linux commands
133 commands, each with a one-line explanation. Click a command to copy it, or its title for details.
Commands 133 shown
-
find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null | sort -k5 -rh | head -20Find files larger than 100MB sorted by size
-
du -sh /* 2>/dev/null | sort -rh | head -15Top 15 largest directories at root level
-
ss -tlnpTCP listening ports with PID and process name (modern netstat)
-
ss -tlnp | grep :<port>Which process is listening on a specific port
-
ps aux --sort=-%cpu | head -15Top 15 processes by CPU consumption
-
ps aux --sort=-%mem | head -15Top 15 processes by memory consumption
-
journalctl -u <service> -f --since '10 minutes ago'Stream logs for a systemd unit from the last 10 minutes
-
systemctl status <service> --no-pager -lService status, recent log lines, and active timers
-
tcpdump -i eth0 -nn host <ip> and port 80 -w /tmp/capture.pcapCapture specific traffic to a pcap file
-
df -i | sort -k5 -rnShow inode usage per filesystem; can cause 'no space' without disk full
-
lsof -p <pid>Show all files, sockets, and connections opened by a process
-
watch -n 2 'kubectl get pods -n <ns>'Re-run a command every 2 seconds with diff highlighting
-
nohup ./script.sh > /tmp/out.log 2>&1 &Run a script immune to SIGHUP; redirect output to file
-
ssh -L 8080:internal-service:80 user@bastion -N -fForward local port 8080 to an internal host via bastion
-
tar -xzf archive.tar.gz -C /target/dir/Extract a gzipped tar archive to a specific directory
-
openssl rand -base64 32Cryptographically secure random 32-byte password
-
openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -dates -subjectShow cert expiry and subject for a live TLS endpoint
-
awk '{sum += $3} END {print sum}' file.txtSum the 3rd column of a space-delimited text file
-
sed -i 's/old-string/new-string/g' file.txtIn-place global string replacement
-
sort file.txt | uniq -c | sort -rn | head -20Count and rank duplicate lines in a file
-
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,UUIDTree of disks, partitions, loop devices with filesystem info
-
blkidPrint UUID, LABEL, and FSTYPE for all block devices
-
mount -t ext4 /dev/sdb1 /mnt/dataMount ext4 partition to /mnt/data
-
findmnt --realList all real (non-virtual) mounted filesystems in a tree
-
mount -o remount,rw /Remount the root filesystem as read-write (e.g. after rescue boot)
-
fsck -n /dev/sdb1Dry-run fsck check (no changes); unmount first for a live fix
-
mkfs.ext4 -L datalabel /dev/sdb1Format partition as ext4 with a label
-
resize2fs /dev/sdb1Grow ext4 to fill the partition (after partition resize)
-
tune2fs -l /dev/sda1 | grep -E 'Block (count|size)|Mount count|Last mount'Show ext2/3/4 metadata: block size, mount count, last mount time
-
du -h --max-depth=2 /var | sort -rh | head -20Disk usage of /var up to 2 directory levels deep
-
df -hT --type=ext4 --type=xfs --type=btrfsShow free space only for real filesystems (skip tmpfs/overlay)
-
fdisk /dev/sdbInteractive MBR/GPT partition table editor
-
parted /dev/sdb -- mklabel gpt mkpart primary ext4 1MiB 100%Create a single GPT partition using the full disk
-
pvs && pvdisplayList LVM physical volumes with space usage
-
vgs && vgdisplayList LVM volume groups with free PE
-
lvs -o +devicesList logical volumes with device paths
-
lvextend -L +10G /dev/vg0/lv_data && resize2fs /dev/vg0/lv_dataExtend LVM logical volume by 10G and grow ext4 filesystem online
-
fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfileAllocate 2G swap file, set permissions, format and enable
-
swapon --show && free -hList active swap spaces and overall memory/swap stats
-
ip -br aBrief list of all interfaces with IPs
-
ip route show table allAll routing rules including policy routes
-
ip route add 10.0.0.0/8 via 192.168.1.1 dev eth0Add a persistent-until-reboot static route
-
ip neigh showNeighbour (ARP/NDP) cache with reachability state
-
ip -s link show eth0TX/RX bytes, errors, drops for an interface
-
dig +short A example.com @8.8.8.8Query A records via a specific DNS server
-
dig +short -x 8.8.8.8PTR record for an IP address
-
dig +trace example.comFollow full DNS resolution chain from root nameservers
-
ss -tnp state establishedAll established TCP connections with process info
-
ss -tan | awk 'NR>1{print $1}' | sort | uniq -c | sort -rnHow many connections are in ESTABLISHED, TIME_WAIT, etc.
