Essential Linux commands for system administration and DevOps

This Linux command handbook is a practical reference for developers, system administrators, DevOps engineers, and anyone working from a terminal. It organizes essential Linux commands by task, explains what each command actually does, and includes safe examples you can adapt on Ubuntu, Debian, RHEL, Rocky Linux, AlmaLinux, Fedora, and other modern distributions.

No single article can replace each command’s manual page. Use this guide to find the right tool, then confirm distribution-specific options with man command, command --help, or the upstream documentation. Commands that modify disks, permissions, processes, firewall rules, or files should first be tested on non-production data.

Table of Contents

Linux Help and Command Discovery

Start with built-in documentation instead of guessing flags. Manual sections distinguish user commands, system calls, configuration files, and administration commands.

man ls
man 5 passwd
man -k "network interface"
apropos "disk usage"
ls --help
type -a python
command -v nginx
whereis ssh
whatis chmod
info coreutils
Command Purpose
man Read a command or file-format manual.
apropos Search manual-page names and descriptions.
type -a Show whether a name is an alias, function, builtin, or executable.
command -v Resolve the command a shell will execute. 
pwd
ls -lah
ls -lt --time-style=long-iso
cd /var/log
cd -
mkdir -p project/{src,tests,docs}
touch notes.txt
cp -a source/ backup/
mv old-name new-name
ln -s /opt/app/current app-current
stat file.txt
file archive.tar.gz
realpath ./relative/path

cp -a preserves metadata and copies directories recursively. Quote names containing spaces: cp "Quarterly Report.pdf" /srv/archive/. Prefer explicit paths in automation.

Delete Files Carefully

# Inspect first
find /srv/cache -maxdepth 1 -type f -mtime +7 -print

# Delete only after the printed set is correct
find /srv/cache -maxdepth 1 -type f -mtime +7 -delete

# Interactive removal for a small manual operation
rm -i obsolete.txt
rmdir empty-directory

Never run copied recursive deletion commands without resolving the exact target. Avoid destructive commands containing an empty variable, an unresolved glob, ~, or /. A shell command can permanently remove data before a backup is checked.

View and Compare File Content

cat /etc/os-release
less +F /var/log/app.log
head -n 20 file.txt
tail -n 50 file.txt
tail -F /var/log/nginx/error.log
wc -l file.txt
sort names.txt
sort -u names.txt
diff -u old.conf new.conf
cmp binary-a binary-b
sha256sum image.iso

Use less for large files rather than loading everything into a terminal. tail -F follows a filename across common log rotation, while lowercase -f follows the open descriptor.

Search and Process Text

grep -Rni --exclude-dir=.git "listen" /etc/nginx
grep -E "ERROR|WARN" app.log
cut -d: -f1 /etc/passwd
awk '$9 >= 500 {print $1, $7, $9}' access.log
sed -n '1,40p' config.ini
tr '[:lower:]' '[:upper:]' < names.txt
sort access.log | uniq -c | sort -nr | head
find . -type f -name '*.go' -print
find /var/log -type f -size +100M -ls
xargs -0 command < files.nul

grep searches contents; find selects filesystem entries. For arbitrary filenames, use NUL delimiters such as find ... -print0 with xargs -0. Modern development environments often provide rg (ripgrep), which is fast and respects ignore files:

rg -n "TODO|FIXME" .
rg --files -g '*.yaml'
rg -l "database_url" /srv/app

Users, Groups, Ownership, and Permissions

whoami
id
groups
getent passwd deploy
sudo -l
useradd --create-home --shell /bin/bash deploy
passwd deploy
usermod -aG sudo deploy
chown -R deploy:deploy /srv/app
chmod 750 /srv/app
chmod 640 /srv/app/config.yaml
umask
getfacl /srv/shared
setfacl -m u:deploy:rwX /srv/shared

Numeric modes use read = 4, write = 2, and execute = 1. Thus 640 means owner read/write, group read, others no access. Directory execute permission controls traversal. Avoid chmod -R 777; it usually hides an ownership or deployment design error and grants unnecessary access.

