Commands Reference

ls -la /var/log          # permissions, sizes, hidden files
ls -lhS ~/Downloads      # human sizes, largest first
ls -lt app/              # sort by modification time
ls -d */                 # directories only in cwd

cd /var/www/app
cd ..                    # parent directory
cd -                     # previous directory (toggle)
cd ~deploy               # another user's home (if permitted)

pwd
pwd -P                   # resolve symlinks (physical path)
cd $(mktemp -d) && pwd     # confirm temp build dir

cp nginx.conf nginx.conf.bak
cp -a /data/app/ /backup/app-$(date +%F)/   # archive mode preserves meta
cp -r src/ dist/src/
cp -n *.log /archive/    # no-clobber — skip existing

mv app.log app.log.1
# for deploys, prefer: ln -sfn releases/20250604 /opt/app/current
mv -i *.tmp /tmp/        # prompt before overwrite

rm stale.lock
rm -r build/ node_modules/   # recursive
rm -f /var/cache/app/*       # force — no prompt
rm -i important.db           # interactive — prefer this for risky paths

mkdir -p src/components/ui
mkdir -m 750 /var/lib/myapp
install -d -o deploy -g deploy /opt/app/releases

rmdir empty_dir
rmdir -p a/b/c             # remove c, then parents if empty

find /var/log -name '*.log' -mtime +30 -delete
find . -type f -name '*.py' -exec grep -l 'TODO' {} +
find / -xdev -size +1G 2>/dev/null   # large files, stay on one FS
find /opt -type l ! -exec test -e {} \; -print   # broken symlinks

locate nginx.conf
locate '*.pem' | grep etc
sudo updatedb              # refresh DB after mass installs

tree -L 2 -d src/
tree -h --du /var/www      # sizes and disk usage
tree -I 'node_modules|__pycache__' .

cat /etc/os-release
cat file1 file2 > merged.txt
cat -n script.sh           # line numbers
cat -A weird.txt           # show $ end lines, tabs as ^I

less /var/log/syslog
less +F /var/log/app.log   # follow mode (like tail -f)
grep ERROR huge.log | less
journalctl -u nginx | less

more README.md
man ls | more

head -n 20 access.log
head -c 1M image.bin | xxd   # inspect binary header
head -n 1 *.csv              # header row of each CSV

tail -f /var/log/nginx/error.log
tail -n 100 deploy.log
tail -F rotated.log          # retry if file recreated

vim /etc/nginx/nginx.conf
vim +42 app.py             # jump to line 42
vim -o file1 file2         # horizontal splits
vim -d old.conf new.conf   # diff mode

nano ~/.bashrc
sudo nano /etc/fstab
nano -l script.sh          # line numbers

wc -l access.log
wc -c backup.tar.gz
find . -name '*.go' | xargs wc -l | tail -1

chmod 600 ~/.ssh/id_rsa
chmod +x deploy.sh
chmod -R g+w /var/shared
chmod u+s /usr/local/bin/myhelper   # setuid

chown www-data:www-data -R /var/www
chown deploy:deploy app.log
chown root:root /usr/bin/special

chgrp docker /var/run/docker.sock
chgrp -R developers /opt/shared

umask
umask 027                  # new files 640, dirs 750
umask 077                  # private defaults

getfacl /data/shared
getfacl -R /nfs/mount | less

setfacl -m u:alice:rwx /data/shared
setfacl -m g:eng:r-x /data/shared
setfacl -b file              # remove all ACLs

ps aux --sort=-%mem | head
ps -ef --forest
ps -p 1234 -o pid,cmd,%cpu,etime
ps -u deploy -f

top
top -u nginx
top -o %CPU
top -bn1 | head -20        # batch mode for scripts

htop
htop -u deploy
htop -t                    # tree view

kill 1234                  # SIGTERM (15)
kill -9 1234               # SIGKILL — last resort
kill -HUP $(cat /var/run/nginx.pid)   # reload
kill -l                    # list signals

pkill -f 'gunicorn master'
pkill -u deploy old_worker
pkill -9 -f runaway_script.py

