17 Linux Error Messages Explained: What They Mean and How to Fix Them

Linux error messages are not random warnings or texts intended only for developers. Each one reveals which operation failed, which resource was involved, and why the kernel or application rejected it. Understanding these clues makes troubleshooting faster and prevents administrators from running commands found online without knowing their consequences.

Linux error messages: the key points in 20 seconds

• Most messages identify the command, the affected resource, and the reason for the failure.
• errno describes system call errors, while the exit code indicates whether a command completed successfully.
• Permissions, storage, memory, and networking account for many common incidents.
• Before fixing a problem, it is best to confirm the cause using logs and diagnostic tools.
• Some recovery commands can cause data loss if used without checking the system first.

An experienced administrator does not memorize one solution for every possible message. They first review the context, reproduce the issue when it is safe to do so, and collect evidence using tools such as journalctl, dmesg, ss, lsof, df, or strace.

For example:

cat /etc/shadow
cat: /etc/shadow: Permission denied
Code language: JavaScript (javascript)

The message identifies three elements: cat is the program that failed, /etc/shadow is the requested resource, and Permission denied explains the reason.

How to interpret an error before trying to fix it

Linux reports failures through two related but different mechanisms.

The first is errno, a numeric code returned when a system call fails. Applications usually translate codes such as EACCES, ENOENT, or ENOSPC into human-readable messages.

The second is the command’s exit status. A value of 0 generally indicates that the operation completed successfully, while a non-zero value signals some kind of error.

The exit status of the last command can be checked with:

echo $?
Code language: PHP (php)

This value is especially useful in scripts:

if cp source.txt destination.txt; then
    echo "Copy completed"
else
    echo "Copy failed"
fi
Code language: PHP (php)

Not every non-zero exit code indicates a serious failure. Some tools use them to communicate specific results. grep, for instance, returns 1 when it finds no matches.

The 17 most common Linux error messages

1. Permission denied (EACCES)

The user does not have sufficient permissions to read, modify, or execute the requested resource.

The cause may be traditional Unix permissions, but it can also involve access control lists, SELinux, AppArmor, Linux capabilities, or missing execute permission on one of the directories in the path.

Diagnosis:

ls -la /path/to/file
namei -l /path/to/file
id
getfacl /path/to/file

On systems using SELinux or AppArmor:

ls -Z /path/to/file
getenforce
aa-status

Possible fixes:

chmod u+r file.txt
chmod u+x script.sh
sudo chown user:group file.txt
sudo usermod -aG group user
Code language: CSS (css)

sudo should not be used as an automatic response. It is better to identify which permission is missing and whether the user should actually have it.

2. No such file or directory (ENOENT)

The system cannot find the specified file, directory, or executable.

The path may be wrong, a symbolic link may be broken, the file may have been deleted, or the interpreter defined on the first line of a script may not exist.

Diagnosis:

pwd
ls -la /path/to/file
namei -l /path/to/file
readlink -f /path/to/link
command -v command_name

A file can also be searched for, although running find from / may be slow:

find /reasonable/search/path -name "file.txt" 2>/dev/null
Code language: JavaScript (javascript)

Possible fixes:

cd /correct/directory
mkdir -p /path/to/directory
sudo apt install package
export PATH="$PATH:/path/to/bin"
ln -s /correct/path /path/to/link
Code language: JavaScript (javascript)

3. Command not found

The shell cannot find an executable with that name in the directories listed in PATH.

The program may not be installed, the command name may be misspelled, or a local script may have been launched without specifying its path.

Diagnosis:

command -v command_name
type command_name
printf '%s\n' "$PATH" | tr ':' '\n'
ls -l ./script.sh
Code language: JavaScript (javascript)

Possible fixes:

sudo apt install package
sudo dnf install package
chmod +x script.sh
./script.sh

The current directory is usually not included in PATH for security reasons. That is why ./script.sh is required.

4. Device or resource busy (EBUSY)

The resource is being used by another process and cannot currently be unmounted, deleted, or modified.

This often appears when trying to unmount a filesystem while a process still has files open or is using it as its current working directory.

Diagnosis:

findmnt /mount/point
lsof /mount/point
fuser -vm /mount/point

Possible fixes:

kill PID
umount /mount/point

kill -9 should be reserved for processes that do not respond to a normal termination signal, since it prevents the application from closing files or releasing resources cleanly.

A lazy unmount:

umount -l /mount/point

may be useful in certain situations, but it does not resolve the cause of the filesystem remaining busy.

5. Connection refused (ECONNREFUSED)

The destination system is reachable, but no service is accepting connections on the requested port, or a firewall is explicitly rejecting them.

