Start by acknowledging the symptom and the need for a systematic, data-driven approach. Walk through a top-down diagnostic process using standard Linux tools, moving from high-level system metrics to per-process and per-thread analysis, and finally to root cause and remediation. Emphasize how you distinguish between user CPU, kernel CPU, and IO wait, and how you'd validate your hypothesis before taking action.
Pro tip: Mention that you'd first check if the spike is sustained or transient, and use `pidstat` or `top -H` to identify threads—this shows you understand that CPU spikes often come from a single busy thread, not the whole process.
Run `top` or `uptime` to see load average and overall CPU breakdown (us, sy, wa, id). Use `vmstat 1` to observe trends over time and confirm whether the bottleneck is user, system, or IO wait.
In `top`, sort by CPU (press P) to find the top process. Note its PID and CPU percentage. If it's a multi-threaded app, press H to toggle thread view or use `top -H -p <PID>` to see per-thread CPU.
Use `pidstat -t -p <PID> 1` to monitor thread-level CPU. For deeper analysis, use `perf top -p <PID>` or `strace -c -p <PID>` to see which syscalls or functions are consuming CPU. Check `/proc/<PID>/status` for voluntary/nonvoluntary context switches.
High `us` indicates user-space code; high `sy` indicates kernel overhead (syscalls, context switches); high `wa` indicates IO wait. Use `iostat -x 1` to check disk utilization and `mpstat -P ALL 1` to see per-CPU breakdown. If `wa` is high, investigate disk or network IO.
Once the cause is identified (e.g., a runaway thread, inefficient syscall loop, or disk bottleneck), take action: renice/kill the process, optimize code, add resources, or adjust IO scheduler. Re-run diagnostics to confirm the spike is resolved and monitor for recurrence.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Trickier than it sounds because there are so many angles.
Start by establishing a baseline and narrowing the scope: check if the latency is client-specific, server-wide, or network-wide using tools like mtr and tcpdump. Then correlate signals such as SYN backlog, retransmits, RTT, and packet drops to pinpoint the layer (client, server, or network) causing the issue.
Pro tip: Always compare multiple vantage points (e.g., client-side vs. server-side tcpdump) to avoid false conclusions—latency seen from one side may not exist on the other. Also, remember that high RTT with low retransmits often indicates network distance, while high retransmits with low RTT suggests local congestion or server overload.
Determine if latency affects all clients or a subset, and if it's consistent or intermittent. Use basic tools like ping and curl to measure response times from different locations.
Run traceroute or mtr from client to server to identify high-latency hops, packet loss, or asymmetric routing. Look for consistent RTT spikes or drops at specific hops.
Use netstat to check for SYN backlog, listen queue overflows, and connection states on the server. On both client and server, use tcpdump to capture packets and analyze retransmissions, duplicate ACKs, and zero-window events.
Compare client-side and server-side captures to see where delays occur: if SYN retransmits are only on client side, network issue; if server shows high SYN backlog, server overload. Check server resource metrics (CPU, memory) to rule out application-level slowness.
Based on evidence, attribute the problem to client, server, or network, and suggest next steps (e.g., scale server, fix network route, optimize client).
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by walking through the DNS resolution process step by step, from the stub resolver to the authoritative server, highlighting caching and TTLs. Then compare dig and nslookup in terms of features, output, and use cases, emphasizing when to choose each. Conclude with a practical example or scenario to demonstrate understanding.
Pro tip: Mention that dig is preferred for scripting and detailed debugging due to its structured output and additional features like +trace, while nslookup is more interactive and available on more systems, but less feature-rich. This shows awareness of real-world tooling trade-offs.
Explain that the stub resolver on the client sends a recursive query to its configured recursive resolver (e.g., ISP or public DNS).
Describe how the recursive resolver checks its cache; if not cached, it queries root, TLD, and authoritative nameservers iteratively to resolve the domain.
Detail that the authoritative nameserver returns the requested record (e.g., A, AAAA, CNAME) with a TTL, which the recursive resolver caches and returns to the stub resolver.
Explain that each record has a TTL that determines how long it can be cached; recursive resolvers and stub resolvers respect TTLs to reduce latency and load.
Contrast dig (flexible, scriptable, detailed output, supports +trace) with nslookup (simpler, interactive, less feature-rich) and suggest when to use each.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.