Linux Foundation LFCS Dumps

Objective: Configure Linux iptables to perform destination-port redirection using the NAT table.

The recording suggests this intended behavior:

Incoming source

Original destination port

Redirected local port

172.16.123.0/28

TCP 80

TCP 9080

All other IPv4 sources

TCP 80

TCP 8080

The second destination, 9080, comes from the candidate's terminal commands, not the fully visible task diagram. It must therefore be treated as an inferred requirement.

A crucial technical issue is rule priority: the more specific subnet rule must be evaluated before the general port-80 rule. Otherwise, the general rule captures the subnet traffic first.

Step 1: Connect to the correct Linux server.

The recording specifies host lfcs00074.

Execute:

ssh candidate@lfcs00074

This connects to the designated host on which the firewall and NAT configuration must be performed.

Step 2: Verify that iptables is available.

Execute:

sudo iptables --version

This displays the iptables version and may indicate whether the system uses the nf_tables or legacy backend.

For example:

iptables v1.8.x (nf_tables)

The actual version depends on the installed environment.

Step 3: Inspect the existing NAT configuration.

Execute:

sudo iptables -t nat -L -n -v

-t nat selects the Network Address Translation table.

-L lists rules.

-n displays numerical IP addresses and port numbers.

-v provides verbose output, including packet and byte counters.

The NAT table contains chains including PREROUTING, OUTPUT, and POSTROUTING.

For incoming connections being redirected to local services, the relevant chain is normally PREROUTING.

Step 4: Display the PREROUTING rules with line numbers.

Execute:

sudo iptables -t nat -L PREROUTING -n -v --line-numbers

This displays the order in which incoming packets encounter the NAT rules.

Also execute:

sudo iptables -t nat -S PREROUTING

The second command displays the rules in a format similar to the commands used to configure them.

Check whether there are already rules that redirect TCP port 80.

Avoid creating duplicate or contradictory rules.

Step 5: Understand the required redirection mechanism.

The Linux REDIRECT target changes the destination of a matching packet so that it is delivered to the local machine, optionally changing its destination port.

For example:

sudo iptables -t nat -A PREROUTING \

-p tcp --dport 80 \

-j REDIRECT --to-ports 8080

This redirects incoming TCP connections originally targeting port 80 to local port 8080.

The official iptables-extensions(8) manual confirms that REDIRECT is supported in the NAT table's PREROUTING and OUTPUT chains.

Linux manual page

Step 6: Configure the source-specific rule first.

For the inferred special handling of subnet 172.16.123.0/28, execute:

sudo iptables -t nat -I PREROUTING 1 \

-s 172.16.123.0/28 \

-p tcp --dport 80 \

-j REDIRECT --to-ports 9080

Option

Purpose

-t nat

Selects the NAT table

-I PREROUTING 1

Inserts the rule at position 1

-s 172.16.123.0/28

Matches packets originating from that subnet

-p tcp

Matches TCP traffic

--dport 80

Matches original destination port 80

-j REDIRECT

Redirects the packet to the local machine

--to-ports 9080

Changes the destination port to 9080

The -I PREROUTING 1 option is important because it places the specific rule at the beginning of the chain, ahead of broader rules appended later.

Do not run this command if an equivalent correct rule already exists; inspect and reconcile the existing configuration first.

Step 7: Configure the general port redirection.

Provided an equivalent general rule is not already present, execute:

sudo iptables -t nat -A PREROUTING \

-p tcp --dport 80 \

-j REDIRECT --to-ports 8080

This handles incoming TCP port-80 connections that did not match an earlier terminating rule.

Because the source-specific rule has higher priority, the expected behavior is:

Connections from 172.16.123.0/28 are redirected to 9080.

Other incoming TCP port-80 connections are redirected to 8080.

The general rule does not require a source restriction because it is the fallback rule.

Step 8: Understand why the rule order matters.

The candidate initially enters the broad redirect to 8080 and later adds the subnet-specific redirect to 9080.

That sequence is problematic.

Consider these two rules in this order:

sudo iptables -t nat -A PREROUTING \

-p tcp --dport 80 \

-j REDIRECT --to-ports 8080

sudo iptables -t nat -A PREROUTING \

-s 172.16.123.0/28 \

-p tcp --dport 80 \

-j REDIRECT --to-ports 9080

The first rule matches all incoming TCP port-80 connections, including those from the special subnet.

Since a REDIRECT target terminates further rule evaluation for that NAT decision, the later subnet rule will not receive those matching connections.

Correct order:

Rule 1: Subnet 172.16.123.0/28 → Port 9080

Rule 2: Other TCP port-80 connections → Port 8080

The Linux iptables manual documents sequential rule evaluation and matching behavior.

Linux manual page

Step 9: Verify the configured NAT rules.

Execute:

sudo iptables -t nat -L PREROUTING \

-n -v --line-numbers

The relevant rule sequence should resemble:

1 REDIRECT tcp -- 172.16.123.0/28 0.0.0.0/0 tcp dpt:80 redir ports 9080

2 REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 8080

The output format may vary.

If existing unrelated rules are present, preserve them. The two example lines do not imply that the real NAT table should contain only two rules.

Step 10: Correct any incorrectly ordered rules.

If the general port-80 rule is already first, the specific rule can be inserted ahead of it using:

sudo iptables -t nat -I PREROUTING 1 \

-s 172.16.123.0/28 \

-p tcp --dport 80 \

-j REDIRECT --to-ports 9080

Before doing so, make sure an identical subnet rule is not already present.

If the previous candidate commands created duplicate entries, list the chain:

sudo iptables -t nat -L PREROUTING -n --line-numbers

Then carefully remove only confirmed duplicate or erroneous entries by their current rule number:

sudo iptables -t nat -D PREROUTING RULE_NUMBER

Replace RULE_NUMBER with the actual displayed number.

Rule numbers can change after each deletion, so inspect the chain again before deleting another entry.

Do not flush the entire NAT table.

Step 11: Verify that the destination services are available.

Execute:

sudo ss -ltnp

To examine the relevant ports:

sudo ss -ltnp | grep -E ':(8080|9080)\b'

This checks whether processes are listening on TCP ports 8080 and 9080.

The iptables rules may be syntactically correct even if no service is currently listening. However, actual connection delivery requires an appropriate local service and any necessary firewall permission.

A NAT redirection rule does not automatically start the destination application.

Step 12: Check whether filtering rules permit redirected connections.

Execute:

sudo iptables -L INPUT -n -v

Check whether the existing INPUT chain allows connections to the effective destination ports.

The REDIRECT target changes the packet's destination, but a restrictive filter policy can still block delivery.

Do not add broad ACCEPT rules unless the actual task requires them and the existing firewall policy warrants the change.

Step 13: Test traffic from the specified subnet.

From a machine whose source address belongs to:

172.16.123.0/28

Initiate a fresh TCP connection to port 80 on the appropriate IP address of lfcs00074.

For an HTTP-based service, a test could use:

curl -v

Replace SERVER_IP with the real server address.

If the inferred subnet-specific rule is correct, the connection should reach the local service listening on port 9080.

