linux
133 commands
133 shown
Find large files
Find files larger than 100MB sorted by size
find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null | sort -k5 -rh | head -20
Disk usage per directory
Top 15 largest directories at root level
du -sh /* 2>/dev/null | sort -rh | head -15
Check open ports
TCP listening ports with PID and process name (modern netstat)
ss -tlnp
Find process by port
Which process is listening on a specific port
ss -tlnp | grep :<port>
CPU usage per process
Top 15 processes by CPU consumption
ps aux --sort=-%cpu | head -15
Memory usage per process
Top 15 processes by memory consumption
ps aux --sort=-%mem | head -15
Follow systemd service logs
Stream logs for a systemd unit from the last 10 minutes
journalctl -u <service> -f --since '10 minutes ago'
Check systemd service status
Service status, recent log lines, and active timers
systemctl status <service> --no-pager -l
Capture traffic on interface
Capture specific traffic to a pcap file
tcpdump -i eth0 -nn host <ip> and port 80 -w /tmp/capture.pcap
Check inode usage
Show inode usage per filesystem; can cause 'no space' without disk full
df -i | sort -k5 -rn
List open files by process
Show all files, sockets, and connections opened by a process
lsof -p <pid>
Watch command output
Re-run a command every 2 seconds with diff highlighting
watch -n 2 'kubectl get pods -n <ns>'
Run command in background
Run a script immune to SIGHUP; redirect output to file
nohup ./script.sh > /tmp/out.log 2>&1 &
Create SSH tunnel
Forward local port 8080 to an internal host via bastion
ssh -L 8080:internal-service:80 user@bastion -N -f
Extract tar.gz
Extract a gzipped tar archive to a specific directory
tar -xzf archive.tar.gz -C /target/dir/
Generate random password
Cryptographically secure random 32-byte password
openssl rand -base64 32
Check certificate details
Show cert expiry and subject for a live TLS endpoint
openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -dates -subject
Awk — sum a column
Sum the 3rd column of a space-delimited text file
awk '{sum += $3} END {print sum}' file.txt
Sed — replace in file
In-place global string replacement
sed -i 's/old-string/new-string/g' file.txt
Sort and deduplicate
Count and rank duplicate lines in a file
sort file.txt | uniq -c | sort -rn | head -20
List block devices
Tree of disks, partitions, loop devices with filesystem info
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,UUID
Show block device UUIDs
Print UUID, LABEL, and FSTYPE for all block devices
blkid
Mount a partition
Mount ext4 partition to /mnt/data
mount -t ext4 /dev/sdb1 /mnt/data
Show all mounts
List all real (non-virtual) mounted filesystems in a tree
findmnt --real
Remount filesystem read-write
Remount the root filesystem as read-write (e.g. after rescue boot)
mount -o remount,rw /
Check filesystem integrity
Dry-run fsck check (no changes); unmount first for a live fix
fsck -n /dev/sdb1
Create ext4 filesystem
Format partition as ext4 with a label
mkfs.ext4 -L datalabel /dev/sdb1
Resize ext4 filesystem
Grow ext4 to fill the partition (after partition resize)
resize2fs /dev/sdb1
Show filesystem info
Show ext2/3/4 metadata: block size, mount count, last mount time
tune2fs -l /dev/sda1 | grep -E 'Block (count|size)|Mount count|Last mount'
Disk usage with depth
Disk usage of /var up to 2 directory levels deep
du -h --max-depth=2 /var | sort -rh | head -20
Free disk space summary
Show free space only for real filesystems (skip tmpfs/overlay)
df -hT --type=ext4 --type=xfs --type=btrfs
Interactive partition editor
Interactive MBR/GPT partition table editor
fdisk /dev/sdb
Partition with parted (GPT)
Create a single GPT partition using the full disk
