What do you need to do
Find a file or some text in files
find, grepWatch a log as it happens
tail -f, journalctl -fFind what is eating the disk
df -h, then du -sh *Find what is eating the CPU
topSee who is listening on a port
ss -tulpnEdit a config file
nano, or vi when nano is absent
This sheet answers “which one”, not “every flag”. Each line names the tool for a job and shows the form you will actually type. When you need the full set of options for one of them, the per-tool sheets linked at the bottom go deeper.
How commands join together
| Goal | Syntax |
|---|---|
| Feed one command into another | ps aux | grep nginx |
| Write output to a file, replacing it | df -h > /tmp/disk.txt |
| Append instead of replacing | date >> /tmp/run.log |
| Capture errors as well | ./job.sh > out.log 2>&1 |
| Throw output away | find / -name x 2>/dev/null |
| Run the second only if the first worked | make && ./deploy.sh |
| Run the second only if the first failed | ping -c1 host || echo down |
| Use a command’s output as a value | echo "lines: $(wc -l < file)" |
| Everything matching a pattern | rm /tmp/*.log |
| Turn a list into arguments | cat hosts | xargs -I{} ping -c1 {} |
| Page through long output | journalctl | less |
| Repeat a command every two seconds | watch df -h |
| At the prompt | Keys |
|---|---|
| Complete a name | Tab, twice to list the options |
| Previous commands | Up arrow, or history |
| Search what you typed before | Ctrl+R, then part of the command |
| Repeat the last command as root | sudo !! |
| Stop a running command | Ctrl+C |
| Clear the screen | Ctrl+L |
| Quit a pager such as less or man | q |
Quotes matter more than in cmd. The shell expands
*, $ and spaces before the command ever sees them, so a path with a space needs quotes. Single quotes pass text through untouched, double quotes still expand variables.
Finding out what a command does
| Question | Command |
|---|---|
| Full manual | man rsync, then /pattern to search and q to leave |
| Quick option list | rsync --help |
| What is this thing at all | whatis rsync |
| Which commands relate to a topic | apropos partition |
| Where does this command live | which rsync, or type rsync |
| Is it a file, a builtin or an alias | type -a cd |
| Which package provides it | rpm -qf $(which ss) or dpkg -S $(which ss) |
Moving around and finding things
| Task | Command |
|---|---|
| Where am I | pwd |
| List, with details and hidden files | ls -lah |
| Newest files last | ls -lahtr |
| Go somewhere, and back | cd /etc, then cd - |
| Find files by name | find /var -name "*.log" |
| Find files changed in the last day | find /etc -mtime -1 |
| Find files over 100 MB | find / -size +100M 2>/dev/null |
| Find and act on each result | find /tmp -name "*.tmp" -delete |
| What kind of file is this | file /usr/bin/ssh |
| Size, owner, timestamps | stat report.csv |
| Tree view, if installed | tree -L 2 |
Reading files
| Task | Command |
|---|---|
| Show a short file | cat /etc/hosts |
| Page through a long one | less /var/log/syslog |
| First or last lines | head -20 file, tail -50 file |
| Follow a log live | tail -f /var/log/nginx/error.log |
| Count lines, words, bytes | wc -l file |
| Compare two files | diff -u old.conf new.conf |
| Checksum | sha256sum image.iso |
| Read a compressed log without unpacking | zcat old.log.gz | less |
| Pretty-print JSON | jq . data.json |
Inside less.
/text searches forward and n repeats it, G jumps to the end, g to the start, q quits. less +F behaves like tail -f but lets you press Ctrl+C and scroll back.
Working with text
| Task | Command |
|---|---|
| Find a string in a file | grep "error" /var/log/syslog |
| Ignore case, show line numbers | grep -in "error" file |
| Search a whole tree | grep -rn "TimeoutSec" /etc/systemd |
| Show context around the hit | grep -C3 "failed" file |
| Everything except a pattern | grep -v "debug" file |
| Count matches | grep -c "error" file |
| Replace text on screen | sed 's/old/new/g' file |
| Replace in the file itself | sed -i 's/old/new/g' file |
| Print one column | awk '{print $3}' file |
| Sum a column | awk '{s+=$2} END {print s}' file |
| Split on a delimiter | cut -d: -f1 /etc/passwd |
| Sort, then count duplicates | sort file | uniq -c | sort -rn |
| Sort by the second column, numerically | sort -k2 -n file |
sed -i edits in place with no undo. Run it without
-i first and read the result, or keep a copy with sed -i.bak, which writes file.bak beside the original.
Files, archives and transfer
| Task | Command |
|---|---|
| Copy, and copy a folder | cp a b, cp -r dir/ dest/ |
| Move or rename | mv old new |
| Delete, and delete a folder | rm file, rm -r dir |
| Create a folder path | mkdir -p /opt/app/logs |
| Create an empty file | touch /tmp/marker |
| Symbolic link | ln -s /opt/app/current /opt/app/live |
| Copy a tree efficiently | rsync -avh src/ dest/ |
| Copy to another machine | rsync -avh dir/ user@host:/backup/ |
| Pack a folder | tar -czf app.tar.gz /opt/app |
| Unpack it | tar -xzf app.tar.gz -C /tmp |
| Look inside without unpacking | tar -tzf app.tar.gz | head |
| Zip, for someone on Windows | zip -r app.zip /opt/app |
| Download a file | curl -O https://host/file, or wget |
Remember tar by its three letters.