A destination service's response or a packet trace can establish which port received the connection.

Step 14: Test traffic from outside the specified subnet.

From a client outside 172.16.123.0/28, initiate another new connection to the same server's TCP port 80.

The general rule should redirect that traffic to port 8080, provided no earlier rule intercepts it.

Do not rely only on a test from:

curl

Locally generated traffic traverses the NAT OUTPUT chain rather than the incoming PREROUTING chain. It is therefore not a valid test of these PREROUTING rules.

Step 15: Inspect rule counters.

Execute:

sudo iptables -t nat -L PREROUTING \

-n -v --line-numbers

Review the packet and byte counters.

New matching connections should increment the applicable rule's counters.

Because NAT decisions are generally made for the initial packets of tracked connections, established connections may not increment counters in the way ordinary filter-chain traffic does.

Use fresh connections for testing.

Step 16: Preserve the rules if persistence is required.

The video shows the candidate using:

sudo service netfilter-persistent save

For a system with the appropriate netfilter-persistent plugins installed, the documented command is:

sudo netfilter-persistent save

This saves the active firewall rules through the installed persistence plugins.

Ubuntu's netfilter-persistent(8) manual documents the save operation.

Ubuntu Manpages

Before relying on it, check that the service and IPv4 plugin are installed:

command -v netfilter-persistent

ls -l /usr/share/netfilter-persistent/plugins.d/

If persistence is required, verify the saved IPv4 rules:

sudo grep -A 20 '^\*nat' /etc/iptables/rules.v4

The saved configuration should contain the correctly ordered rules.

Persistence is not explicitly visible in the task statement, so treat it as an additional measure suggested by the recorded candidate actions, not a proven requirement.

Step 17: Perform final verification.

Execute:

sudo iptables -t nat -S PREROUTING

sudo iptables -t nat -L PREROUTING -n -v --line-numbers

sudo ss -ltnp | grep -E ':(8080|9080)\b'

For the inferred two-rule requirement, the expected configuration is:

Verification

Expected behavior

Source subnet

172.16.123.0/28

Original destination

TCP port 80

Special-subnet destination

TCP port 9080

General destination

TCP port 8080

Specific rule priority

Before general rule

NAT table

nat

NAT chain

PREROUTING

Existing unrelated rules

Preserved

Final Solution

For the two redirection paths inferred from the recording, and assuming equivalent rules do not already exist, the essential command sequence is:

# Connect to the required server

ssh candidate@lfcs00074

# Inspect existing NAT rules

sudo iptables -t nat -S PREROUTING

# Specific subnet: TCP 80 → 9080

# This rule must have higher priority.

sudo iptables -t nat -I PREROUTING 1 \

-s 172.16.123.0/28 \

-p tcp --dport 80 \

-j REDIRECT --to-ports 9080

# General traffic: TCP 80 → 8080

sudo iptables -t nat -A PREROUTING \

-p tcp --dport 80 \

-j REDIRECT --to-ports 8080

# Verify rule ordering and counters

sudo iptables -t nat -L PREROUTING \

-n -v --line-numbers

# If persistence is required and configured

sudo netfilter-persistent save

Technical Verification and References

Linux iptables(8)

— Documents rule insertion, ordering, matching and chain operations.

Linux iptables-extensions(8)

— Defines the REDIRECT target and --to-ports option.

Ubuntu netfilter-persistent(8)

— Documents saving and restoring firewall rules.

Video verification finding: The candidate's commands reveal an attempted redirect from port 80 to 8080 and a separate source-specific redirect from port 80 to 9080. The specific rule was appended after the general rule, which would prevent the special-subnet redirect from taking effect as intended. The corrected sequence places the specific rule first.

Verification limitation: The full task diagram is never visible, so the inferred two-rule interpretation cannot be certified as the exact complete exam requirement. The command syntax and priority correction are validated against Linux documentation, but the final intended behavior requires the missing diagram portion and runtime connection tests.

next please

Worked for 3m 12s

Objective: Correct the Linux system clock by performing a one-time synchronization against NTP servers from pool.ntp.org, without enabling continuous or automatic time synchronization and without modifying the hardware clock.

The video shows the candidate successfully executing:

sudo ntpdate pool.ntp.org

This is a valid solution. The terminal output confirms that the system clock was adjusted using an NTP server.

The official Ubuntu ntpdate(8) documentation confirms that ntpdate can synchronize the system clock manually without establishing an ongoing synchronization service.

Ubuntu Manpages

Step 1: Connect to the correct Linux server.

The video specifies host lfcs00103.

From the candidate terminal, execute:

ssh lfcs00103

This establishes an SSH session with the server whose system clock requires correction.

All subsequent commands must be executed on this host.

Step 2: Inspect the current system date and time.

Execute:

date

This displays the system's current local date and time.

For UTC:

date -u

The -u option displays the system time in Coordinated Universal Time.

Record the initial date and time so you can compare the system clock before and after synchronization.

The task states that the system clock has drifted. Therefore, its displayed time may differ significantly from the actual time reported by NTP servers.

Step 3: Check the current time synchronization status.

Execute:

timedatectl status

This displays information such as:

Local time.

Universal time.

RTC (hardware clock) time.

Configured timezone.

Whether an NTP synchronization service is active.

Whether the system reports its clock as synchronized.

An illustrative output is:

Local time: Sat 2026-10-03 11:30:00 UTC

Universal time: Sat 2026-10-03 11:30:00 UTC

RTC time: Sat 2026-10-03 11:30:00

Time zone: Etc/UTC (UTC, +0000)

System clock synchronized: no

NTP service: inactive

These values are illustrative rather than the actual output from the video.

Since the question asks for manual one-time synchronization, there is no need to configure an automatic NTP service.

Step 4: Verify that the ntpdate utility is available.

Execute:

command -v ntpdate

If installed, this command displays its executable path.

For example:

/usr/sbin/ntpdate

You can inspect the utility's manual:

man ntpdate

The task's demonstrated environment already has ntpdate available.

Therefore, installing additional software is unnecessary.

Step 5: Verify hostname resolution for the NTP server pool.

The task specifies:

pool.ntp.org

Check that the hostname resolves:

getent ahosts pool.ntp.org

This should return IP addresses associated with the NTP pool.

pool.ntp.org is a DNS-based collection of public NTP servers rather than one fixed machine.

Using the pool allows the time client to obtain available servers without manually specifying individual server addresses.

A successful synchronization also requires network connectivity to an NTP server, normally using UDP port 123.

Step 6: Check for an existing time synchronization daemon if necessary.

Execute:

systemctl is-active systemd-timesyncd

systemctl is-active chrony

systemctl is-active ntp

Some services may not be installed, so an inactive, unknown, or unit-not-found result is possible.

The task says not to configure automatic synchronization. It does not require enabling any of these services.

If an existing synchronization daemon interferes with a one-time adjustment, investigate and handle that conflict without unnecessarily modifying its persistent configuration.

Do not enable a daemon merely to synchronize the clock once.