# Ctrl+Z to stop, then:
bg
bg %2

fg
fg %1

jobs -l
jobs -p                    # PIDs only

nohup ./long_backup.sh &
nohup python train.py > train.log 2>&1 &

screen -S deploy
screen -ls
screen -r deploy           # reattach
# Ctrl+a d to detach

tmux new -s api
tmux ls
tmux attach -t api
tmux split-window -h

df -h
df -i /                   # inode usage
df -h /var /tmp

du -sh /var/log/* | sort -hr | head
du -x --max-depth=1 /data
du -sh .[!.]* * 2>/dev/null   # include dot dirs in cwd

lsblk -f
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT

mount /dev/sdb1 /mnt/backup
mount -o ro /dev/cdrom /media/cdrom
mount -a                 # all from /etc/fstab

umount /mnt/backup
umount -l /mnt/stuck       # lazy unmount if busy
fuser -km /mnt/backup      # kill processes using mount (careful)

fdisk -l
sudo fdisk /dev/sdb
fdisk -l /dev/nvme0n1

parted -l
parted /dev/sdb mklabel gpt
parted /dev/sdb mkpart primary ext4 0% 100%

mkfs.ext4 /dev/sdb1
mkfs.xfs -f /dev/sdb1
mkfs.ext4 -L backup_vol /dev/sdb1

blkid
blkid /dev/sdb1
grep $(blkid -s UUID -o value /dev/sdb1) /etc/fstab

ping -c 4 8.8.8.8
ping -c 3 internal-api.local
ping6 2001:4860:4860::8888

curl -sS https://api.example.com/health | jq .
curl -o image.tar.gz https://releases.example.com/latest.tar.gz
curl -X POST -H 'Content-Type: application/json' -d '{"ok":true}' localhost:8080/hook
curl -vI https://example.com      # headers only, verbose

wget https://example.com/file.iso
wget -c https://example.com/big.zip   # resume
wget -r -np https://docs.example.com/  # mirror (careful)

netstat -tlnp
netstat -rn
netstat -an | grep ESTABLISHED

ss -tlnp
ss -tan state established '( dport = :443 or sport = :443 )'
ss -u -a
ss -s                    # summary

ip addr show
ip link set eth0 up
ip route show default
ip neigh show

ifconfig
ifconfig eth0

traceroute example.com
traceroute -n 10.0.0.5     # no DNS
tracepath example.com      # alternative without raw sockets

nmap -sV localhost
nmap -p 1-1024 192.168.1.10
nmap -sn 192.168.1.0/24    # host discovery only

dig example.com A
dig +short api.example.com
dig @8.8.8.8 example.com MX
dig -x 93.184.216.34       # reverse DNS

nslookup example.com
nslookup -type=mx example.com

ssh deploy@prod.example.com
ssh -i ~/.ssh/deploy_ed25519 -p 2222 bastion
ssh -L 5432:localhost:5432 db.internal   # local port forward
ssh -J bastion app.internal              # jump host

scp build.tar.gz user@host:/opt/releases/
scp -r ./config/ user@host:~/app/
scp -3 hop:file1 hop:file2   # through two hosts

rsync -avz --delete ./dist/ user@host:/var/www/app/
rsync -av /data/ /backup/data/
rsync -avz -e 'ssh -p 2222' file user@host:
rsync -av --dry-run src/ dest/   # preview

useradd -m -s /bin/bash deploy
useradd -r -s /usr/sbin/nologin nginx
useradd -G docker,sudo alice

usermod -aG docker deploy
usermod -s /bin/bash serviceaccount
usermod -L locked_user         # lock password

userdel oldcontractor
userdel -r tempuser            # remove home dir too

passwd
sudo passwd deploy
passwd -l account              # lock

groups
groups deploy

id
id deploy
id -u -n                   # username only

who
who -a
w                          # who + load + command

whoami
sudo whoami                # root when sudo works

su -
su - postgres
su -s /bin/bash serviceuser

sudo systemctl restart nginx
sudo -u deploy -H bash -l
sudo -l                    # list allowed commands
sudo visudo                # edit sudoers safely

sudo visudo
sudo visudo -f /etc/sudoers.d/deploy

uname -a
uname -r                   # kernel release
uname -m                   # x86_64, aarch64

hostname
hostname -f
hostnamectl set-hostname app-prod-01

uptime
uptime -p                  # pretty duration

free -h
free -h -s 5               # every 5 seconds
free -b | awk '/Mem:/ {print $7}'