-c create, -x extract, -t list. Add -z for .gz and -f for the file name, which is why czf and xzf cover almost everything.
Processes and jobs
| Task | Command |
|---|---|
| Live view of load and processes | top, or htop if installed |
| Every process, one snapshot | ps aux |
| Find a process by name | pgrep -a nginx |
| Top consumers of CPU | ps aux --sort=-%cpu | head |
| Top consumers of memory | ps aux --sort=-%mem | head |
| Ask a process to stop | kill 1234 |
| Make it stop | kill -9 1234 |
| By name instead of PID | pkill nginx |
| What has this file or port open | lsof /var/log/app.log, lsof -i :443 |
| Run something that survives logout | nohup ./job.sh & |
| Keep a session alive across disconnects | tmux, detach with Ctrl+B then D |
| Come back to it | tmux attach |
| Background the current command | Ctrl+Z, then bg, list with jobs |
kill -9 is the last resort, not the first. Plain
kill asks the process to shut down and flush its work. -9 removes it instantly and whatever it was writing stays half written. For anything managed by systemd, systemctl restart is better than either.
System, disks and space
| Task | Command |
|---|---|
| Distribution and version | cat /etc/os-release |
| Kernel, hostname, virtualisation | uname -a, hostnamectl |
| Uptime and load average | uptime |
| Memory, in human units | free -h |
| CPU model and core count | lscpu |
| Free space per filesystem | df -hT |
| What is big in this folder | du -sh * | sort -h |
| Disks, partitions and mount points | lsblk -f |
| What is mounted, readably | findmnt |
| Hardware and driver messages | dmesg -T | tail -50 |
| Service state and logs | systemctl status name, journalctl -u name |
| Reboot or power off | reboot, poweroff |
Disk full but du finds nothing? Either a deleted file is still held open, which
lsof | grep deleted reveals, or you have run out of inodes rather than bytes, which df -i shows.
Network
| Task | Command |
|---|---|
| Addresses, one line each | ip -br a |
| Routing table | ip r |
| Listening ports and their processes | ss -tulpn |
| Is the host up | ping -c4 10.0.0.1 |
| Is the port open | nc -zv 10.0.0.50 443 |
| Resolve a name | dig example.com +short |
| Where does the path break | traceroute -n 8.8.8.8 |
| Test an HTTP endpoint | curl -I https://example.com |
| Connect to another server | ssh user@host |
| Watch packets | tcpdump -i any -nn port 443 |
Users, access and scheduling
| Task | Command |
|---|---|
| Who am I, and in which groups | id |
| Who is logged in | who, or w for what they are doing |
| Recent logins | last -10 |
| What may I run as root | sudo -l |
| Become root for a session | sudo -i |
| Change a password | passwd, or passwd user as root |
| Permissions and ownership | chmod 640 file, chown user:group file |
| Edit the crontab | crontab -e, list with crontab -l |
| What is scheduled through systemd | systemctl list-timers --all |
| cron field order | Example |
|---|---|
| minute hour day month weekday | 0 2 * * * /usr/local/bin/backup.sh runs at 02:00 daily |
| Every 15 minutes | */15 * * * * /usr/local/bin/check.sh |
| Mondays at 06:30 | 30 6 * * 1 /usr/local/bin/weekly.sh |
When the command is not there
| Family | Install |
|---|---|
| RHEL, Rocky, AlmaLinux, Fedora | dnf install tree |
| RHEL 7 and older | yum install tree |
| Debian, Ubuntu | apt install tree |
| SLES, openSUSE | zypper install tree |
| Photon OS, vCenter appliance | tdnf install tree |
| Alpine, containers | apk add tree |
Minimal images are missing more than you expect.
dig, tcpdump, lsof, tree and even ip can be absent on a container or an appliance. Check with command -v name before assuming the system is broken, and remember that an ESXi host has no package manager at all.
FAQ
Command not found, but I am sure it exists.
Three cases. It is not installed, which
command -v name settles. It lives in /usr/sbin and your PATH as a normal user does not include it, so try sudo name or the full path. Or it is a shell builtin of a different shell. On minimal images and appliances the first case is by far the most common.
Which editor should I use?
nano when it is there: arrow keys work, and the shortcuts are printed at the bottom of the screen. vi is the one guaranteed to exist, including on an ESXi host, so it is worth knowing the twenty keys that get you in and out safely.
Why does my command work as root but not as me?
Usually file permissions or a PATH difference.
ls -l on the file shows the first, and sudo -l shows what you are actually allowed to run. Note that sudo command and sudo -i give different environments, which is why a script can behave differently between them.
How do I run something that keeps going after I disconnect?
tmux for interactive work you want to return to, nohup ./job.sh & for a one-off, and a systemd unit for anything that should survive a reboot and be managed properly.
Is there a PowerShell equivalent on Linux?
Yes, PowerShell 7 installs on all the major distributions and your existing scripts largely work. It is a reasonable choice for your own tooling, but the system itself is administered with the commands on this sheet, so you still need both.