Step 7: Synchronize the system clock manually using ntpdate.

Execute the primary solution:

sudo ntpdate pool.ntp.org

This is the command demonstrated in the video.

Command component

Purpose

sudo

Grants privileges to modify the system clock

ntpdate

Queries NTP servers and adjusts the local system clock

pool.ntp.org

Specifies the requested NTP server pool

The utility contacts NTP servers, estimates the difference between the local clock and server time, and corrects the local clock.

Depending on the implementation and magnitude of the error, it may step or slew the clock.

A step changes the displayed system time immediately. A slew changes the clock gradually.

The ntpdate manual documents the clock-setting behavior and the difference between querying and updating the clock.

Ubuntu Manpages

Step 8: Examine the synchronization output.

The recording shows that the ntpdate command corrected a substantial clock error.

The terminal includes a successful adjustment message of the form:

CLOCK: time stepped by 37212257.308748

It also reports that the system clock moved from an incorrect date in July 2025 to October 3, 2026.

This is significant because it confirms that the command did more than merely query an NTP server: it actually changed the system clock.

Your terminal output will depend on the clock's actual drift when the command runs.

A small drift may result in a different adjustment message.

Step 9: Verify the command's exit status.

Immediately after the synchronization command completes, execute:

echo $?

Expected:

0

The official ntpdate documentation specifies that a zero exit status indicates a successful clock update.

Ubuntu Manpages

A nonzero status indicates that the operation failed.

If the operation fails, investigate the actual error rather than assuming that the clock has been corrected.

Possible issues include unavailable DNS resolution, unreachable NTP servers, firewall restrictions, or interference from another time synchronization process.

Step 10: Verify the corrected system time.

Execute:

date

Then:

date -u

These commands display the system time after the NTP adjustment.

Compare the new values with the values recorded before synchronization.

The corrected clock should be consistent with the time reported by the selected NTP servers.

Step 11: Optionally check the remaining time offset without changing the clock.

Execute:

sudo ntpdate -q pool.ntp.org

The -q option means query only.

It obtains time information and reports the estimated offset without setting the clock.

This is useful after synchronization because it allows you to check whether the remaining clock difference is small.

Do not confuse:

sudo ntpdate -q pool.ntp.org

with:

sudo ntpdate pool.ntp.org

The first command queries only; the second performs the requested clock adjustment.

A small reported offset provides supporting evidence that the local clock is close to the NTP reference time.

Step 12: Do not configure automatic synchronization.

The task explicitly states:

Do not configure automatic time synchronization.

Therefore, do not enable a continuous time synchronization service as part of the solution.

For example, avoid:

sudo timedatectl set-ntp true

Also avoid enabling a daemon solely for this task:

sudo systemctl enable --now chrony

Likewise, do not create a cron job that runs ntpdate periodically.

These operations would establish ongoing synchronization behavior rather than performing the required one-time adjustment.

The command:

sudo ntpdate pool.ntp.org

already satisfies the one-time synchronization requirement when it completes successfully.

Step 13: Do not manually update the hardware clock.

Linux maintains two conceptually distinct clocks:

Clock

Description

System clock

Kernel-maintained clock used by running applications

Hardware clock (RTC)

Battery-backed or virtualized real-time clock used across system restarts

The task specifically instructs that the hardware clock does not need to be updated.

Therefore, do not execute:

sudo hwclock --systohc

This command copies the system clock to the hardware clock and is unnecessary for the task.

The exam environment is already configured to perform the appropriate hardware-clock update during shutdown.

Step 14: Do not modify persistent NTP configuration files.

The task does not require editing files such as:

/etc/chrony/chrony.conf

/etc/systemd/timesyncd.conf

/etc/ntp.conf

These files belong to time synchronization service configurations and are unrelated to the required manual one-time operation.

There is also no requirement to change the timezone.

Step 15: Verify the system status after synchronization.

Execute:

timedatectl status

Inspect the system time.

One important technical detail: after a manual ntpdate adjustment, timedatectl may still report:

System clock synchronized: no

This does not necessarily mean the one-time NTP adjustment failed.

That status may depend on whether a running time synchronization service or the kernel's synchronization status has marked the clock as synchronized.

For this task, rely primarily on the successful ntpdate execution, the resulting clock adjustment, and an optional read-only NTP offset check.

Do not enable automatic synchronization simply to change the timedatectl status.

Step 16: Alternative solution if ntpdate is unavailable.

If the host provides Chrony instead of ntpdate, the officially documented one-time synchronization command is:

sudo chronyd -q 'pool pool.ntp.org iburst'

chronyd is Chrony's time synchronization program.

-q instructs it to set the system clock once and exit.

pool pool.ntp.org selects servers from the specified NTP pool.

iburst performs an initial burst of requests for quicker synchronization.

This is the alternative recommended by Ubuntu's current time synchronization documentation.

Frequently Asked Questions

+1

Use this alternative only if appropriate for the installed environment. If another Chrony daemon is already running, avoid launching a competing clock controller without resolving that conflict.

For the environment demonstrated in the supplied video, ntpdate is available and is the simpler, directly demonstrated solution.

Step 17: Perform final verification.

Execute:

date -u

Confirm the corrected system time.

If needed, check the NTP offset without changing the clock:

sudo ntpdate -q pool.ntp.org

The completed task should satisfy:

Requirement

Expected result

Correct host

lfcs00103

NTP server pool

pool.ntp.org

System clock synchronized once

Yes

Method

Manual NTP adjustment

Automatic synchronization configured

No

Hardware clock manually changed

No

Clock adjustment

Successful

Final Solution

The essential commands are:

# Connect to the designated server

ssh lfcs00103

# Check the current system time

date -u

# Perform one-time synchronization

sudo ntpdate pool.ntp.org

# Verify the corrected time

date -u

# Optional: query the remaining offset without modifying the clock

sudo ntpdate -q pool.ntp.org

The single command that performs the requested adjustment is:

sudo ntpdate pool.ntp.org

Technical Verification and References

Ubuntu ntpdate(8) Manual

— Documents one-time clock synchronization, query-only mode and exit status.

Chrony Official FAQ

— Documents chronyd -q for one-time clock synchronization.

Ubuntu Server — Time Synchronization

— Explains NTP, Chrony and one-shot synchronization.

Video verification finding: At approximately 30:30–30:46, the candidate connects to lfcs00103 and executes sudo ntpdate pool.ntp.org. The terminal displays a successful clock-step operation, correcting a large time difference. No continuous synchronization service or hardware-clock modification is shown.

Expected result: The system clock on lfcs00103 is corrected through a single NTP synchronization against pool.ntp.org. No automatic time synchronization is configured, and the hardware clock is left unchanged.

next batch now

Objective: Build a Docker image from the existing Dockerfile, create and start a container in detached mode, configure its network port mapping and memory limit, and ensure Docker automatically restarts the container following a Docker daemon restart or system reboot.