Processes, CPU, Memory, and Runtime Inspection

ps auxf
ps -eo pid,ppid,user,%cpu,%mem,etimes,cmd --sort=-%cpu | head
pgrep -a nginx
pidof sshd
top
free -h
uptime
vmstat 1
iostat -xz 1
pidstat -p ALL 1
lsof -p PID
lsof -nP -iTCP -sTCP:LISTEN
ulimit -a
cat /proc/PID/limits

Send Signals Safely

kill -TERM PID
kill -HUP PID
pkill -TERM -x exact-process-name
kill -KILL PID

Use SIGTERM first so the program can drain work and release resources. SIGKILL cannot be handled and may leave partial work, so reserve it for a process that does not respond after evidence is captured.

System and Kernel Information

uname -a
cat /etc/os-release
hostnamectl
lscpu
lsmem
lsblk -f
lsusb
lspci -nnk
dmesg --level=err,warn
timedatectl
locale
env | sort
printenv PATH

dmesg contains kernel messages such as OOM kills, disk errors, driver failures, and network link changes. Access may require root depending on the kernel security policy.

Package Management Commands

Ubuntu and Debian

sudo apt update
apt list --upgradable
sudo apt install nginx
sudo apt remove nginx
sudo apt purge nginx
apt search package-name
apt show package-name
dpkg -L package-name
dpkg -S /path/to/file

RHEL, Rocky Linux, AlmaLinux, and Fedora

sudo dnf check-update
sudo dnf install nginx
sudo dnf remove nginx
dnf search package-name
dnf info package-name
rpm -ql package-name
rpm -qf /path/to/file

Refresh metadata before installation and review the transaction. Do not use an unreviewed remote shell script when a supported distribution package or verified upstream repository is available.

systemd Services, Boot, and Logs

systemctl status nginx --no-pager
sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl reload nginx
sudo systemctl enable --now nginx
sudo systemctl disable nginx
systemctl is-active nginx
systemctl is-enabled nginx
systemctl list-units --type=service --state=failed
systemctl cat nginx
systemctl show nginx -p MainPID -p MemoryCurrent
systemd-analyze blame

journalctl Examples

journalctl -u nginx --since "30 minutes ago" --no-pager
journalctl -u nginx -f
journalctl -p err..alert -b
journalctl -k -b
journalctl --disk-usage
journalctl _PID=1234

reload asks a service to reread configuration when supported; restart stops and starts it. Validate configuration before either operation, for example nginx -t or sshd -t.

Networking, Ports, Routing, and DNS

ip -br address
ip -s link
ip route show
ip route get 1.1.1.1
ip neigh show
ss -lntup
ss -s
ping -c 4 1.1.1.1
tracepath example.com
curl -I https://example.com
curl -v --connect-timeout 3 https://example.com/health
wget -O file.iso https://example.com/file.iso
dig example.com A +short
dig example.com AAAA +short
resolvectl status
getent hosts example.com
nc -vz database.example.com 3306

Use ip and ss for modern Linux networking rather than depending on legacy ifconfig and netstat. A useful diagnostic order is DNS resolution, selected route, TCP connection, TLS handshake, HTTP response, and application health.

Firewall Inspection

sudo nft list ruleset
sudo ufw status verbose
sudo firewall-cmd --state
sudo firewall-cmd --list-all

Use the firewall manager configured by the distribution. Do not mix nftables, UFW, firewalld, and direct rule changes without understanding ownership and persistence.

Disks, Filesystems, Mounts, and Archives

lsblk -o NAME,SIZE,FSTYPE,FSVER,LABEL,UUID,MOUNTPOINTS
findmnt
df -hT
df -ih
du -xhd1 /var | sort -h
sudo blkid
mount | column -t
sudo mount /dev/sdb1 /mnt/data
sudo umount /mnt/data
sudo fsck -N /dev/sdb1
sudo smartctl -a /dev/sda

df reports filesystem space; du walks directory entries. A filesystem can fail because blocks are full or because inodes are exhausted, so check both df -h and df -i. Do not run filesystem repair on a mounted writable filesystem unless its documentation explicitly permits it.