Diagnosis:

ss -lntup
systemctl status service
nc -vz server 443
journalctl -u service
sudo nft list ruleset
Code language: PHP (php)

Possible fixes:

sudo systemctl start service
sudo systemctl restart service
sudo systemctl enable service

Before opening a port, verify that the service is listening on the correct interface and that exposing it is actually necessary.

6. Disk quota exceeded (EDQUOT)

The user, group, or project has reached its storage or inode quota, even though the filesystem may still have free capacity.

Diagnosis:

quota -s
df -h
df -i
du -sh "$HOME"/*
sudo repquota -a
Code language: JavaScript (javascript)

Possible fixes:

Unnecessary data can be removed, files can be moved to another volume, backup retention can be reduced, or the administrator can be asked to increase the quota.

Before deleting anything, identify what is consuming the space:

du -xhd1 "$HOME" | sort -h
Code language: JavaScript (javascript)

7. Read-only file system (EROFS)

The filesystem is mounted in read-only mode.

This may be intentional, or it may be a protective measure taken by the kernel after detecting storage errors or filesystem corruption.

Diagnosis:

findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS /mount/point
journalctl -k
dmesg | tail -50
lsblk -f

Possible fixes:

If no errors are present and the design allows writing:

sudo mount -o remount,rw /mount/point

If corruption is suspected, do not simply remount it. Stop activity, unmount the volume, and check it using the appropriate tool:

sudo umount /dev/device
sudo fsck /dev/device

fsck should generally not be run on a filesystem mounted in read-write mode.

8. File exists (EEXIST)

The operation requires a new resource, but another file or directory already exists with the same name.

Diagnosis:

ls -la /path/to/destination
stat /path/to/destination
readlink /path/to/destination

Possible fixes:

mkdir -p /path/to/directory
mv file.txt file-old.txt
ln -sf source destination

Overwrite options such as cp -f or ln -sf should only be used after checking what will be replaced.

9. No space left on device (ENOSPC)

The filesystem cannot allocate any more blocks or inodes.

This message can appear even when df -h still shows free space if all inodes have been consumed, which is common when millions of small files exist.

Diagnosis:

df -h
df -i
du -xhd1 /var | sort -h
sudo lsof +L1
docker system df
Code language: JavaScript (javascript)

lsof +L1 can locate deleted files that are still held open by a process and continue consuming space.

Possible fixes:

sudo apt clean
sudo journalctl --vacuum-time=7d
docker system prune

docker system prune may remove unused resources. Before running it, review which containers, images, and volumes are still required.

10. Operation not permitted (EPERM)

The kernel does not allow the operation, even if the file itself appears accessible.

Unlike EACCES, this error is often related to special privileges, capabilities, immutable attributes, filesystem restrictions, or security policies.

Diagnosis:

id
lsattr /path/to/file
getcap /path/to/executable
capsh --print
findmnt -o TARGET,OPTIONS /path
Code language: PHP (php)

Possible fixes:

sudo chattr -i /path/to/file
sudo setcap capability /path/to/executable

Changing capabilities or attributes without understanding their purpose may weaken system security.

11. Too many open files (EMFILE)

A process has reached its file descriptor limit.

In Linux, a descriptor may represent files, sockets, pipes, terminals, and other input/output resources.

Diagnosis:

ulimit -n
ls /proc/PID/fd | wc -l
lsof -p PID
cat /proc/sys/fs/file-nr

Possible fixes:

Increasing the limit may relieve the issue, but first determine whether the application has a file descriptor leak.

For a shell session:

ulimit -n 65535

For a systemd service:

[Service]
LimitNOFILE=65535

Then run:

sudo systemctl daemon-reload
sudo systemctl restart service

12. OOM Killed or process terminated with SIGKILL

The Out-Of-Memory Killer has terminated a process because the system or a control group ran out of available memory.

Diagnosis:

journalctl -k | grep -i -E 'oom|killed process'
free -h
ps aux --sort=-%mem | head
systemd-cgtop
docker stats
Code language: JavaScript (javascript)

Container memory limits should also be reviewed.

Possible fixes:

The solution may involve fixing a memory leak, reducing concurrency, changing application settings, adding RAM, or enabling swap. Restarting the process only restores the service temporarily if the underlying cause remains.

13. Kernel panic

A kernel panic occurs when the kernel encounters a fatal condition from which it cannot safely recover.

Possible causes include failing RAM, storage problems, drivers, incompatible modules, filesystem corruption, or kernel bugs.