parted /dev/sdb -- mklabel gpt mkpart primary ext4 1MiB 100%
Show LVM physical volumes
List LVM physical volumes with space usage
pvs && pvdisplay
Show LVM volume groups
List LVM volume groups with free PE
vgs && vgdisplay
Show LVM logical volumes
List logical volumes with device paths
lvs -o +devices
Extend LV and resize FS
Extend LVM logical volume by 10G and grow ext4 filesystem online
lvextend -L +10G /dev/vg0/lv_data && resize2fs /dev/vg0/lv_data
Create swap file
Allocate 2G swap file, set permissions, format and enable
fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile
Show swap usage
List active swap spaces and overall memory/swap stats
swapon --show && free -h
Show all IP addresses
Brief list of all interfaces with IPs
ip -br a
Show routing table
All routing rules including policy routes
ip route show table all
Add static route
Add a persistent-until-reboot static route
ip route add 10.0.0.0/8 via 192.168.1.1 dev eth0
Show ARP/NDP table
Neighbour (ARP/NDP) cache with reachability state
ip neigh show
Show network interface stats
TX/RX bytes, errors, drops for an interface
ip -s link show eth0
DNS lookup
Query A records via a specific DNS server
dig +short A example.com @8.8.8.8
Reverse DNS lookup
PTR record for an IP address
dig +short -x 8.8.8.8
Trace DNS delegation
Follow full DNS resolution chain from root nameservers
dig +trace example.com
Show established TCP connections
All established TCP connections with process info
ss -tnp state established
Count connections per state
How many connections are in ESTABLISHED, TIME_WAIT, etc.
ss -tan | awk 'NR>1{print $1}' | sort | uniq -c | sort -rn
Traceroute with MTU discovery
Combine traceroute and ping; TCP mode to bypass ICMP blocks
mtr --report --tcp --port 443 example.com
Test MTU path
Send DF-bit ping of 1500-byte frames to detect MTU issues
ping -M do -s 1472 -c 3 8.8.8.8
Show iptables rules
All filter table rules with packet counters and line numbers
iptables -L -n -v --line-numbers
Show nftables ruleset
Full nftables ruleset in human-readable form
nft list ruleset
Check network bandwidth
Measure TCP throughput with 4 parallel streams for 10 seconds
iperf3 -c <server_ip> -t 10 -P 4
Monitor network traffic live
Real-time bandwidth per connection on an interface
iftop -i eth0 -n
Show kernel version
Kernel release string and full system info
uname -r && uname -a
Kernel ring buffer
Last 50 kernel errors/warnings with human-readable timestamps
dmesg -T --level=err,warn | tail -50
List loaded kernel modules
All currently loaded kernel modules
lsmod | sort
Load a kernel module
Load a module with dependencies and verify
modprobe <module> && lsmod | grep <module>
Show module info
Module parameters, version, license, and dependencies
modinfo <module>
Read/write kernel parameters
List all kernel parameters; filter by name
sysctl -a | grep vm.swappiness
Apply sysctl parameter
Enable IP forwarding at runtime (also add to /etc/sysctl.d/)
sysctl -w net.ipv4.ip_forward=1
Show kernel boot parameters
Parameters passed to the kernel at boot time
cat /proc/cmdline
Count open file descriptors system-wide
Allocated FDs, free FDs, and system-wide max (file-max)
cat /proc/sys/fs/file-nr
IO wait and throughput
Extended disk IO stats every 2s, 5 iterations; look for %iowait, await
iostat -xz 2 5
Virtual memory stats
System-wide CPU, memory, swap, IO stats per second
vmstat 1 5
Watch IO per process
Accumulated disk read/write per process (requires root)
iotop -ao
System activity report
CPU, memory, and disk stats via sysstat (5 samples, 1s interval)
sar -u -r -d 1 5
Trace system calls of a process
Trace network and file syscalls of a running process
strace -f -e trace=network,file -p <pid>
CPU performance counters