-
mtr --report --tcp --port 443 example.comCombine traceroute and ping; TCP mode to bypass ICMP blocks
-
ping -M do -s 1472 -c 3 8.8.8.8Send DF-bit ping of 1500-byte frames to detect MTU issues
-
iptables -L -n -v --line-numbersAll filter table rules with packet counters and line numbers
-
nft list rulesetFull nftables ruleset in human-readable form
-
iperf3 -c <server_ip> -t 10 -P 4Measure TCP throughput with 4 parallel streams for 10 seconds
-
iftop -i eth0 -nReal-time bandwidth per connection on an interface
-
uname -r && uname -aKernel release string and full system info
-
dmesg -T --level=err,warn | tail -50Last 50 kernel errors/warnings with human-readable timestamps
-
lsmod | sortAll currently loaded kernel modules
-
modprobe <module> && lsmod | grep <module>Load a module with dependencies and verify
-
modinfo <module>Module parameters, version, license, and dependencies
-
sysctl -a | grep vm.swappinessList all kernel parameters; filter by name
-
sysctl -w net.ipv4.ip_forward=1Enable IP forwarding at runtime (also add to /etc/sysctl.d/)
-
cat /proc/cmdlineParameters passed to the kernel at boot time
-
cat /proc/sys/fs/file-nrAllocated FDs, free FDs, and system-wide max (file-max)
-
iostat -xz 2 5Extended disk IO stats every 2s, 5 iterations; look for %iowait, await
-
vmstat 1 5System-wide CPU, memory, swap, IO stats per second
-
iotop -aoAccumulated disk read/write per process (requires root)
-
sar -u -r -d 1 5CPU, memory, and disk stats via sysstat (5 samples, 1s interval)
-
strace -f -e trace=network,file -p <pid>Trace network and file syscalls of a running process
-
perf stat -e cycles,instructions,cache-misses -- sleep 5Hardware CPU counters during a 5-second window
-
lscpu | grep -E 'Model|Socket|Core|Thread|MHz'CPU model, socket/core/thread topology, and clock speed
-
dmidecode -t memory | grep -E 'Size|Speed|Locator|Type:'Physical DIMM slots: size, speed, type (requires root)
-
lspci -v | grep -A5 'VGA\|Ethernet\|NVMe'Network cards, GPUs, NVMe controllers with driver info
-
chattr +i /etc/resolv.conf && lsattr /etc/resolv.confPrevent any user (incl. root) from modifying the file
-
lsattr -R /etc/ 2>/dev/null | grep -v '^\-\-\-\-'List non-default extended attrs in /etc/
-
getfacl /srv/sharedShow POSIX ACL entries including owner, group, and extra users
-
setfacl -m u:alice:rwx /srv/sharedGrant alice full access without changing group ownership
-
find / -perm /6000 -type f -ls 2>/dev/nullLocate setuid/setgid executables (security audit)
-
pgrep -la nginxList PIDs and full command lines matching a name
-
kill -TERM -$(pgrep -f 'my-app')Send SIGTERM to the entire process group
-
renice -n 10 -p <pid>Lower priority (nice +10) of a running process
-
systemd-run --scope -p MemoryMax=512M -p CPUQuota=50% -- ./heavy.shRun a command in a transient systemd scope with resource limits
-
journalctl --since '2024-01-15 10:00' --until '2024-01-15 10:30' -u nginxLogs for nginx between two timestamps
-
journalctl -u <service> -o json | jq '{ts: .REALTIME_TIMESTAMP, msg: .MESSAGE}'Structured log export for ingestion into log aggregators
-
timedatectl status && chronyc trackingClock sync state, offset, and NTP source details
-
systemctl list-timers --all --no-pagerAll timers with last/next trigger times
-
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@hostAppend public key to remote authorized_keys
-
rsync -avz --progress --delete src/ user@host:/dest/Mirror directory to remote with deletion of extra files
-
shred -vzn 1 /dev/sdbOne-pass overwrite with zeros + verify (use hdparm ATA for NVMe)
-
smartctl -a /dev/sda | grep -E 'SMART overall|Reallocated|Pending|Uncorrectable'SMART overall health and key failure indicators
-
dd if=/dev/zero of=/tmp/testfile bs=1M count=1024 conv=fdatasyncWrite 1GB with forced sync to measure raw write speed
-
