Linux with Operating System Concepts

 filename 
where 
filename
is a file storing crontab scheduling information?
26. What does run-parts do and which service does it call upon?
27. Why might you use /etc/at.allow?
28. What is the role of the directory /etc/cron.daily?
29. How does free’s output differ from vmstat’s?
30. Which of the programs from Section 14.4 might you use to determine how much 
virtual memory your system is or has been using?
31. Which of the programs from Section 14.4 might you use to view how your system’s 
performance has been changing over a few minutes’ time?
32. Which of the programs from Section 14.4 might you use to view how your system’s 
processor is performing?

---

618
◾
Linux with Operating System Concepts
33. Which of the programs from Section 14.4 might you use to determine if any single 
process is using an inordinate amount of system resources?
34. Which of the programs from Section 14.4 might you use to compare your processor’s 
time spent on user processes, system processes, and idle time?
35. How does sar differ in terms of the data it uses from ps? From top?
36. The who program does not in itself inform you about system performance. Why 
as a system administrator might you use it if you are investigating your system’s 
performance?
37. You suspect a possible intruder in your system. What log file(s) might you examine?
38. You suspect a scheduled process did not run correctly. What log file(s) might you 
examine?
39. Why might you examine the boot.log files?
40. Provide a command to display all audit log messages from the user whose UID is 501.
41. Assume you want to explore all the events logged by running processes that are chil-
dren of /sbin/init. Provide the proper ausearch command for this (hint: all these pro-
cesses have something in common, init is their parent).
42. Given the following audit log entry, explain each part that is underlined.
time–
>
Wed Jul 17 12:20:10 2014
type 
=
CRED_ACQ msg 
=
audit(1374078010.023:59603): user 
pid 
=
3102 uid 
=
501 auid 
=
501 ses 
=
1 
subj 
=
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
msg 
=
‘op 
=
PAM:setcred acct 
=
“root” exe 
=
“/bin/su” hostname 
=
? 
addr 
=
? terminal 
=
pts/2 res 
=
success’
43. The 
aureport –m
option displays user modification events. What is a user modifi-
cation event and what programs can you think of that would generate such an event?
44. What would ausearch –sc open do?
45. Why would a system administrator be involved in disaster-recovery planning?
46. Why would it be unwise to store file system backup media in the same building as the 
computer or file server that is being backed up?
47. Why would distributing file systems and processing across multiple locations be a 
wise precaution for an organization that could afford it?
48. What types of preventative measures could an organization take to prevent damage 
or destruction of hardware from a natural disaster?
49. How might a disaster plan for a flooding situation differ from that of a fire?

---

Maintaining and Troubleshooting Linux
◾
619
50. How might a disaster plan for a lockdown because of a gunman on the premises differ 
from natural disasters such as fire, flood, and earthquake?
51. What role does encryption play in risk assessment?
For questions 52 through 56, similar to Section 14.7, describe the types of tests that you 
should take to troubleshoot the given problem.
52. A user is not able to log into his or her account even though other users can.
53. Installation using yum of an available software package has failed.
54. Remotely mounted file system no longer accessible.
55. Network access showing heavy usage.
56. Too much disk swapping seems to be taking place.

---

---

621
Bibliography
Abhari, A., Dandamudi, S., and Majumdar, S. Web Object-Based Storage Management in Proxy 
Caches,