Hardware CPU counters during a 5-second window
perf stat -e cycles,instructions,cache-misses -- sleep 5
Show CPU info
CPU model, socket/core/thread topology, and clock speed
lscpu | grep -E 'Model|Socket|Core|Thread|MHz'
Show memory slots (DIMM)
Physical DIMM slots: size, speed, type (requires root)
dmidecode -t memory | grep -E 'Size|Speed|Locator|Type:'
List PCI devices
Network cards, GPUs, NVMe controllers with driver info
lspci -v | grep -A5 'VGA\|Ethernet\|NVMe'
Set immutable file attribute
Prevent any user (incl. root) from modifying the file
chattr +i /etc/resolv.conf && lsattr /etc/resolv.conf
Show extended file attributes
List non-default extended attrs in /etc/
lsattr -R /etc/ 2>/dev/null | grep -v '^\-\-\-\-'
ACL: show permissions
Show POSIX ACL entries including owner, group, and extra users
getfacl /srv/shared
ACL: grant user access
Grant alice full access without changing group ownership
setfacl -m u:alice:rwx /srv/shared
Find SUID/SGID binaries
Locate setuid/setgid executables (security audit)
find / -perm /6000 -type f -ls 2>/dev/null
Find process by name
List PIDs and full command lines matching a name
pgrep -la nginx
Kill process tree
Send SIGTERM to the entire process group
kill -TERM -$(pgrep -f 'my-app')
Change process priority
Lower priority (nice +10) of a running process
renice -n 10 -p <pid>
Limit process resources (cgroup)
Run a command in a transient systemd scope with resource limits
systemd-run --scope -p MemoryMax=512M -p CPUQuota=50% -- ./heavy.sh
Query journald with time range
Logs for nginx between two timestamps
journalctl --since '2024-01-15 10:00' --until '2024-01-15 10:30' -u nginx
Export journald to JSON
Structured log export for ingestion into log aggregators
journalctl -u <service> -o json | jq '{ts: .REALTIME_TIMESTAMP, msg: .MESSAGE}'
Show NTP sync status
Clock sync state, offset, and NTP source details
timedatectl status && chronyc tracking
Check systemd timers
All timers with last/next trigger times
systemctl list-timers --all --no-pager
Copy SSH public key
Append public key to remote authorized_keys
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host
Rsync with progress
Mirror directory to remote with deletion of extra files
rsync -avz --progress --delete src/ user@host:/dest/
Securely wipe a disk
One-pass overwrite with zeros + verify (use hdparm ATA for NVMe)
shred -vzn 1 /dev/sdb
Check SMART disk health
SMART overall health and key failure indicators
smartctl -a /dev/sda | grep -E 'SMART overall|Reallocated|Pending|Uncorrectable'
Benchmark sequential disk IO
Write 1GB with forced sync to measure raw write speed
dd if=/dev/zero of=/tmp/testfile bs=1M count=1024 conv=fdatasync
Show running containers namespaces
List Linux namespaces for network, PID, and mount isolation
lsns -t net,pid,mnt
Inspect cgroup hierarchy
Tree view of systemd cgroup hierarchy and resource assignments
systemd-cgls
Count lines in all logs
Find the biggest log files by line count
find /var/log -name '*.log' -exec wc -l {} + | sort -rn | head -20
Follow multiple log files
Stream multiple log files interleaved in one terminal
tail -f /var/log/syslog /var/log/auth.log
Search compressed logs
grep inside .gz files without manual decompression
zgrep -i 'error' /var/log/syslog.*.gz
Rotate logs manually
Force log rotation regardless of schedule
logrotate -f /etc/logrotate.conf
List cron jobs system-wide
Print active cron lines for every user
for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u $u 2>/dev/null | grep -v '^#' | sed "s|^|$u: |"; done
Cron expression tester
Parse and show next 5 trigger times for a cron expression
systemd-analyze calendar '*/5 * * * *'
Redirect stderr to file
Split stdout and stderr into separate files
