Free EX442 sample questions

Correct answer: Disk I/O latency; use `iotop` or `pidstat -d` to identify the process generating the write load.

The `iostat` output shows a high `%iowait` (48.50%) and significant write throughput (125MB/s) relative to the read throughput, while the CPU idle time is 35%. This indicates the system is waiting on I/O completion rather than being CPU bound. The next logical step is to identify *which* process is generating this I/O using tools like `iotop` or `pidstat -d`. Checking CPU saturation would be incorrect as the CPU is largely idle waiting for I/O. graph TD A[Analyze iostat] --> B{High %iowait?} B -- Yes --> C{High Throughput?} B -- No --> D[Check CPU/Memory] C -- Yes --> E[Identify Process (iotop/pidstat)] C -- No --> F[Check Disk Health/Latency] E --> G[Tune Application/Filesystem]

Correct answer: The system is CPU saturated with a significant run queue backlog.

The `r` column (runnable processes) is 15, which is nearly double the number of vCPUs (8). The `us` (user) + `sy` (system) CPU usage is 99%, and idle is 1%. This indicates clear CPU saturation. The run queue depth (`r`) exceeding the core count confirms that processes are waiting for CPU time. Swap (`si`/`so`) and I/O (`bi`/`bo`) are negligible.

Correct answer: pmlogger

`pmlogger` is the PCP service responsible for creating and writing archive logs. While `pmcd` (Performance Metrics Collector Daemon) is required to collect the metrics, `pmlogger` is the specific component that persists them to disk for historical analysis. `pcp-zeroconf` typically sets up a default configuration for this.

Correct answer: pmval -a /var/log/pcp/pmlogger/myserver/20230915 -S 10:00 -T 11:00 disk.all.write

The `pmval` command is used to display performance metric values. The `-a` flag specifies the archive source. The `-S` (start) and `-T` (terminate) flags specify the time window for the analysis. `disk.all.write` is the metric for total disk write throughput.

Correct answer: sar -n DEV -f /var/log/sa/sa$(date --date='yesterday' +%d)

`sar -n DEV` displays network statistics for devices. The `-f` flag is used to specify a historical data file. Standard sysstat daily files are stored in `/var/log/sa/` with the format `saDD`, where DD is the day of the month.

Correct answer: A massive flood of network interrupts is being handled by a single core.

High `%soft` (software interrupt) usage on a single core typically indicates that the core is overwhelmed processing SoftIRQs, often from network traffic. If `irqbalance` is not running or configured correctly, or if Receive Packet Steering (RPS) is not configured, all network interrupts may hit a single CPU, creating a bottleneck even if total system CPU capacity is ample.