of memory for slab caches. Use 'slabtop' to examine kernel memory allocations.
The kernel OOM killer can be triggered by high slab cache usage, which is memory allocated for kernel data structures like inode and dentry caches. Standard tools like 'free' and 'top' may show low overall memory usage because they report only user-space memory, while slab caches are accounted separately. Using 'slabtop' allows the administrator to identify which kernel slab caches are consuming excessive memory, often due to a large number of small files or heavy filesystem metadata operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The server is experiencing a fork bomb. Use 'ps -ef | wc -l' to count processes.
Why it's wrong here
A fork bomb would cause high process count and load, not specifically OOM.
- ✗
The database is using swap space excessively. Use 'swapon -s' to check swap usage.
Why it's wrong here
Swap usage is a symptom of memory pressure, not the cause of OOM.
- ✗
The web server is leaking file descriptors. Use 'lsof -n' to check open files.
Why it's wrong here
File descriptor leaks cause 'too many open files', not OOM.
- ✓
The kernel is using a large amount of memory for slab caches. Use 'slabtop' to examine kernel memory allocations.
Why this is correct
Slab caches can consume significant memory not shown in standard memory tools; 'slabtop' helps identify this.
Go deeper
Related to this question
About these practice questions
This LFCS question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.