command > /tmp/out.log 2> /tmp/err.log
Capture both streams
Redirect stdout+stderr to file and screen simultaneously
command 2>&1 | tee /tmp/all.log
Replace string in files recursively
Find files containing text, then replace in-place
grep -rl 'old_string' /etc/ | xargs sed -i 's/old_string/new_string/g'
Print specific columns with awk
Print 1st and 3rd fields of a space-delimited file
awk '{print $1, $3}' /etc/passwd
Sum a column with awk
Sum values in column 2 of a text file
awk '{sum += $2} END {print sum}' file.txt
Delete lines matching pattern
Remove all comment lines starting with #
sed -i '/^#/d' config.conf
Multi-line sed replacement
Print block of text between START and END markers
sed -n '/START/,/END/p' file.txt
Unique sorted values
Count occurrences of each unique line
sort file.txt | uniq -c | sort -rn
Show users logged in
Active user sessions and what they are running
who -H && w
Last logins
Last 20 login records with IP and duration
last -n 20 | head -25
Failed login attempts
Top source IPs of failed SSH logins in last 24h
journalctl -u ssh --since '24h ago' | grep 'Failed password' | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -10
Check sudo access
List sudo rules for a specific user
sudo -l -U <username>
Add user to group
Append user to multiple groups without removing existing ones
usermod -aG docker,sudo alice
Show /proc memory maps
Total virtual memory size of a process from smaps
cat /proc/<pid>/smaps | awk '/^Size/{sum+=$2} END{print sum/1024" MB"}'
Anonymous huge pages status
Check if THP / hugepages are used and configured
grep -E 'HugePages|AnonHugePages|Transparent' /proc/meminfo
Disable Transparent Huge Pages
Disable THP at runtime (fix for Redis, MongoDB latency spikes)
echo never > /sys/kernel/mm/transparent_hugepage/enabled
Show NUMA topology
NUMA nodes, CPU assignment, and memory distribution
numactl --hardware
TCP tuning: increase backlog
Increase socket listen backlog for high-connection services
sysctl -w net.core.somaxconn=65535 net.ipv4.tcp_max_syn_backlog=65535
TCP tuning: enable BBR
Enable Google BBR congestion control for better throughput
sysctl -w net.core.default_qdisc=fq net.ipv4.tcp_congestion_control=bbr
Show open UDP sockets
All UDP listening sockets with process info
ss -ulnp
Bind process to CPU cores
Pin a running process to specific CPU cores
taskset -cp 0,1 <pid>
Show hardware interrupts
Per-CPU interrupt counts, updated every second
watch -n1 'cat /proc/interrupts | head -30'
Show process limits
Hard and soft resource limits for a running process
cat /proc/<pid>/limits
Increase system file descriptor limit
Set high FD limit for current session and persist it
ulimit -n 1048576 && echo '* soft nofile 1048576
* hard nofile 1048576' >> /etc/security/limits.conf
Show inode usage
Show inode usage per filesystem (important for many small files)
df -i
Find large files
Find files larger than 100MB on the entire filesystem
find / -type f -size +100M 2>/dev/null | sort
Show open file descriptors
Count open file descriptors for a running process
cat /proc/$(pgrep myapp)/fd | wc -l
Check SELinux status
Show current SELinux enforcement mode
getenforce
List cron jobs (system)
List all system and user cron job locations
ls /etc/cron.* /var/spool/cron/crontabs/
Show environment variables
Display all environment variables sorted alphabetically
printenv | sort
Watch disk I/O
Show extended disk I/O statistics updated every second
iostat -xz 1
Show process tree
Display process hierarchy with PIDs
pstree -p
TCP/IP tuning — backlog
Increase the maximum connection backlog for sockets
sysctl -w net.core.somaxconn=65535
Show CPU info
Display CPU architecture and core count information
lscpu
no commands match