A Linux box is at 100% CPU. Walk me through identifying what is doing it and why.
What they are really testing: Whether you can read a load picture properly. The distinction between user, system and iowait time is the difference between a targeted answer and guessing.
A real interview question
A Linux box is at 100% CPU. Walk me through identifying what is doing it and why.
What most people say
drag me
“I would find the process using the most CPU and kill it.”
It may be the process that matters, and killing it during a production incident can be worse than the CPU load. It also skips the diagnosis entirely, so the same thing recurs in 20 minutes with no more understanding than before.
The follow-ups they ask next
iowait is 60%. Where do you go next?
Storage: iostat for device utilisation and queue depth, then which process is doing the IO. Often an unindexed query, a log flush pattern, or a noisy co-tenant on shared storage.
Load average is 40 but CPU is 15%. Explain that.
Linux load includes uninterruptible sleep, usually disk or network blocking. Forty processes are runnable-or-blocked while few are computing, so the bottleneck is IO, not CPU.
What the interviewer is listening for
- Reads user, system, iowait and steal separately
- Knows load average includes uninterruptible sleep
- Refuses to kill blindly
What sinks the answer
- Kills the top process immediately
- Treats load average as a CPU percentage
- No awareness of steal time
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Identify the process with [top sorted by CPU], but read [the breakdown: user is app work, system is kernel or syscalls, iowait means blocked on disk so CPU is not the problem, steal means a noisy neighbour]. Remember [load average counts uninterruptible sleep, so high load with low CPU is IO]. Then [per-thread and a profiler], and [do not kill a user-serving process blind].”
Keep going with linux
Mid
What is the difference between SIGTERM and SIGKILL, and why does it matter for containers?
Mid
Our pipeline takes 45 minutes and developers have stopped waiting for it. How do you fix that?
Mid
A pod is in CrashLoopBackOff after a deploy. Walk me through your debugging, command by command.
Mid
Terraform plan wants to destroy a production database that someone modified manually. What do you do?
Mid
You need to rename a heavily-used database column with zero downtime. How?
Mid
How do you decide CPU and memory requests and limits for a service, and what breaks if you get them wrong?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free