Compression and Archives

tar -czf backup.tar.gz directory/
tar -tzf backup.tar.gz
tar -xzf backup.tar.gz -C /restore/path
gzip large.log
gunzip large.log.gz
zip -r archive.zip directory/
unzip -l archive.zip
unzip archive.zip -d destination/

List an untrusted archive before extraction and use a dedicated destination. Verify checksums after downloading or transferring important artifacts.

SSH, Keys, and File Transfer

ssh user@server.example.com
ssh -p 2222 user@server.example.com
ssh-keygen -t ed25519 -a 100
ssh-copy-id user@server.example.com
ssh -v user@server.example.com
scp file.txt user@server:/srv/upload/
sftp user@server
rsync -aHAX --info=progress2 source/ user@server:/srv/backup/
rsync -aHAXn --delete source/ destination/

The final rsync example is a dry run because of -n. Review it before removing -n, especially when using --delete. Protect private keys with mode 600, verify host keys, and prefer dedicated keys with limited access for automation.

Pipes, Redirection, Variables, and Exit Codes

command > output.txt
command >> output.txt
command 2> error.txt
command > all-output.txt 2>&1
producer | consumer
printf '%sn' "$PATH"
export APP_ENV=production
echo "$?"
command1 && command2
command1 || recovery-command
set -o pipefail

&& executes the second command only after success; || executes it after failure. In scripts, quote variable expansions unless intentional word splitting is required. Prefer printf over ambiguous uses of echo.

Useful Command Composition

# Ten largest directories under /var, without crossing filesystems
sudo du -xhd1 /var | sort -h | tail

# Processes using the most memory
ps -eo pid,user,%mem,rss,cmd --sort=-rss | head

# Count HTTP status codes in a common access log
awk '{print $9}' access.log | sort | uniq -c | sort -nr

# Find files changed during the last 24 hours
find /srv/app -type f -mtime -1 -print

A Reliable Linux Troubleshooting Workflow

  1. Record the exact symptom, timestamp, affected users, and latest change.
  2. Check service state and the first relevant log error.
  3. Confirm CPU, memory, disk blocks, inodes, descriptors, and kernel events.
  4. Check listeners, DNS, routes, firewall ownership, TLS, and dependency health.
  5. Compare configuration and runtime identity with a known-good instance.
  6. Apply one reversible change, verify user impact, and retain a rollback path.
date -Is
uptime
systemctl --failed
systemctl status SERVICE --no-pager
journalctl -u SERVICE --since "15 minutes ago" --no-pager
free -h
df -hT
df -ih
ss -lntup
ip route
dmesg --level=err,warn
curl -v --max-time 10 http://127.0.0.1:PORT/healthz

Linux Commands That Require Extra Care

  • rm -rf: permanently removes directory trees.
  • dd: can overwrite an entire block device with one incorrect target.
  • mkfs: creates a filesystem and destroys existing filesystem metadata.
  • chmod -R and chown -R: recursively change access or ownership.
  • rsync --delete: removes destination entries missing from the source.
  • ip address flush and firewall flushes: can remove remote connectivity.
  • kill -KILL: prevents graceful cleanup.

Resolve exact targets with read-only commands, take or verify backups, use dry-run modes, and keep a second administrative session open for remote networking changes.

Frequently Asked Questions

Which Linux commands should a beginner learn first?

Start with pwd, ls, cd, mkdir, cp, mv, less, grep, find, man, ps, df, du, ip, ss, curl, and your distribution package manager.

How do I find an unknown command?

Use apropos for a task description, man -k for manual-page search, and package-manager search when the binary is not installed.

Why does a command work in my shell but fail in systemd or cron?

Non-interactive processes have a different user, PATH, working directory, environment, permissions, and resource limits. Use absolute paths and configure required environment explicitly.

Should I run every administration command with sudo?

No. Use normal privileges by default and elevate only the specific operation that requires it. Review access with sudo -l.

Conclusion

The most valuable Linux skill is not memorizing every flag; it is knowing how to discover the correct command, inspect before modifying, read exit status and logs, compose small tools safely, and verify the result. Bookmark this Linux command reference, but rely on the installed manual page for the exact version running on your system.

Official and Authoritative References

Leave a Reply

Your email address will not be published. Required fields are marked *