Quiz 201-450: LPIC-2 (201)

The correct answers are B. lsof and C. pstree.
Capacity planning involves understanding which processes are running, what they are doing, and how they relate to each other or to system resources. The goal is often to identify resource-intensive or relevant processes before deciding on upgrades, tuning, or scaling.
Why B. lsof is correct:
lsof stands for "list open files." In Linux and Unix systems, everything is treated as a file, including network sockets and device access. lsof helps identify:
- Which processes have specific files open
- Which processes are using certain ports
- Which processes may be holding onto important resources
This makes it very useful when you need to identify processes of interest during capacity analysis.
Why C. pstree is correct:
pstree displays running processes in a tree structure, showing parent-child relationships between processes. This helps you:
- See how processes are organized
- Identify related process groups
- Understand which service or daemon spawned a particular process
This is useful in capacity planning because it helps locate and understand the processes contributing to system load.
Why the other options are incorrect:
A. acpid
acpid is a daemon that handles ACPI events, such as power button presses or hardware power management signals. It is not a tool for listing or identifying processes.
D. telinit
telinit is used to change the runlevel or init state of the system. It is not used for process listing or process identification.
Summary:
For listing and identifying processes of interest in capacity planning, lsof and pstree are the appropriate tools because they help reveal what processes are running and how they are connected to system resources.

The correct answer is D. Processes waiting for IO operations to complete.
In the output from top, the CPU state wa means I/O wait. This is the percentage of time the CPU is idle because it has nothing else to do while waiting for input/output operations to finish. Common causes include:
- Disk reads or writes
- Network file operations
- Waiting on storage devices or other hardware I/O
Why the other options are incorrect:
A. Processes waiting for user interaction.
This refers more to interactive programs or idle user input, not CPU I/O wait time.
B. Processes that were already closed and are waiting to be launched again.
Closed processes do not contribute to CPU wait time. A process that is not running anymore is simply not active.
C. Processes that have not been scheduled yet because they haven't been fully loaded into RAM or are in swap.
This describes memory-related delays or swapping, but wa specifically measures I/O wait, not whether a process is loaded into RAM.
D. Processes waiting for IO operations to complete.
This is exactly what wa represents, so this is the correct choice.
In short, wa in top indicates time spent waiting on I/O, not on user input, process scheduling, or memory loading.

The correct answers are B. us and D. sy.
Here’s why:
In vmstat output, the cpu section contains several columns that describe how the CPU time is being used.
The two relevant columns are:
- us: user time
- This is the percentage of time the CPU spends running non-kernel code.
- “User” means applications and processes outside the operating system kernel.
- sy: system time
- This is the percentage of time the CPU spends running kernel code.
- “System” refers to work done by the Linux kernel itself.
Why the other options are not correct:
- id: idle time
- This is the percentage of time the CPU is not doing anything.
- It does not represent user or kernel execution.
- wa: I/O wait time
- This is the time the CPU spends waiting for I/O operations to complete.
- It is not kernel execution time.
So the columns that match the question are:
- B. us = percent of time running non-kernel code
- D. sy = percent of time running kernel code

The correct answer is A. 0
In vmstat output, the cpu section includes the column wa, which stands for the percentage of CPU time spent waiting for I/O to complete.
The relevant part of the output is:
us sy id wa
0 0 100 0
0 0 100 0
0 0 100 0
0 0 100 0
The wa column is 0 in every sample shown. That means the CPU was not waiting on pending I/O at all during these intervals.
Why the other options are not correct:
- 100 would mean the CPU spent all its time waiting for I/O, which is not shown.
- 35.9, 57.7, and 36.6 are values from other columns such as interrupts or context switches, not CPU I/O wait.
Therefore, the percentage of time the CPU was waiting for pending I/O is 0%.

The correct answers are B. nfsiostat and D. cifsiostat.
The question asks which commands are useful for collecting data about remote filesystem connections. Remote filesystem connections typically refer to network-based filesystems, such as NFS and CIFS/SMB.
B. nfsiostat
nfsiostat is used to monitor NFS I/O statistics. It provides information about NFS client activity, including reads, writes, retransmissions, and other performance data related to NFS-mounted filesystems. Since NFS is a remote filesystem protocol, this command is directly relevant.
D. cifsiostat
cifsiostat is used to report statistics for CIFS/SMB filesystems. CIFS, also known as SMB, is another network filesystem protocol used for remote file sharing. This command helps collect data about CIFS-mounted filesystems, making it also directly relevant.
Why the other options are incorrect:
A. pidstat
pidstat collects process-level statistics such as CPU usage, memory usage, and I/O activity for processes. It is not specifically designed to gather data about remote filesystem connections.
C. sadf
sadf is a reporting tool for data collected by sar/system activity reports. While it can display various performance metrics, it is not a dedicated tool for remote filesystem connections like nfsiostat or cifsiostat.
In summary, the two commands specifically intended for remote filesystem monitoring are:
B. nfsiostat for NFS
D. cifsiostat for CIFS/SMB