The task requires four specific configurations:

Requirement

Correct configuration

Docker image

myapp:latest

Container execution

Detached (-d)

Port mapping

Host 8080/tcp → Container 80/tcp

Memory limit

256m

Automatic restart

--restart=always

The essential Docker commands are:

Docker's official documentation confirms the behavior of the image-building, container-execution, memory-limit, port-publishing and restart-policy options used here.

Docker Docs

+2

Step 1: Connect to the correct Linux server.

The video specifies host lfcs00096.

From the candidate terminal, execute:

This connects to the Linux host where the Docker image and container must be created.

All subsequent commands must be executed on this host.

Step 2: Verify that Docker is installed.

Execute:

This displays the installed Docker client version.

For example:

The actual version may differ.

Check whether the Docker daemon is accessible:

This reports information about the Docker Engine, including its version, storage driver, available resources and container runtime.

If the Docker daemon is unavailable, investigate the service before proceeding.

Step 3: Verify that the Docker service is running.

Execute:

A running service should report:

For a concise check:

Expected:

If Docker is installed but stopped, start it:

There is no reason to reinstall Docker if the existing installation is functioning.

Step 4: Navigate to the Dockerfile directory.

The task specifies:

Execute:

Verify the working directory:

Then inspect its contents:

The directory should contain the Dockerfile and any files required to build the application.

Step 5: Verify that the Dockerfile exists.

Execute:

You can also confirm that it is a regular file:

An exit status of 0 indicates that the file exists.

The Dockerfile is already provided. There is no requirement to create a new Dockerfile or replace its contents.

Step 6: Inspect the Dockerfile before building.

Execute:

A Dockerfile can contain instructions such as:

Instruction

Purpose

FROM

Specifies the base image

RUN

Executes commands during image creation

COPY

Copies files from the build context into the image

WORKDIR

Sets the working directory

EXPOSE

Documents an intended container listening port

CMD

Specifies a default startup command

ENTRYPOINT

Defines the executable launched by the container

The Dockerfile may already configure a web service to listen on port 80.

Do not invent or replace application commands, because the task requires building the existing Dockerfile.

Step 7: Understand the Docker build context.

The Docker build context is the collection of files available to the Docker builder.

Because the Dockerfile is located at:

the normal build context is:

After navigating into that directory, the build context is represented by:

Docker's official documentation confirms that the final positional argument of docker build defines the build context.

Docker Docs

Step 8: Build the Docker image with the exact required tag.

Execute:

This is the first essential Docker command.

sudo provides access to the Docker daemon.

docker build builds an image from a Dockerfile.

-t assigns a repository name and image tag.

myapp:latest is the exact image reference specified in the task.

indicates the current directory as the build context.

An equivalent command, when executed from another directory, would be:

However, the shorter command is preferable after changing into ~/flying-jay.

Step 9: Examine the build output.

During the build, Docker processes the Dockerfile instructions.

A successful build may display output similar to:

This is illustrative.

The actual build output depends on the contents of the Dockerfile, Docker Engine version and BuildKit configuration.

After the command completes, check the exit status:

Expected:

If the build fails, inspect the reported error before proceeding. Common causes include an unavailable base image, missing build-context files or a failing Dockerfile instruction.

Step 10: Verify that the image was created successfully.

Execute:

The output should contain an entry corresponding to:

For more specific verification:

If the image exists, Docker returns its metadata.

If the image does not exist, Docker reports an error.

Do not create a container until the image has been built successfully.

Step 11: Check whether an existing container will conflict.

The task does not specify a required container name. For easier management, the solution will use:

Before creating the container, execute:

Check whether a container named myapp already exists.

If an existing container has that name, inspect it rather than automatically deleting it. Docker container names must be unique.

Using --name myapp is optional for the assessment; it is a convenient identifier for verification.

Step 12: Start the container in detached mode with all required options.

Execute:

This is the second essential command and implements all requested runtime requirements.

Parameter

Purpose

docker run

Creates and starts the container

-d

Runs the container in detached mode

--name myapp

Assigns a convenient container name

--restart=always

Configures automatic restarts

-p 8080:80/tcp

Maps host TCP 8080 to container TCP 80

--memory=256m

Sets a 256 MiB memory limit

myapp:latest

Uses the required Docker image

Docker documents all these options as supported container-runtime settings.

Docker Docs

Step 13: Understand detached mode.

The -d option means detached mode.

When executed with -d, Docker starts the container in the background and returns control to the terminal.

For example:

does not attach the terminal to the container's standard input and output.

Instead, Docker normally prints the new container ID.

The task explicitly requests a detached container, so do not omit -d.

Also, do not use --rm for this task. Removing a container automatically on exit conflicts with the intended persistent container lifecycle.

Step 14: Understand the required port mapping.

The task states:

mapping the container port 80/tcp to host port 8080/tcp

The correct argument is:

Docker port-publishing syntax is:

Therefore:

A connection to:

is forwarded to TCP port 80 inside the container.

Do not reverse the numbers:

That would map host port 80 to container port 8080, which is the opposite of the task's requirement.

By default, publishing without a specific host IP address exposes the port on the Docker host's available network interfaces, subject to network and firewall configuration.

Docker Docs

Step 15: Understand the 256m memory limit.

The required option is:

This configures a hard limit on the container's physical memory usage.

Docker interprets this memory size as:

256

×

1024

×

1024

=

268

,

435

,

456

bytes

256×1024×1024=268,435,456 bytes

Therefore, the configured memory value is:

The memory limit is enforced through Linux kernel resource-management mechanisms, such as control groups (cgroups).

One distinction matters: --memory=256m limits physical memory, but Docker may permit additional swap usage depending on its swap configuration.

The task does not separately specify a swap limit. Therefore, --memory=256m is the appropriate requested setting without introducing unrelated swap restrictions.

Docker Docs

Step 16: Understand automatic container restart behavior.

The final requirement is:

Finally, ensure that the container is started automatically on boot or restart of Docker.

Docker supports several restart policies.

Restart policy

Behavior

no

No automatic restart

on-failure

Restart after a failed process exit, subject to options

always

Restart when the container exits and after applicable Docker daemon restarts

unless-stopped

Similar to always, but retains a manually stopped state across daemon restarts

For this task, use:

This is appropriate because the task specifically requires automatic startup after boot or a Docker daemon restart.

Docker documents that a manually stopped container using always is normally restarted when the Docker daemon restarts, unlike unless-stopped.

Docker Docs

Step 17: Verify that the container was created and started.

Execute:

A successful result should include a container using:

Its status should indicate that it is running.

For example:

This is an illustrative result.

If no running container appears, inspect stopped containers:

A successful docker run -d response only confirms that Docker accepted the startup request; it does not guarantee the application continues running.

Step 18: Verify the image used by the container.

Execute:

Expected:

This confirms that the running container was created using the required image reference.

Docker's official inspect documentation supports using formatted output to retrieve individual container configuration fields.

Docker Docs

Step 19: Verify the container's TCP port mapping.

Execute:

Expected output includes a mapping equivalent to:

Depending on the host configuration, Docker may also display an IPv6 mapping.

For a targeted check:

This should identify host TCP port 8080.

The docker port command is specifically documented for inspecting published port mappings.

