Reference / Linux commands by task
Linux commands by task
GNU coreutils and util-linux on a current distribution. Flags that differ on BSD or macOS are noted where it matters.
Files and directories
| Task | Command |
|---|---|
| List with sizes, hidden files, newest last | ls -lahtr |
| Find files by name, case-insensitive | find . -iname "*.log" |
| Files changed in the last 60 minutes | find /var/log -mmin -60 -type f |
| Files larger than 100 MB | find / -xdev -type f -size +100M |
| Copy preserving mode, owner and times | cp -a src/ dest/ |
| Sync a directory, showing progress | rsync -a --info=progress2 src/ dest/ |
| Symbolic link | ln -s /opt/app/current/bin/app /usr/local/bin/app |
| Details: size, mode, inode, times | stat file |
| Pack and compress a directory | tar -czf backup.tar.gz dir/ |
| List an archive without extracting | tar -tzf backup.tar.gz |
rsync src/ dest/ copies the contents of src; rsync src dest/ creates dest/src. The trailing slash on the source is the difference.
Text
| Task | Command |
|---|---|
| Search recursively with line numbers | grep -rn "pattern" . |
| Only filenames that match | grep -rl "pattern" . |
| Extended regex, case-insensitive | grep -Ei "error|fail" app.log |
| Follow a growing log | tail -f /var/log/syslog |
| Count lines | wc -l file |
| Count identical lines, most frequent first | sort file | uniq -c | sort -rn | head |
| Column 1 of a space-separated file | awk '{print $1}' access.log |
| Field 3 of a CSV without quotes | cut -d, -f3 data.csv |
| Replace in place, keep a backup | sed -i.bak 's/old/new/g' file |
| Unified diff of two files | diff -u old.conf new.conf |
uniq only collapses adjacent duplicates, which is why it is almost always preceded by sort. On macOS, sed -i needs an explicit suffix argument: sed -i '' 's/a/b/' file.
Processes and services
| Task | Command |
|---|---|
| All processes with full command lines | ps aux |
| Process tree | ps -ef --forest |
| Find a process id by name | pgrep -a python |
| Ask a process to stop, then force it | kill PID; sleep 5; kill -9 PID |
| Interactive view sorted by CPU | top -o %CPU |
| Which process holds a file open | lsof /path/to/file |
| Service status and recent log lines | systemctl status app.service |
| Restart a service | sudo systemctl restart app.service |
| Follow a service’s log | journalctl -u app.service -f |
| Errors since boot | journalctl -b -p err |
| Run detached from the terminal | nohup ./job.sh > job.log 2>&1 & |
Disks and memory
| Task | Command |
|---|---|
| Free space per filesystem | df -h |
| Free inodes (when df shows space but writes fail) | df -i |
| Size of each item in a directory | du -sh -- * | sort -h |
| Block devices and mount points | lsblk -f |
| Where a path is mounted from | findmnt -T /var/lib |
| Memory, human-readable | free -h |
| Deleted files still held open (space not freed) | lsof +L1 |
When df and du disagree, a process usually still holds a deleted file, often a rotated log. lsof +L1 lists such files; restarting the process frees the space.
Basic network diagnostics
| Task | Command |
|---|---|
| Addresses on all interfaces | ip -br addr |
| Routing table | ip route |
| Which route a destination would take | ip route get 192.0.2.10 |
| Listening TCP and UDP sockets with processes | sudo ss -tulpn |
| Is a host reachable (4 packets) | ping -c 4 192.0.2.10 |
| Path to a host, hop by hop | tracepath 192.0.2.10 |
| DNS lookup, short answer | dig +short example.com A |
| DNS lookup against a specific resolver | dig @192.0.2.53 example.com |
| Is a TCP port open | nc -zv 192.0.2.10 443 |
| HTTP status and headers | curl -sI "$URL" |
| TLS certificate dates and subject | openssl s_client -connect host:443 -servername host </dev/null 2>/dev/null | openssl x509 -noout -dates -subject |
ss replaced netstat, and ip replaced ifconfig and route. The old tools are often not installed on current systems. ICMP may be blocked even when the service works, so a failed ping proves little; nc -zv tests the port you actually care about.
Shell habits that save time
| Task | Command |
|---|---|
| Re-run the last command with sudo | sudo !! |
| Last argument of the previous command | cd !$ |
| Search command history | Ctrl+R, then type |
| Stop a script at the first error | set -euo pipefail |
| Time a command | time ./build.sh |
The example addresses come from the ranges reserved for documentation (RFC 5737), and example.com is reserved for examples (RFC 2606).