The correct answer is A. 1, 5 and 15 minutes.
In Unix-like systems, the load average shown by commands such as uptime or top is typically reported as three numbers. These three values represent the system’s average load over:
1. The past 1 minute
2. The past 5 minutes
3. The past 15 minutes
So in the example:
12:10:05 up 18 days, 19:00, 2 users, load average: 0.47, 24.71, 35.31
the values 0.47, 24.71, and 35.31 correspond to the 1-minute, 5-minute, and 15-minute load averages, respectively.
Why the other options are incorrect:
- B. 1, 15 and 30 minutes
Load average is not commonly reported in this format.
- C. 1, 15, and 30 seconds
System load averages are not measured in seconds.
- D. 15, 30 and 60 minutes
These are not the standard load average intervals.
- E. 15, 30 and 60 seconds
Again, load average is not measured in seconds.
Therefore, A is correct.

The correct answers are A, C, and D.
System sizing for a web server is about determining how much CPU, memory, storage, and network capacity the server will need to handle the expected workload. The main factors that affect sizing are the demand on the server and the type of processing it must perform.
A. How many concurrent users are expected.
This directly impacts system sizing. More concurrent users usually mean more requests, more memory usage, more CPU load, and more network traffic. A web server expected to serve hundreds or thousands of users at the same time needs greater capacity than one serving only a few users.
C. What type of content will be served.
This also affects sizing. Serving static content such as simple HTML files is much less demanding than serving dynamic content, large media files, or database-driven pages. Dynamic content often requires more CPU, memory, and backend resources, while large files increase storage and bandwidth requirements.
D. What scripting languages will the web server support.
This matters because different scripting languages and runtime environments have different resource needs. For example, PHP, Python, Perl, or Node.js-based applications may require additional modules, interpreters, memory, and CPU resources. Some applications are lightweight, while others are much more demanding, so this influences the hardware and software sizing.
Why the other options are incorrect:
B. Which hardware vendor has better Linux support.
This may matter for compatibility or ease of installation, but it does not directly determine the size or capacity requirements of the web server. It is a procurement or compatibility consideration, not a sizing factor.
E. Will the OS install be CD, DVD or network based.
This affects how the operating system is installed, but it does not impact the long-term workload or capacity planning of the web server. It is an installation method choice, not a system sizing factor.
In summary, the correct sizing factors are the expected number of concurrent users, the type of content being served, and the scripting languages or runtime support required.

The correct answer is A. It uses a library of plugins.
collectd is a system statistics collection daemon that gathers performance and monitoring data by loading plugins. These plugins are responsible for collecting different kinds of metrics such as CPU usage, memory consumption, disk activity, network traffic, and more.
Why A is correct:
- collectd is designed in a modular way.
- Each plugin can monitor a specific subsystem or service.
- This plugin-based architecture makes collectd flexible and extensible.
Why the other options are incorrect:
- B is incorrect because collectd does not typically work by having a master server connect to each client and retrieve data.
- C is incorrect because while collectd does gather data locally on each server, the key mechanism is still its plugin system, not simply a generic local collection-and-forward model.
- D is incorrect because collectd does not rely on SNMP queries as its primary mechanism, though it can interact with SNMP through a plugin.
In short, collectd collects monitoring information by using plugins that gather and optionally forward metrics.

The correct answers are C. sar, D. top, and E. vmstat.
Here is why:
C. sar
sar is part of the sysstat package and is used to collect and report system activity information over time. It can display memory-related statistics such as free memory, swap usage, and paging activity.
D. top
top is an interactive monitoring tool that shows real-time system processes and resource usage. It includes memory usage information, such as total, used, free, and cached memory, along with memory consumption by individual processes.
E. vmstat
vmstat reports information about processes, memory, paging, block I/O, traps, and CPU activity. It is commonly used to view memory usage and system memory performance.
Why the others are not correct:
A. mpstat
mpstat is mainly used to report CPU statistics, not memory usage.
B. pstree
pstree shows the process tree in a hierarchical format. It is useful for viewing parent-child process relationships, but it does not measure memory usage.
In summary, sar, top, and vmstat are the tools that provide memory usage information.

The correct answer is B.
Swap space is disk-based virtual memory used when RAM is insufficient. When a system relies heavily on swap, it must move data and processes between RAM and disk much more often. This causes a significant slowdown because disk access is much slower than memory access.
Why B is correct:
- Extensive use of swap usually means the system is under memory pressure.
- The kernel repeatedly pages data in and out of RAM.
- This increases hard disk activity and reduces responsiveness.
- As a result, overall system performance degrades.
Why the other options are incorrect:
- A is incorrect: swap space is not always on the root partition. It can be on a separate partition or a swap file.
- C is incorrect: processes are not permanently confined to either RAM or swap; the kernel manages their movement dynamically. Also, RAM does not become unused for that reason.
- D is incorrect: while memory fragmentation can be a concern in general, “memfrag -d” is not a standard tool or solution for swap-related issues.
- E is incorrect: applications do not need to restart because of swapping. Virtual memory handles relocation transparently.
In short, heavy swap usage mainly hurts performance due to increased disk I/O, which is why B is the best answer.