Diagnosis after rebooting:

journalctl -k -b -1
journalctl -b -1
sudo smartctl -a /dev/device
uname -r
lsmod

If logs do not survive the reboot, persistent journald storage, a serial console, kdump, or remote logging may need to be enabled.

The fix depends on the root cause: replace faulty hardware, remove a module, boot an older kernel, or repair the filesystem.

14. Segmentation fault (SIGSEGV)

A process tried to access a memory region it was not allowed to use, and the kernel terminated it with SIGSEGV.

It usually points to a programming bug, an incompatible library, memory corruption, or, less commonly, defective RAM.

Diagnosis:

coredumpctl list
coredumpctl info
coredumpctl debug
journalctl -k
ldd /path/to/program
Code language: PHP (php)

During development, tools such as these may also be used:

valgrind ./program
gcc -g -fsanitize=address source.c -o program

The real fix usually requires locating the bug in the program, updating it, or installing compatible dependency versions.

15. APT Lock Error

APT or dpkg is already being used by another process. The lock prevents two operations from modifying the package database at the same time.

Diagnosis:

ps aux | grep -E '[a]pt|[d]pkg'
sudo lsof /var/lib/dpkg/lock-frontend
systemctl status apt-daily.service
sudo dpkg --audit
Code language: JavaScript (javascript)

The first step is usually to wait for automatic updates to finish.

If a process is stuck, verify its state before stopping it. After an interrupted operation, run:

sudo dpkg --configure -a
sudo apt --fix-broken install
sudo apt update

Deleting lock files manually while APT or dpkg is still running may damage the package database.

16. Host key verification failed

SSH detects that the server’s public key does not match the one previously stored in known_hosts.

This may be caused by a legitimate server reinstall, a server replacement, a reused IP address, or a man-in-the-middle attack.

Diagnosis:

ssh-keygen -F server
ssh -vv user@server
Code language: CSS (css)

The new fingerprint must be verified through a trusted channel, such as the provider console, internal documentation, or direct contact with the administrator.

After verification:

ssh-keygen -R server
ssh user@server
Code language: CSS (css)

ssh-keyscan can retrieve a key, but it does not prove by itself that the key belongs to the correct server.

17. Network is unreachable and Connection timed out

Although both messages prevent a connection, they indicate different problems.

Network is unreachable (ENETUNREACH) means the system has no valid route to the destination network.

Connection timed out (ETIMEDOUT) usually means a route exists, but the destination or an intermediate device did not respond before the timeout expired.

Diagnosis:

ip addr
ip link
ip route
ping -c 4 gateway
dig example.com
tracepath server
nc -vz server 443
sudo nft list ruleset
Code language: CSS (css)

Possible fixes:

sudo ip link set interface up
sudo systemctl restart NetworkManager
sudo ip route add default via gateway
Code language: JavaScript (javascript)

DNS configuration, access control lists, firewall rules, cloud routes, and security groups should also be checked.

A practical troubleshooting method that avoids making things worse

When an error appears, a simple order of operations can help:

1. Read the complete message instead of focusing only on the final line.
2. Identify the command, the affected resource, and the requested operation.
3. Check the exit status when useful.
4. Review permissions, storage, memory, processes, and connectivity.
5. Inspect the service and kernel logs.
6. Change one thing at a time.
7. Confirm that the problem has been fixed and that the root cause has not merely been hidden.

Destructive commands should be the last resort. Deleting lock files, using kill -9, emptying entire directories, or running fsck without checking the volume state can turn a recoverable incident into data loss.

Linux usually explains with reasonable precision why it rejected an operation. The real challenge is not memorizing commands, but knowing what evidence to collect and how to distinguish the symptom from the underlying cause.

Frequently asked questions

What is the difference between errno and an exit status?

errno explains why a specific system call failed. The exit status summarizes how a command finished and can be checked with echo $?.

Why does “No space left on device” appear when free space is still available?

The system may have run out of inodes, a quota may have been exhausted, or deleted files may still be held open by running processes. Check df -h, df -i, quotas, and lsof +L1.

Is it safe to use sudo to fix “Permission denied”?

Not always. sudo bypasses some restrictions, but it can also hide incorrect permissions or run a dangerous operation as root. The blocking control should be identified first.

Should the APT lock file be deleted?

Not while an APT or dpkg process is still running. The correct approach is to wait, inspect the process, and repair the package state if an update was interrupted.

Sources:

• Linux man-pages project, documentation on error codes and system calls.
• GNU Bash Reference Manual, exit statuses and command execution.
• OpenSSH documentation on host key verification.
• Debian documentation for APT and dpkg.
• systemd manuals for journalctl, service management, and resource limits.