Docker Docs

Step 20: Verify the configured memory limit.

Execute:

Expected:

This confirms the configured 256 MiB limit.

You can also examine runtime resource usage:

This displays the current memory consumption and configured memory limit.

An illustrative result might show:

The actual usage depends on the application.

Step 21: Verify the automatic restart policy.

Execute:

Expected output:

This confirms that the Docker container has the required restart policy.

If an otherwise correctly configured container was created without that setting, the restart policy can be corrected using:

There is no need to recreate the container solely to change its restart policy.

Docker Docs

Step 22: Ensure Docker itself starts at boot.

A container restart policy works when the Docker daemon is running.

Check whether the Docker service is enabled:

Expected:

On Ubuntu, Docker is commonly enabled to start automatically at boot.

If it is disabled, execute:

Where containerd.service is installed and is part of the Docker Engine setup, verify that its startup configuration is appropriate as well.

Docker's official Linux post-installation documentation recommends enabling Docker and containerd services for boot-time startup on systemd-based systems when they are not already enabled.

Docker Docs

Step 23: Test the application through host port 8080.

If the Dockerfile starts an HTTP application on port 80, execute:

A valid HTTP response confirms that the host's published port can reach the containerized application.

For example:

The actual response code depends on the application's configuration.

An HTTP response is an application-level test. The Docker task itself requires the port mapping to be configured correctly, so do not confuse an application error with an incorrect port-publishing setting without further investigation.

Step 24: Troubleshoot a container that exits unexpectedly.

If the container does not remain running, execute:

Check its current state.

Then inspect its logs:

Common causes of immediate container exit include:

An invalid startup command.

A missing application dependency.

An application configuration error.

Failure of the image's main process.

Memory exhaustion.

Do not assume that --restart=always repairs application failures.

Docker's restart policy takes effect after a container has started successfully, with Docker documenting a minimum successful startup period of approximately ten seconds before restart monitoring applies.

Objective: Configure persistent Linux resource limits for the existing user james, ensuring that:

The hard process limit is 32768.

The soft process limit is 16384.

The limits are applied when the user starts a new PAM-managed login session.

The configuration remains available after a system reboot.

The appropriate solution uses Linux-PAM's resource-limit configuration, typically in /etc/security/limits.d/.

The official Linux-PAM documentation specifies the configuration syntax and confirms that nproc is the resource identifier for process limits.

Step 1: Connect to the correct Linux server.

The video specifies host lfcs00089.

From the candidate terminal, execute:

ssh lfcs00089

This establishes an SSH session with the designated server.

All subsequent configuration changes must be performed on this host.

Step 2: Verify that the user james exists.

Execute:

id james

This displays the user's UID, primary group and supplementary group memberships.

Example output:

uid=1001(james) gid=1001(james) groups=1001(james)

The numeric identifiers may differ on the actual server.

You can also check the account database:

getent passwd james

The task specifies an existing user, so there is no need to create a new account or modify the user's password.

Step 3: Understand soft and hard process limits.

Linux implements process-related resource restrictions using RLIMIT_NPROC.

Limit

Required value

Purpose

Soft

16384

Default process/thread creation limit enforced for the user's processes

Hard

32768

Maximum value to which an unprivileged user may raise the soft limit

The hard limit must be at least as large as the soft limit. Here:

\[ 16384 \leq 32768 \]

Therefore, the requested configuration is valid.

On Linux, RLIMIT_NPROC actually accounts for processes and threads associated with the real user ID, subject to kernel privilege exceptions. It is not a separate allowance for every running application.

Step 4: Inspect any existing persistent limits.

Before changing the system, execute:

sudo cat /etc/security/limits.conf

Then list any existing supplemental configuration files:

sudo ls -la /etc/security/limits.d/

Search specifically for process-limit settings:

sudo grep -RnsE \

'^[[:space:]]*([^#[:space:]] +[[:space:]]+)+(soft|hard|-)[[:space:]] +nproc' \

/etc/security/limits.conf /etc/security/limits.d/ 2 > /dev/null

Also check for any existing entries concerning james:

sudo grep -RnsE '^[[:space:]]*james[[:space:]] ' \

/etc/security/limits.conf /etc/security/limits.d/ 2 > /dev/null

These checks help identify existing user-specific limits and avoid contradictory configuration entries.

Step 5: Understand the persistent configuration locations.

The primary resource-limit configuration file is:

/etc/security/limits.conf

Additional administrator-defined limits can be stored under:

/etc/security/limits.d/

Both locations are supported by Linux-PAM.

The configuration format is:

< domain > < type > < item > < value >

For this task:

Field

Required value

Description

Domain

james

Existing username

Type

soft or hard

Which resource limit to configure

Item

nproc

Number of processes/threads

Value

16384 or 32768

Required limit

A dedicated configuration file is preferable because it keeps the account-specific policy separate from the system's general resource-limit settings.

Step 6: Create the persistent configuration file.

Execute:

sudo nano /etc/security/limits.d/90-james-nproc.conf

This opens a new configuration file.

If the file already exists, inspect its contents before modifying it.

Step 7: Add the required soft and hard process limits.

Insert the following two lines:

james soft nproc 16384

james hard nproc 32768

This is the exact configuration required for the task.

Explanation of the first line:

james soft nproc 16384

james selects the target user.

soft specifies the default soft resource limit.

nproc refers to the process/thread limit.

16384 establishes the required soft value.

Explanation of the second line:

james hard nproc 32768

james selects the same user.

hard specifies the hard resource limit.

nproc identifies the resource.

32768 establishes the maximum hard value.

These settings apply specifically to james rather than all users.

The Linux-PAM manual explicitly supports user-specific soft and hard nproc entries.

Step 8: Save the configuration.

If using Nano:

Press Ctrl + O to save.

Press Enter to confirm the filename.

Press Ctrl + X to exit.

If using Vim:

Press Esc.

Type :wq.

Press Enter.

The file should be located at:

/etc/security/limits.d/90-james-nproc.conf

Step 9: Verify the saved configuration.

Execute:

sudo cat /etc/security/limits.d/90-james-nproc.conf

Expected output:

james soft nproc 16384

james hard nproc 32768

Check the file permissions:

ls -l /etc/security/limits.d/90-james-nproc.conf

A typical configuration file has permissions of 644 and is owned by root.

If the file permissions are incorrect, restore appropriate permissions:

sudo chmod 644 /etc/security/limits.d/90-james-nproc.conf

The file should be readable by the PAM module when login sessions are established.

Step 10: Verify that PAM applies resource limits.

The settings are interpreted by the PAM module:

pam_limits.so

Check whether the module is configured:

sudo grep -Rns 'pam_limits.so' /etc/pam.d/

A relevant configuration entry resembles:

session required pam_limits.so

session identifies the PAM session-management phase.

required means the module must succeed for the relevant PAM operation to succeed.

pam_limits.so applies the configured resource limits when the session is established.

The official Linux-PAM documentation confirms that this module applies resource limits to user sessions.

On Ubuntu, inspect the PAM configuration used by the relevant login method, including sshd, login, su, and any referenced common-session files.

