Practice area
LPIC-1 101: Devices, Filesystems, and FHS
Read storage, mount, inode, permission, ownership, link, archive, and filesystem layout evidence before making data-affecting changes.
Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.
Source status
Source status: LPI LPIC-1 overview verified July 3, 2026. Current version 5.0; exams 101-500 and 102-500.
This page paraphrases study areas into command practice. It does not copy official objective text wholesale and is not an exam dump.
Plain-English goal
Practice area: partitions, filesystems, swap, mounts, quotas, permissions, links, archives, and filesystem layout. Exam/domain: 101-500.
read the situation
Command, output, and next step
Command anatomy
df -h && df -idf- summarize filesystem pressure
-h- human-readable byte usage
-i- inode usage instead of bytes
target- scope the question to a mount point
Annotated output
Filesystem Size Used Avail Use% Mounted on
/dev/nvme0n1p2 40G 39G 220M 100% /
/dev/nvme0n1p3 200G 82G 118G 42% /home
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/nvme0n1p2 2621440 2621400 40 100% /
4.0K /var/tmp
180M /var/log
2.8G /var/libWhat to notice
- filesystem
- the device or volume under pressure
- mounted on
- the scope of the problem
- Use%
- byte pressure
- IUse%
- inode pressure
- Avail/IFree
- how much room remains
- /var child
- which top-level directory is growing inside the likely hot path
Safe vs unsafe move
Common wrong move
Cleaning /home when / is the full filesystem.
Next safe command
sudo find /var -xdev -type f -size +100M -printf '%s %p\n' 2>/dev/null | sort -nr | headTroubleshooting ladder
- Name the symptom.
- Inspect read-only state.
- Find the owner, service, file, device, mount, or route.
- Read the decisive output field.
- Choose the next narrow command.
- Avoid broad or destructive changes.
- Make the smallest justified change if required.
- Verify and record what changed.
How to get help
- Know the commandUse
command --help, thenman commandfor the full reference. - Know the conceptUse
apropos keywordorman -k keywordto discover command names. - Maybe a shell builtinUse
type command,command -V command, thenhelp command. - Service behaviorUse
systemctl status serviceandjournalctl -u servicebefore restarting. - Package ownershipUse
dpkg -S,rpm -qf, or the distro package tool for the installed file.
Study plan
- Separate disk, partition, filesystem, mount point, and directory path; explain each before changing any of them.
- Practice byte and inode checks, same-filesystem scans, open deleted file checks, and safe cleanup decision paths.
- Inspect permissions from the root of the path to the final file; then reason about owner, group, mode, umask, and special bits.
- Use archives and compression as read-first skills: list contents, inspect paths, verify before extracting, and avoid writing outside a sandbox.
Command labs
Run these in a lab shell or disposable machine first. The point is to explain the output, not just memorize the command.
Prove full bytes vs full inodes
df -h && df -iByte use and inode use should be read separately; either can block writes.
Annotated output
Filesystem Size Used Avail Use% Mounted on
/dev/nvme0n1p2 40G 39G 220M 100% /
/dev/nvme0n1p3 200G 82G 118G 42% /home
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/nvme0n1p2 2621440 2621400 40 100% /
4.0K /var/tmp
180M /var/log
2.8G /var/libWhat to notice: filesystem, mounted on, Use%, IUse%, Avail/IFree, /var child.
Next safe command: sudo find /var -xdev -type f -size +100M -printf '%s %p\n' 2>/dev/null | sort -nr | head
Inspect path permissions
namei -l /srv/app/current/.env 2>/dev/null || true; stat -c '%A %U:%G %n' /srv/app/current 2>/dev/null || trueDirectory traversal and target permissions should reveal the exact access barrier.
Annotated output
f: /srv/app/current/.env
drwxr-xr-x root root /
drwxr-xr-x root root srv
drwxr-x--- deploy www-data app
drwxr-x--- deploy www-data current
-rw------- deploy deploy .env
uid=33(www-data) gid=33(www-data) groups=33(www-data)What to notice: each path segment, mode, owner/group, effective user.
Next safe command: systemctl show nginx -p User -p Group
List archive before extraction
tar -tzf backup.tar.gz | sed -n '1,40p'Archive paths should be reviewed before writing files to disk.
Annotated output
Usage: command [OPTION]... TARGET
Try 'command --help' for common flags.
Try 'man command' for full reference.What to notice: Usage, --help, man.
Next safe command: command --help
command families
Commands to practice
lsblkblkidmkfsmkswapfsckdfdufindmntmountchmodchownumasklnstatnameitargzipxzzip
Related drills
Flashcards
Why can df -h look fine while writes fail?
The filesystem may be out of inodes even when free bytes remain.
What does -xdev protect during find or du?
It keeps the scan on one filesystem and avoids mounted backups or network paths.
What is the safest first archive command?
List contents before extraction, especially when paths or ownership may surprise you.
Why use namei -l for permission denied?
Directory traversal permissions can block access even when the final file mode looks correct.
safe first command
A host says `No space left on device`. What two checks should come before cleanup?
Run `df -h` for byte pressure and `df -i` for inode pressure. They answer different failure modes.
A filesystem can have free bytes and still fail writes when inodes are exhausted.
expected output field
Which `df` column tells you the affected mount point?
`Mounted on` tells you where the full filesystem is attached. Clean the pressured mount, not a random large-looking directory elsewhere.
This prevents deleting from `/home` when `/` is the problem.
flag meaning
What does `-xdev` protect during `find` or `du`?
It keeps the scan on one filesystem so you do not cross into backups, network mounts, containers, or other mounted trees.
Scope protects performance and prevents misleading results.
dangerous wrong move
Why not extract an archive before listing it?
Archive paths, ownership, and file names may surprise you. Use `tar -tf` or `tar -tzf` first.
Listing is the read-only proof step.
next diagnostic step
`namei -l` shows a parent directory missing execute permission. What does that prove?
The user cannot traverse the path even if the final file looks readable.
Fixing only the final file mode would miss the real blocker.
help command
You need to know whether `find -xdev` is supported. What local help fits?
Run `find --help` for a quick check and `man find` for details and portability notes.
Help commands are part of the practice loop, not a last resort.
command purpose
What does `findmnt -T /var` answer better than `df` alone?
It maps a path to the filesystem/mount that owns it, which helps connect a symptom path to the right mount point.
Use it when the target path may sit on a separate mount.
Quick quiz
Check the reasoning locally in your browser. Answers are not sent anywhere.
interactive permissions
Permission mode simulator
Toggle read, write, and execute bits. The symbolic and octal modes update locally in your browser.