Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
System Administration
TheoryBeginner11 minLog Analysis

Packages, Storage & Filesystems

What is it?

A package manager (apt, dnf) installs, updates and removes software with dependencies. Storage is disks partitioned into filesystems mounted at paths; df shows usage, mount shows what is mounted where.

Why it matters

Software and disks are the two most common operational failures: an unpatched package is a vulnerability, and a full disk stops services and logging silently.

Where you see it

`apt update && apt upgrade` patches; `df -h` shows free space; `du -sh *` finds what is large; `/etc/fstab` defines mounts at boot.

What normal looks like

Packages current, disks well under full, mounts matching fstab, /var/log rotating so it never fills the disk.

What suspicious looks like

A disk at 100% (df shows 100% on /var), an outdated package with a known CVE, or a mount missing after reboot because fstab is wrong.

How analysts investigate

For 'out of space' run df -h then du to find the culprit; for software issues check installed version vs available; for a missing mount check fstab and dmesg.

Common beginner mistakes

  • Deleting files blindly to free space instead of finding the large offender with du.
  • Editing fstab wrong so the box won't boot — always keep a known-good copy.

Keep it patched and keep it free

  df -h
    /dev/sda1  20G  20G  0  100%  /var   ← FULL: services fail, logs stop
  du -sh /var/log/*  | sort -h
    9.8G  /var/log/app/verbose.log        ← the culprit
  → rotate/compress the log + fix the app, don't blind-delete
A full disk (df) is found and fixed by locating the large consumer (du), not by blind deletion.

Quick check

A service stopped and /var is at 100%. Best move?

A quick self-check — it doesn't affect your XP or progress.

Sign in to save your progress on the server.