Do not blindly add duplicate pam_limits.so entries. If the module is absent from the actual login path, configure it appropriately before testing.

Step 11: Understand when the changes take effect.

The limits defined in /etc/security/limits.d/90-james-nproc.conf are persistent settings, but they are not automatically applied to every currently running process.

Linux-PAM applies these limits when an applicable new login session begins.

Therefore:

Existing sessions may retain their previous limits.

New PAM-managed sessions can receive the new values.

Changes survive reboot because the configuration is stored on disk.

There is no need to restart the entire operating system simply to load the configuration.

The Linux-PAM manual specifically explains that configured resource limits are applied per login session.

Step 12: Start a fresh session as james.

If you have administrative access, you can attempt to create a new login session with:

sudo su - james

This starts a login-style shell using the su PAM service, provided that service is configured to apply PAM resource limits.

Alternatively, open a new SSH login as james, using the account's existing credentials if permitted:

ssh james@localhost

A fresh SSH login is particularly useful if the actual login service is the intended target of the configuration.

Check the active user:

whoami

Expected:

james

Do not assume that simply running sudo -u james ulimit ... is a valid test. ulimit is a shell builtin, and changing the execution user does not necessarily create a PAM session or apply its resource-limit policy.

Step 13: Verify the soft process limit.

Inside the new login session belonging to james, execute:

ulimit -Su

ulimit displays or controls process resource limits.

-S selects the soft limit.

-u selects the maximum process/thread resource limit.

Expected output:

16384

This confirms that the session received the required soft limit.

Step 14: Verify the hard process limit.

In the same session, execute:

ulimit -Hu

-H selects the hard limit.

-u selects the process/thread resource limit.

Expected output:

32768

The GNU Bash manual confirms that -S and -H distinguish soft and hard limits, and that -u refers to the maximum number of processes available to a user.

Step 15: Verify both limits together.

Execute:

printf 'Soft limit: '

ulimit -Su

printf 'Hard limit: '

ulimit -Hu

Expected output:

Soft limit: 16384

Hard limit: 32768

This is the most direct practical verification of the two requested values.

Step 16: Verify the kernel's process-limit information.

Linux also exposes resource limits through the /proc filesystem.

Inside the new james session, execute:

cat /proc/self/limits

Find the line:

Max processes

The relevant values should be:

Limit Soft Limit Hard Limit

Max processes 16384 32768

The displayed output contains additional columns and other resource limits, but the Max processes entry is the one relevant to this task.

For a more concise check, execute:

grep 'Max processes' /proc/self/limits

Expected values:

Max processes 16384 32768

You can also use:

prlimit --pid $$

This displays resource limits for the current shell process.

Step 17: Check for conflicting limits if the values are incorrect.

If the new session does not show the required values, investigate rather than repeatedly adding duplicate configuration entries.

First, inspect user-specific rules:

sudo grep -Rns 'james' \

/etc/security/limits.conf /etc/security/limits.d/

Next, inspect all process-limit rules:

sudo grep -Rns 'nproc' \

/etc/security/limits.conf /etc/security/limits.d/

Then check whether pam_limits.so is active in the login method used for testing.

Potential reasons for an unexpected value include an overriding limits configuration, a session started without PAM resource-limit processing, or resource limits imposed by a systemd-managed service.

If the user runs an application under a systemd service, systemd's LimitNPROC= setting may also be relevant. However, configuring a systemd service is not required by the task.

Step 18: Verify persistence.

The persistent configuration resides at:

/etc/security/limits.d/90-james-nproc.conf

Execute:

sudo cat /etc/security/limits.d/90-james-nproc.conf

Expected:

james soft nproc 16384

james hard nproc 32768

Because this configuration is stored under /etc, it remains present after the system reboots unless it is changed or removed.

For end-to-end verification, start a fresh login session after reboot and repeat:

ulimit -Su

ulimit -Hu

Expected:

16384

32768

A reboot is not necessary for normal verification, and should not be performed unnecessarily during the LFCS exam.

Step 19: Confirm that unrelated users remain unchanged.

The file contains rules for:

james

It does not use the wildcard:

*

Therefore, this particular configuration does not apply indiscriminately to all users.

Avoid adding entries such as:

* soft nproc 16384

* hard nproc 32768

Those would impose the specified limits more broadly, instead of targeting the user named in the task.

Step 20: Perform final verification.

The final configuration must satisfy all requirements:

Requirement

Expected result

Existing user

james

Resource type

nproc

Soft limit

16384

Hard limit

32768

Persistent configuration

Present

Fresh login session

Correct limits applied

Other users

No unnecessary changes

Final Solution

The essential commands are:

Copy commands

# Connect to the correct server

ssh lfcs00089

# Verify the user exists

id james

# Create the persistent resource-limit configuration

printf '%s\n' \

'james soft nproc 16384' \

'james hard nproc 32768' | \

sudo tee /etc/security/limits.d/90-james-nproc.conf

# Verify the configuration

sudo cat /etc/security/limits.d/90-james-nproc.conf

# Confirm PAM resource-limit integration

sudo grep -Rns 'pam_limits.so' /etc/pam.d/

# Start a new PAM-managed login session

# (provided the su PAM stack applies pam_limits)

sudo su - james

# Verify the soft limit

ulimit -Su

# Verify the hard limit

ulimit -Hu

# Verify through procfs

grep 'Max processes' /proc/self/limits

The required configuration is:

james soft nproc 16384

james hard nproc 32768

Technical Verification and References

Linux-PAM limits.conf(5) — Confirms the configuration file syntax and nproc resource identifier.

Linux-PAM pam_limits(8) — Explains how limits are applied when PAM sessions are established.

GNU Bash — ulimit — Documents soft and hard resource-limit verification.

Linux getrlimit(2) — Defines the kernel's process-limit behavior.

Video verification finding: At approximately 29:01–29:05, Question 9 appears with host lfcs00089. The recording shows the full task statement but does not demonstrate the required configuration being completed. The solution above is independently validated against Linux-PAM documentation.

Expected result: User james receives a soft process limit of 16384 and a hard process limit of 32768 in applicable new login sessions. The settings are stored persistently and remain configured after reboot.

Objective: Identify which Linux block device is experiencing excessive write activity, determine the user process generating that activity, terminate the offending process, and unmount the affected filesystem.

The solution requires four main operations:

Examine block-device read/write statistics.

Identify the process responsible for the heavy disk writes.

Terminate the identified process.

Unmount the filesystem associated with the affected block device.

The video provides useful evidence about the responsible process.

Findings from the video

Required host

lfcs00099

Process generating heavy writes

batches

Observed process ID

891

Process owner

root

Observed write rate Approximately 1,200 KiB/s in one sample

Mountpoint acted on in video

/media/batches

The recording shows batches as the principal writer and the candidate subsequently unmounting /media/batches. However, the original block-device name is not established clearly enough to quote as an exact device path. The solution below includes the commands needed to confirm that mapping.

Step 1: Connect to the correct Linux server.

The video specifies host lfcs00099.

