Linux Command Cheat Sheet

pwd

# Show the current absolute path.

ls -lah

# List files and directories.

cd ~

# Change to your home directory.

cd -

# Jump back to the last directory.

tree -a -L 2

# Display a recursive tree of files and directories.

which python3

# Show which executable will run for a command.

whereis ssh

# Search standard binary and documentation paths.

type ls

# Reveal whether a name is an alias, builtin, function, or file.

find . -type f -name '*.log'

# Search recursively for files with a matching name.

locate nginx.conf

# Search a prebuilt file index for paths.

touch notes.txt

# Create an empty file if it does not exist.

mkdir -p app/logs/archive

# Create one or more directories, including parents.

cp -av src/ backup/src/

# Copy files or directories.

mv old-name.txt new-name.txt

# Move or rename a file or directory.

rm file.txt

# Delete a file.

rm -rf build/

# Delete a directory tree forcefully.

rmdir empty-dir

# Delete an empty directory.

ln -s /opt/app/current app-current

# Create a symlink that points to another path.

ln original.txt twin.txt

# Create an additional directory entry for the same inode.

stat /var/log/syslog

# Display inode, permissions, timestamps, and size.

file archive.tar.gz

# Identify file contents and encoding.

du -sh *

# Estimate file and directory sizes.

df -h

# Display mounted filesystems and free space.

basename /var/log/nginx/access.log .log

# Return the last path component.

dirname /var/log/nginx/access.log

# Return the parent directory of a path.

cat /etc/os-release

# Concatenate and print files to standard output.

less /var/log/syslog

# Open a file in a scrollable pager.

head -n 20 app.log

# Display the first lines of a file.

tail -n 50 app.log

# Display the end of a file.

tail -f /var/log/nginx/access.log

# Stream appended lines as they are written.

wc -l users.csv

# Count content in files or streams.

nl -ba config.yml

# Display file contents with line numbers.

cut -d: -f1 /etc/passwd

# Extract portions of each line.

paste names.txt emails.txt

# Combine files line-by-line.

column -t -s, data.csv

# Format delimited text into aligned columns.

sort -t, -k2,2n scores.csv

# Sort input lines lexicographically or numerically.

sort access.log | uniq -c | sort -nr

# Collapse repeated adjacent lines.

tr '[:lower:]' '[:upper:]' < input.txt

# Replace or delete characters from a stream.

make 2>&1 | tee build.log

# Send output to both a file and the terminal.

grep -n 'ERROR' app.log

# Print lines matching a pattern.

grep -RIn 'TODO' src/

# Search all matching files in a tree.

grep -v '^#' .env.example

# Exclude lines that match a pattern.

grep -E 'warn|error|fatal' app.log

# Use extended regular expressions with grep.

grep -F 'user[id]' app.log

# Match text literally instead of as a regex.

rg 'connection refused' .

