$ Linux One Liners
Back to cert prep

Practice area

LFCS Storage

Identify disk, inode, mount, backup, and restore evidence before removing or changing data.

Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.

Source status

Source status: Linux Foundation LFCS page verified June 30, 2026. LFCS is an online, proctored, performance-based command-line exam.

This page paraphrases study areas into command practice. It does not copy official objective text wholesale and is not an exam dump.

Plain-English goal

Practice area: storage. Exam/domain: LFCS.

read the situation

Command, output, and next step

Command anatomy

df
df
summarize filesystem pressure
-h
human-readable byte usage
target
scope the question to a mount point

Annotated output

Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme0n1p2   40G   39G  220M 100% /
/dev/nvme0n1p3  200G   82G  118G  42% /home

4.0K	/var/tmp
180M	/var/log
2.8G	/var/lib

What to notice

filesystem
the device or volume under pressure
mounted on
the scope of the problem
Use%
byte pressure
Avail
how much byte capacity remains
/var child
which top-level directory is growing inside the likely hot path

Safe vs unsafe move

Common wrong move

Cleaning /home when / is the full filesystem.

Next safe command

sudo find /var -xdev -type f -size +100M -printf '%s %p\n' 2>/dev/null | sort -nr | head

Troubleshooting ladder

  1. Name the symptom.
  2. Inspect read-only state.
  3. Find the owner, service, file, device, mount, or route.
  4. Read the decisive output field.
  5. Choose the next narrow command.
  6. Avoid broad or destructive changes.
  7. Make the smallest justified change if required.
  8. Verify and record what changed.

How to get help

  1. Know the commandUse command --help, then man command for the full reference.
  2. Know the conceptUse apropos keyword or man -k keyword to discover command names.
  3. Maybe a shell builtinUse type command, command -V command, then help command.
  4. Service behaviorUse systemctl status service and journalctl -u service before restarting.
  5. Package ownershipUse dpkg -S, rpm -qf, or the distro package tool for the installed file.

performance practice

Timed task cards

LFCS-style practice should reward evidence, small changes, verification, and rollback thinking.

Timed task

Read-only proof task

Task: Prove the current storage state without changing it.

Time: 8 minutes

Allowed first commands: df, du, find, rsync

Pass: You identify the decisive field and can explain normal versus abnormal output.

Fail: You restart, delete, chmod, or edit before proving the state.

Timed task

Smallest safe change task

Task: Name the smallest justified change you would make after the evidence is clear.

Time: 10 minutes

Allowed first commands: status/log/readout command first, change command second

Pass: The change is scoped, reversible, and tied to one output field.

Fail: The change is broad, unverified, or unrelated to the evidence.

Timed task

Verify and rollback task

Task: State the verification command and rollback note for the task.

Time: 6 minutes

Allowed first commands: status, log, route, mount, permission, or package verification

Pass: You can show the before/after signal and explain rollback.

Fail: You cannot prove the task worked or cannot undo the change.

command families

Commands to practice

  • df
  • du
  • find
  • rsync
  • tar

Related command pages

Related drills

Flashcards

timed task

In a storage incident, what must you prove before deleting files?

Prove the affected mount point, whether pressure is bytes or inodes, and which directory is actually hot.

LFCS-style practice rewards proof before action.

safe first command

Why does `df -h && df -i && du -xhd1 /var` make a good first storage drill?

It separates byte pressure, inode pressure, and the top-level `/var` directories without deleting anything.

The command is read-only but can be I/O-heavy, so scope matters.

expected output field

Which fields decide byte pressure versus inode pressure?

`Use%` decides byte pressure. `IUse%` decides inode pressure.

Do not confuse a byte-full filesystem with an inode-full filesystem.

next diagnostic step

Why prefer `sudo find /var -xdev ...` over `find / -xdev ...` here?

The sample already points to `/var`, so the narrower scan answers the question with less noise and less I/O.

Start with the hot path that evidence already named.

dangerous wrong move

Why is `rm -rf /var/cache/*` not a safe first answer?

It assumes the cause and deletes state before proving which directory or file owns the pressure.

Deletion comes after evidence, owner review, and rollback thinking.

verification check

After cleanup, what should you rerun?

Rerun the same `df -h` and `df -i` checks so the before/after fields are comparable.

Verification should use the same decisive fields.

help command

You forgot what `du -d1` means. What should you run?

Run `du --help` or `man du`. `-d1` limits summary depth to one directory level on GNU du.

Know the command, then know how to ask the system for detail.

Quick quiz

Check the reasoning locally in your browser. Answers are not sent anywhere.

Which command pair separates byte pressure from inode pressure?
Show answer

Answer: df -h && df -i

Why: `df -h` shows byte usage and `df -i` shows inode usage, so you know which limit is failing before cleanup.

  • rm -rf /var/cache: Deleting cache first guesses at the fix before proving the affected mount or pressure type.
  • systemctl restart nginx: Restarting a service does not answer a storage pressure question.
  • chmod -R 777 /var: Recursive chmod changes permissions and does not create bytes or inodes.
The output points to `/var` as the hot path. Which next command stays scoped?
Show answer

Answer: sudo find /var -xdev -type f -size +100M -printf '%s %p\n' 2>/dev/null | sort -nr | head

Why: The scoped `find` stays on `/var`, avoids other filesystems with `-xdev`, and lists candidates without deleting them.

  • find / -type f -delete: That deletes files across the filesystem without proving ownership or safety.
  • du -sh /*: That is broader than the evidence requires and can create more I/O noise.
  • mkfs /dev/sda1: Formatting a device destroys data and is never a diagnostic follow-up.
After freeing space, which verification habit is strongest?
Show answer

Answer: Rerun the same `df -h` and `df -i` checks and compare the decisive fields.

Why: Verification should compare the same fields that proved the problem: mount point, `Use%`, and `IUse%`.

  • Assume the shell prompt returning means the incident is fixed.: A completed command is not proof that storage pressure changed.
  • Delete another large directory to be safe.: More deletion without evidence increases risk.
  • Add ads.txt to the site.: ads.txt has nothing to do with Linux storage triage.