lsns -t net,pid,mntList Linux namespaces for network, PID, and mount isolation
-
systemd-cglsTree view of systemd cgroup hierarchy and resource assignments
-
find /var/log -name '*.log' -exec wc -l {} + | sort -rn | head -20Find the biggest log files by line count
-
tail -f /var/log/syslog /var/log/auth.logStream multiple log files interleaved in one terminal
-
zgrep -i 'error' /var/log/syslog.*.gzgrep inside .gz files without manual decompression
-
logrotate -f /etc/logrotate.confForce log rotation regardless of schedule
-
for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u $u 2>/dev/null | grep -v '^#' | sed "s|^|$u: |"; donePrint active cron lines for every user
-
systemd-analyze calendar '*/5 * * * *'Parse and show next 5 trigger times for a cron expression
-
command > /tmp/out.log 2> /tmp/err.logSplit stdout and stderr into separate files
-
command 2>&1 | tee /tmp/all.logRedirect stdout+stderr to file and screen simultaneously
-
grep -rl 'old_string' /etc/ | xargs sed -i 's/old_string/new_string/g'Find files containing text, then replace in-place
-
awk '{print $1, $3}' /etc/passwdPrint 1st and 3rd fields of a space-delimited file
-
awk '{sum += $2} END {print sum}' file.txtSum values in column 2 of a text file
-
sed -i '/^#/d' config.confRemove all comment lines starting with #
-
sed -n '/START/,/END/p' file.txtPrint block of text between START and END markers
-
sort file.txt | uniq -c | sort -rnCount occurrences of each unique line
-
who -H && wActive user sessions and what they are running
-
last -n 20 | head -25Last 20 login records with IP and duration
-
journalctl -u ssh --since '24h ago' | grep 'Failed password' | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -10Top source IPs of failed SSH logins in last 24h
-
sudo -l -U <username>List sudo rules for a specific user
-
usermod -aG docker,sudo aliceAppend user to multiple groups without removing existing ones
-
cat /proc/<pid>/smaps | awk '/^Size/{sum+=$2} END{print sum/1024" MB"}'Total virtual memory size of a process from smaps
-
grep -E 'HugePages|AnonHugePages|Transparent' /proc/meminfoCheck if THP / hugepages are used and configured
-
echo never > /sys/kernel/mm/transparent_hugepage/enabledDisable THP at runtime (fix for Redis, MongoDB latency spikes)
-
numactl --hardwareNUMA nodes, CPU assignment, and memory distribution
-
sysctl -w net.core.somaxconn=65535 net.ipv4.tcp_max_syn_backlog=65535Increase socket listen backlog for high-connection services
-
sysctl -w net.core.default_qdisc=fq net.ipv4.tcp_congestion_control=bbrEnable Google BBR congestion control for better throughput
-
ss -ulnpAll UDP listening sockets with process info
-
taskset -cp 0,1 <pid>Pin a running process to specific CPU cores
-
watch -n1 'cat /proc/interrupts | head -30'Per-CPU interrupt counts, updated every second
-
cat /proc/<pid>/limitsHard and soft resource limits for a running process
-
ulimit -n 1048576 && echo '* soft nofile 1048576 * hard nofile 1048576' >> /etc/security/limits.confSet high FD limit for current session and persist it
-
df -iShow inode usage per filesystem (important for many small files)
-
find / -type f -size +100M 2>/dev/null | sortFind files larger than 100MB on the entire filesystem
-
cat /proc/$(pgrep myapp)/fd | wc -lCount open file descriptors for a running process
-
getenforceShow current SELinux enforcement mode
-
ls /etc/cron.* /var/spool/cron/crontabs/List all system and user cron job locations
-
printenv | sortDisplay all environment variables sorted alphabetically
-
iostat -xz 1Show extended disk I/O statistics updated every second
-
pstree -pDisplay process hierarchy with PIDs
-
sysctl -w net.core.somaxconn=65535Increase the maximum connection backlog for sockets
-
lscpuDisplay CPU architecture and core count information
no commands match — try a different search