Recently went on Job Interview for Linux Admin and 1 of the questions asked was:

You have a standalone server running Linux. Apx every 11 days it deletes the same file. There are no log trails or remnants left behind. It just deletes this file. You don't need to know the file type or Linux version. You are told to troubleshoot and find out the problem.
Question: What system inside Linux do you use to find what is deleting this file?

You could write a file event monitoring program using the inotify API to watch for deletion of the file.

It might also be possible to detect what deletes a file by turning on kernel block i/o debugging in /proc/sys/vm/block_dump with "sysctl -w vm.block_dump=1". The logging is to dmesg, and it will be high volume, so you wouldn't want that turned on for long.

1 members found this post helpful.

I thought the same thing but was told it was a built in system command that
will identify the problem. I asked all my Linux
buddies (sys admins > 25 yrs) and they all said they are aware of no commands that will
do this. Needless to say the interview was over because I did not know this
command.

You could monitor files/dirs for alteration through integrity checkers.
http://aide.sourceforge.net/
but this method may appear cumbersome and redundant given the large volume of data generated by servers.

You can also use auditd that comes with most distros

Interesting, bathory. It's not included in Slackware, evidently.

I'll also suggest inotify, which is part of Slackware (well, the inotify-tools are). The inotify system has been in the kernel since 2.6, and the inotify-tools have several interfaces/scripts to use the built-in kernel module to do exactly what you're after. inotifywait works just fine...and it could be that the interviewer had some arcane utility that they knew about, but didn't have alot of knowledge about Linux, and only would take that one answer as 'correct', when the REAL correct answer is "There are many ways using built-in Linux commands and utilities"
Honestly, I would say you dodged a bullet. With *nix systems, there are always MANY ways to accomplish something. If they only used ONE, and didn't want to hear about ANYTHING ELSE, chances are you'd be in a fairly toxic workplace, and have that person micro-managing you from day one.

I agree with TB0ne (about dodging a bullet), and I would add that "I don't know" can be an acceptable answer, if you can show that you are able to think about it and tell how you would begin to solve the problem. It sounds like you did that, and if the interviewer is more interested in a trivia quiz, it's his loss.

2 members found this post helpful.

My initial thought is that there is a cron job running that is deleting the file. You could check the cron log (/var/log/cron for Redhat anyway) for the dates the file was removed to see what users and commands/scripts are being executed then check the user crontabs to see if in fact a user cron job is responsible for the file deletion.

i had a fone interview with google around 2006 (probably android related) and the recruiter asked 4 questions about linux commands.

what is the default signal for the kill command:
- i answered sigterm (15)

what are the 7 feilds of the /etc/passwd file:
i answered user name,hash password,uid,gid,comment,home dir,shell

what command is used to get the inode of a file:
i answered df (wrong); should be stat

i forget what the other one was. but i failed because the interviewer couldnt see how i was thinking since they didnt have the technical background (he was just reading answeres and checking which ones i got rite -- so i didnt get a call back).

Hi,

Most good UNIX/Linux admin have skills that go beyond the OS. Knowledge and pride are just a few. If you cannot compose a good structured sentence or do not have oral or verbal skills to convey information then you will fall short therefore fail at some point in time.

Composition is very important when programming, performing or working within IT. Sure, not every admin will do programming but in some form will have duties to do some form of composition. You must be task oriented to fulfill the duties of a good admin.

You will need to continue adding to your skill set to provide ever evolving maintenance for assigned duties. No way anyone can know everything but can/should know where to look for help or information to solve issue(s);
Over the years here at LQ I have noticed members that do rely on certification(s) to show their skills. Sorry, but certs just show a leveled skill set by the certs norm standards that a person can achieve via time spent learning, labs or tutorial sessions before testing.

Professionally, I would set a good skill testing with both hands on system tests and verbal intercommunication with the interviewee. Then I would see how that individual would respond to interaction with a skilled professional(myself or other team member). Usually most would not get past the hands on testing. I have seen some individuals who surpassed the hands on test but could not convey or interact with a skilled professional without falling short. Generally due too lack of professional verbal skills or just plain lack of knowledge or terminology skills. I have seen some who could throw out the buzz words but did not understand the meaning, just parroting.

Resume is a good foundation for entrants to provide HR and the interviewer with information to hopefully open the door. Sure, some entry level professional do have skills yet lack experience. One must rely on good interviewer skills and interpretation of the individuals overall understanding along with that person's abilities to interact thus convey during the interview. Assessment by all members of the interview session will generally filter out unskilled entrants while providing good assessments of skilled entrants. Then final decision(s)s for offer of a second, third or even final interview will be given to individual(s) to hopefully then offer chance of employment to the best entrant. This tiered interview will help decide if the entrant should be offered employment. Most HR departments do provide candidates but professional UNIX/Linux interviewers should be involved with that process to prevent errant entries.

I also add that appearances, mannerism do mean something when presenting oneself to a future employer process. The above is condensed yet should provide some insight from the interviewer perspective.

1 members found this post helpful.