Execute:

ssh lfcs00099

All diagnostic commands, process termination and unmounting must be performed on this host.

Step 2: Examine all available block devices.

Execute:

lsblk

For a more informative output:

lsblk -p -o NAME,TYPE,SIZE,FSTYPE,MOUNTPOINTS

Column

Purpose

NAME

Absolute block-device path

TYPE

Disk, partition, or logical device

SIZE

Device capacity

FSTYPE

Filesystem type

MOUNTPOINTS

Where the device's filesystem is mounted

An illustrative output might be:

NAME TYPE SIZE FSTYPE MOUNTPOINTS

/dev/sda disk 40G

└─/dev/sda1 part 40G ext4 /

/dev/sdb disk 10G

└─/dev/sdb1 part 10G ext4 /media/batches

/dev/sdc disk 20G

└─/dev/sdc1 part 20G ext4 /media/data

This output is an example, not confirmed device assignments from the video.

Do not assume that /dev/sdb1 is the affected device until the actual machine's storage configuration is inspected.

Step 3: Identify the block device experiencing excessive writes.

Use iostat, which is part of the sysstat utilities.

Execute:

iostat -dx 1 5

-d displays block-device activity.

-x enables extended I/O statistics.

1 specifies a one-second sampling interval.

5 requests five reports.

The command displays measurements for each block device.

Pay particular attention to:

Metric

Meaning

w/s

Write requests completed per second

wkB/s

Kilobytes written per second

w_await

Average time spent completing write requests

%util

Percentage of elapsed time during which the device had I/O requests

A device with unusually high sustained write throughput compared with the other devices is a candidate for the problematic storage workload.

An illustrative comparison:

Device r/s w/s rkB/s wkB/s %util

sda 2.00 1.00 8.00 4.00 1.00

sdb 0.00 250.00 0.00 1200.00 95.00

sdc 1.00 4.00 4.00 16.00 3.00

In this example, sdb deserves investigation.

High %util by itself does not establish a device fault, especially on modern parallel-I/O storage. Evaluate write throughput, latency and workload together. The official sysstat documentation defines these metrics.

GitHub

Step 4: Identify which user process is causing the write load.

The recording uses iotop to monitor process-level disk activity.

Execute:

sudo iotop

For a view restricted to processes currently performing I/O:

sudo iotop -oP

-o shows processes actively performing I/O.

-P presents process-level information rather than individual threads.

iotop displays process IDs, owners, disk-read rates, disk-write rates and command names.

The important columns are:

TID PRIO USER DISK READ DISK WRITE COMMAND

The task concerns heavy writes, so focus on DISK WRITE, not DISK READ.

The official iotop manual confirms that these measurements represent process-level I/O activity.

Linux manual page

Step 5: Identify the offending process from the video.

At approximately 32:45–33:25 in the recording, the terminal shows iotop output with processes including:

PID USER DISK READ DISK WRITE COMMAND

891 root 0 B/s ~1200 KiB/s batches

927 root ~1200 KiB/s 0 B/s ingest

909 root ~20 KiB/s ~20 KiB/s data

944 root ~20 KiB/s ~20 KiB/s export

These are rounded observations from the displayed sampling interval, not fixed process characteristics.

The important distinction is that ingest is responsible mainly for read activity in the observed samples, whereas batches is the dominant writer.

Therefore, the process to investigate and terminate is batches, observed as PID 891.

PIDs are assigned dynamically and must be checked on the live system before termination.

Step 6: Verify the identity of the process.

On the exam host, execute:

ps -p 891 -o pid,ppid,user,comm,args

For the recorded session, the command should identify batches if PID 891 is still assigned to the same process.

The ps output displays:

PID: process identifier.

PPID: parent process identifier.

USER: account that owns the process.

COMMAND/ARGS: executable name and command-line arguments.

If the PID is different in a fresh session, substitute the PID obtained from iotop.

Do not terminate PID 891 blindly on another system.

Step 7: Verify the process's actual write activity.

Linux exposes per-process I/O statistics through:

/proc/PID/io

For the observed PID:

sudo cat /proc/891/io

The output includes fields such as:

rchar:

wchar:

syscr:

syscw:

read_bytes:

write_bytes:

cancelled_write_bytes:

The write_bytes field reports bytes attributed to the process as writes to the storage layer.

You can inspect the relevant fields:

sudo grep -E 'read_bytes|write_bytes' /proc/891/io

Take two measurements several seconds apart to determine whether write activity is increasing.

The Linux kernel's /proc/PID/io documentation describes these counters and their limitations.

Linux manual page

Step 8: Identify the filesystem being written to by batches.

Execute:

sudo lsof -p 891

lsof lists open files associated with the selected process.

Look for open files located under the affected mountpoint.

For example, paths might begin with:

/media/batches/

If the process has an open writable file on /media/batches, that supports the connection between the observed write activity and this filesystem.

Be aware that lsof lists open resources; not every open file is necessarily responsible for the observed write rate.

Cross-check with block-device I/O measurements.

Step 9: Identify the actual block device mounted at /media/batches.

Execute:

findmnt --mountpoint /media/batches

For concise output:

findmnt -no SOURCE,FSTYPE,TARGET --mountpoint /media/batches

This displays the filesystem source and mountpoint.

For example:

/dev/sdb1 ext4 /media/batches

If this is the output, the block-device path is /dev/sdb1.

This is illustrative. The actual block device must come from the exam host.

Also verify the mapping through:

lsblk -p -o NAME,TYPE,FSTYPE,MOUNTPOINTS

The official findmnt(8) manual documents using --mountpoint to inspect the filesystem mounted at a particular directory.

Linux manual page

Step 10: Confirm that the identified device is responsible for the heavy write activity.

Compare the block device reported by findmnt with the output of:

iostat -dx 1 5

You should now have both pieces of information required by the first part of the task:

The block device experiencing the heavy writes.

The responsible process.

For the recorded scenario, the process evidence points to batches, and the candidate's selected target is /media/batches.

If the block-device statistics instead identify another device, investigate the discrepancy before terminating anything.

Step 11: Check whether the offending process is still running.

Execute:

ps -p 891

Or, using the PID obtained from the current investigation:

ps -p PID -o pid,user,comm,args

Replace PID with the actual current process ID.

Confirm the command name and owner one final time immediately before sending a termination signal.

Step 12: Terminate the process gracefully.

The recommended first attempt is:

sudo kill -TERM 891

This sends SIGTERM to the observed process.

SIGTERM requests an orderly shutdown and allows applications to perform cleanup operations.

Check whether the process has stopped:

ps -p 891

The official Linux kill(1) manual recommends attempting SIGTERM before SIGKILL when possible.

Linux manual page

Step 13: Forcefully terminate the process only if required.

The candidate in the video uses:

sudo kill -9 891

This sends SIGKILL, which terminates the process without allowing it to handle the signal.

The equivalent named-signal command is:

sudo kill -KILL 891

This is technically valid if the process cannot be stopped normally.

However, it is preferable to attempt SIGTERM first, because abruptly killing a writer may interrupt in-progress writes or application cleanup.