vmstat 1 10
vmstat -w 1                # wide
vmstat -d                  # disk

iostat -xz 1
iostat -cd 1 5

lscpu
lscpu -e=CPU,CORE,SOCKET,ONLINE

sudo lshw -short
sudo lshw -class disk
sudo lshw -json

dmesg | tail -50
dmesg -T                   # human timestamps
dmesg -w                   # follow
dmesg | grep -i error

sudo apt update
sudo apt install nginx
sudo apt upgrade -y
apt search ripgrep

sudo apt-get update
sudo apt-get install -y build-essential
sudo apt-get remove --purge oldpkg

sudo yum install httpd
sudo yum update
yum search python3

sudo dnf install podman
sudo dnf upgrade
dnf repoquery -l nginx

rpm -qa | grep nginx
rpm -ql nginx              # files in package
rpm -ivh package.rpm

dpkg -l | grep nginx
dpkg -L nginx
sudo dpkg -i package.deb
sudo dpkg-reconfigure package

grep -r 'ERROR' /var/log/app/
grep -E 'timeout|refused' access.log
journalctl -u api | grep -i fatal
zgrep pattern archived.log.gz

sed -i.bak 's/debug/info/' config.yaml
sed -n '10,20p' file.txt
grep old file | sed 's/old/new/g'
sed '/^#/d' .env > .env.clean

awk '{print $1, $NF}' access.log
awk -F: '$3 >= 1000 {print $1}' /etc/passwd
awk '/error/{c++} END{print c}' app.log
ps aux | awk '$3 > 50.0 {print $2, $11}'

cut -d: -f1 /etc/passwd
cut -c1-8 file.txt
df -h | cut -d' ' -f1

sort -t, -k2 -n data.csv
sort -u names.txt
sort -h sizes.txt            # human numeric

sort access.log | uniq -c | sort -rn | head
uniq -d duplicates.txt

tr '[:upper:]' '[:lower:]' < FILE
tr -d '\r' < windows.txt > unix.txt
cat ids | tr '\n' ','

find . -name '*.tmp' -print0 | xargs -0 rm
cat hosts.txt | xargs -I{} ping -c1 {}
printf '%s\0' a b | xargs -0 echo

deploy.sh 2>&1 | tee deploy.log
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
make test | tee results.txt

tar -czvf backup.tar.gz /data/app
tar -xzvf release.tar.gz
tar -tf archive.tar | head
tar -czf - ./app | ssh host 'tar -xzf - -C /opt'

gzip large.log
gzip -9 -k file.txt          # keep original
gzip -d file.gz              # decompress

gunzip access.log.gz
zcat access.log.gz | head

zip -r project.zip src/
zip -9 release.zip dist/*

unzip -l archive.zip
unzip archive.zip -d ./out

bzip2 kernel.log
bzip2 -d file.bz2
tar -cjvf archive.tbz2 dir/

echo $PATH
echo 'deb [arch=amd64] https://...' | sudo tee /etc/apt/sources.list.d/extra.list
echo -n 'no newline'

export NODE_ENV=production
export PATH=$HOME/bin:$PATH
export -p | grep AWS

env | sort
env -i HOME=$HOME PATH=$PATH bash --noprofile
env PYTHONPATH=./src python app.py

alias ll='ls -la'
alias k='kubectl'
unalias ll

source ~/.bashrc
source venv/bin/activate
. ./env.sh

history | tail -20
history | grep ssh
!42                        # rerun command 42
Ctrl+r                     # reverse search

crontab -e
crontab -l
crontab -r                  # remove all (careful)
# 0 2 * * * /opt/backup.sh

systemctl status cron        # Debian
systemctl status crond       # RHEL
grep CRON /var/log/syslog
ls -la /etc/cron.d/

echo '/opt/report.sh' | at 02:00 tomorrow
atq
atrm 3

journalctl -u nginx -f
journalctl -p err -b      # errors this boot
journalctl --since '1 hour ago'
journalctl -k             # kernel

tail -f /var/log/syslog
tail -f /var/log/messages    # RHEL
grep sshd /var/log/auth.log
logger -t myapp 'deploy finished'

strace -c ls /etc
strace -e openat,read,write -p 1234
strace -f -o trace.log ./app

lsof -i :8080
lsof -p 1234
lsof +L1 | grep deleted    # deleted but still open
lsof /var/lib/docker

ltrace ls
ltrace -p 1234
ltrace -e malloc,free ./app