For the recorded process, PID 891 is the primary target. The video additionally shows the candidate killing PIDs 909 and 944, but those processes display much lower write activity. Their termination is not justified solely by the task evidence.

Step 14: Verify the offending process has stopped.

Execute:

ps -p 891 -o pid,comm

If the process has fully exited, it should no longer appear as an active process.

You can also inspect:

sudo iotop -oP

The batches process should no longer be generating disk writes.

If the process has restarted automatically with a new PID, investigate its parent process or service rather than relying on the original PID.

Step 15: Inspect remaining users of the affected filesystem.

Before unmounting, execute:

sudo fuser -vm /media/batches

This identifies processes accessing files on the filesystem.

The options mean:

-v: display verbose information.

-m: identify processes accessing the specified mounted filesystem.

The fuser documentation describes this behavior.

Linux manual page

Review the output.

If unrelated processes still need the filesystem, determine whether they can safely stop accessing it. Do not kill every listed process indiscriminately.

Step 16: Unmount the affected filesystem.

Once the offending process has stopped and the filesystem is no longer busy, execute:

sudo umount /media/batches

This is the unmount operation shown in the recording.

sudo provides administrative privileges.

umount detaches a mounted filesystem from the Linux directory hierarchy.

/media/batches identifies the target mountpoint.

The official umount(8) manual confirms that specifying the mountpoint is the normal way to unmount a filesystem.

Linux manual page

Step 17: Handle a busy filesystem if necessary.

If the command reports:

umount: /media/batches: target is busy

it means the filesystem is still being used.

Recheck:

sudo fuser -vm /media/batches

Also inspect:

sudo lsof +f -- /media/batches

A process may have open files, memory mappings, or its working directory on that filesystem.

Close those references appropriately and retry:

sudo umount /media/batches

Do not immediately force or lazily unmount the filesystem.

A lazy unmount can hide an ongoing problem by detaching the mountpoint while references to the filesystem remain. The official umount documentation warns about this distinction.

Linux manual page

Step 18: Verify the filesystem is unmounted.

Execute:

findmnt --mountpoint /media/batches

A successful unmount should result in no matching mount being displayed.

For an additional check:

mountpoint -q /media/batches

echo $?

A nonzero exit status indicates that the directory is not currently a mountpoint.

Also inspect:

lsblk -p -o NAME,TYPE,FSTYPE,MOUNTPOINTS

The affected filesystem should no longer list /media/batches as an active mountpoint.

Step 19: Verify that the excessive write activity has stopped.

Execute:

iostat -dx 1 5

Compare the affected device's write statistics against the measurements recorded before termination.

Also execute:

sudo iotop -oP

Confirm that the original heavy-writing process is no longer active.

Other normal system processes may continue performing I/O. The requirement is to eliminate the problematic workload and unmount its affected device, not to reduce all system writes to zero.

Step 20: Avoid unnecessary modifications to other devices.

The video shows the candidate issuing additional commands involving /media/data and other processes.

Those actions should not automatically be repeated.

The task asks for the block device under heavy write load and the process causing that load.

Unless measurements establish that several devices are affected, there is no reason to unmount unrelated filesystems.

In particular, do not use:

sudo umount -a

This attempts to unmount multiple filesystems and is inappropriate for a targeted storage operation.

Also do not reformat, repartition or remove the affected block device.

Unmounting does not delete the data stored on the filesystem.

Step 21: Consider whether automatic remounting is configured.

Unmounting /media/batches changes the current mounted state, but it does not necessarily prevent the filesystem from being mounted again after a reboot.

For example, the filesystem may be configured through /etc/fstab or a systemd mount unit.

Inspect relevant configuration if the requirement is specifically to keep the device unmounted across restarts:

findmnt --fstab

However, the task instructs you to unmount the device, not explicitly to remove persistent mount configuration.

Do not alter /etc/fstab or disable unrelated services without a demonstrated requirement.

Step 22: Perform final verification.

Execute:

ps -p 891 -o pid,comm

findmnt --mountpoint /media/batches

lsblk -p -o NAME,TYPE,FSTYPE,MOUNTPOINTS

iostat -dx 1 3

If PID 891 is the same offending process observed in the recording and /media/batches is confirmed as its affected filesystem, the expected result is:

Requirement

Expected result

Correct host

lfcs00099

Heavily written block device

Identified using iostat and lsblk

Responsible process

batches

Observed PID

891

Process owner

root

Process terminated

Yes

Affected mountpoint

/media/batches

Filesystem unmounted

Yes

Original excessive write activity

No longer present

Final Solution

The following is the focused command sequence for the scenario shown in the video.

# Connect to the designated server

ssh lfcs00099

# Inspect block devices and mounted filesystems

lsblk -p -o NAME,TYPE,SIZE,FSTYPE,MOUNTPOINTS

# Identify the device under heavy write load

iostat -dx 1 5

# Identify the process generating disk writes

sudo iotop -oP

# Confirm the process identity

# Video PID 891; verify the live PID before proceeding

ps -p 891 -o pid,ppid,user,comm,args

# Inspect files opened by the process

sudo lsof -p 891

# Confirm the affected block-device mapping

findmnt -no SOURCE,FSTYPE,TARGET \

--mountpoint /media/batches

# Request orderly termination

sudo kill -TERM 891

# Confirm the process stopped

ps -p 891

# Check remaining filesystem users

sudo fuser -vm /media/batches

# Unmount the affected filesystem

sudo umount /media/batches

# Verify the filesystem is no longer mounted

findmnt --mountpoint /media/batches

# Verify block-device mount status

lsblk -p -o NAME,TYPE,FSTYPE,MOUNTPOINTS

# Check write activity again

iostat -dx 1 3

If normal termination fails and the process is still confirmed to be the same offending workload, use:

sudo kill -KILL 891

Then recheck the process state and retry the unmount.

Technical Verification and References

The procedure has been checked against the following upstream Linux and sysstat documentation:

sysstat iostat Manual

— Measuring block-device I/O activity and write throughput.

Linux iotop(8)

— Identifying processes performing heavy disk I/O.

Linux findmnt(8)

— Identifying filesystem sources and mountpoints.

Linux kill(1)

— Terminating processes using signals.

Linux fuser(1)

— Identifying processes using mounted filesystems.

Linux umount(8)

— Safely detaching filesystems.

Video verification findings

At approximately 32:40–34:15, Question 16 appears on host lfcs00099. The recording shows iotop identifying batches (PID 891, owned by root) as the process producing the dominant write activity.

The candidate then runs:

sudo kill -9 891

sudo umount /media/batches

Both commands are technically valid for their respective operations. However, the recording does not provide a sufficiently clear device-to-mountpoint mapping to certify the actual block-device path. It also shows additional process terminations and unmounts that are not established as necessary by the write measurements.

Expected result: The high-write-load block device is identified, the batches process responsible for the excessive writes is terminated, and its associated filesystem at /media/batches is unmounted after confirming the device mapping. Unrelated processes and storage devices remain unaffected.

next last task now please

Worked for 2m 32s