# Recursively search text quickly while respecting ignore rules.

find /var/log -type f -mtime -1

# Search for files changed recently.

find / -type f -size +500M 2>/dev/null

# Locate large files with size filters.

find . -name '*.tmp' -print0 | xargs -0 rm -f

# Pass stdin items as arguments to another command.

history | grep docker

# Filter previous shell commands.

ls -l /var/www

# Show permissions and ownership on files.

chmod 640 secrets.env

# Set rwx permissions numerically.

chmod -R u=rwX,go=rX public/

# Apply a mode to a directory tree.

chown deploy:www-data app.log

# Set file owner and group.

chgrp www-data storage/

# Set the group of a file or directory.

umask 027

# Control default modes for new files and directories.

id

# Display numeric and named identity info.

whoami

# Show the effective user name.

getfacl shared/

# Inspect Access Control Lists on a file or directory.

setfacl -m u:alice:rwx shared/

# Grant or modify fine-grained access rules.

sudo systemctl restart nginx

# Execute a command with elevated privileges.

sudoedit /etc/ssh/sshd_config

# Open a file for editing through sudo.

sudo useradd -m -s /bin/bash deploy

# Create a new local user account.

sudo usermod -aG docker alice

# Append a user to an extra group.

sudo passwd deploy

# Set a local user password.

sudo groupadd appteam

# Add a new local group.

groups alice

# Show supplementary group membership.

su - postgres

# Become another user and load their shell profile.

who

# List active login sessions.

w

# Display users plus current processes and load.

last -a | head

# Display recent login records.

sudo pkill -u olddeploy

# Terminate processes owned by a specific user.

ps aux

# Show running processes in BSD format.

ps -ef --forest

# Display processes in a parent-child tree.

top

# Monitor processes, CPU, and memory interactively.

htop

# Use a richer interactive process monitor.

pgrep -af nginx

# Search for process IDs using a pattern.

kill -TERM 12345

# Request graceful process termination.

kill -KILL 12345

# Send SIGKILL to stop a process immediately.

pkill -f 'gunicorn: master'

# Signal processes matching a name or regex.

nice -n 10 tar -czf backup.tgz /srv/data

# Run a command at a different CPU scheduling priority.

sudo renice -n 5 -p 12345

# Adjust niceness of an existing process.

jobs -l

# Show background and stopped jobs for the current shell.

bg %1

# Continue a suspended job in the background.

fg %1

# Resume a background or stopped job in the foreground.

nohup ./long-task.sh > task.out 2>&1 &

# Run a command immune to hangups.

crontab -e

# Create or modify scheduled tasks.

crontab -l

# Show scheduled cron entries.

echo 'systemctl restart worker' | at 02:00

# Queue a command to run once later.

uname -a

# Print kernel and architecture details.

hostnamectl

# Inspect hostname, OS, and virtualization metadata.

cat /etc/os-release

# Print distribution metadata from os-release.

uptime

# Print system uptime and load averages.

free -h

# Display RAM and swap usage.

lscpu

# Display CPU architecture and core details.

lsblk -f

# Show disks, partitions, and mountpoints.

sudo blkid

# Display filesystem type and UUID labels.

mount | column -t

# List mounted filesystems or mount one manually.

sudo umount /mnt/data

# Detach a mounted filesystem.

dmesg -T | tail -n 50

# Inspect kernel messages and boot-time hardware logs.

lsusb

# Display connected USB hardware.

lspci -nn

# Display PCI and PCIe hardware.

ip address show

# Display interfaces and assigned addresses.

ip link show

# Display interface status and MAC information.

ip route show

# Display current IP routes.

ss -tulpn

# Show listening TCP and UDP ports with processes.

ping -c 4 8.8.8.8

# Send ICMP echo requests to a host.

traceroute example.com

# Display the route packets take to a host.

dig +short A example.com

# Look up DNS answers directly.

nslookup example.com

# Query DNS information interactively or directly.

host 8.8.8.8

# Resolve names or reverse-lookup addresses.

curl -I https://example.com

# Make HTTP requests and API calls.

wget https://example.com/file.tar.gz

# Retrieve files non-interactively.

ssh user@server.example.com

# Connect securely to another host.

scp app.tar.gz user@server:/tmp/

# Transfer files between hosts securely.

rsync -avz ./dist/ user@server:/var/www/app/

# Copy files efficiently with deltas and preservation.

nc -vz example.com 443

# Use netcat for port checks and simple listeners.

nmap -sV example.com

# Probe a host for open ports and services.

sudo tcpdump -i any port 443

# Inspect network traffic from the command line.

tar -cvf backup.tar app/

# Bundle files into a tar archive.

tar -czvf backup.tar.gz app/

# Archive and compress in one step.

tar -xzvf backup.tar.gz

# Unpack an archive into the current directory.

gzip large.log

# Compress a file and replace it with a `.gz` version.

gunzip large.log.gz

# Expand a `.gz` file back to its original contents.

zip -r release.zip dist/

# Archive and compress files in zip format.

unzip release.zip -d release/

# Unpack zip files.

xz -T0 dump.sql

# Compress a file using xz.

sha256sum release.tar.gz

# Compute file integrity digest.

md5sum file.iso

# Compute MD5 digest.

sed 's/localhost/db.internal/g' config.tpl

# Substitute matching text in a stream.

sed -i.bak 's/debug=false/debug=true/' app.conf

# Modify a file directly.

sed -n '100,140p' big.log

# Show a line range from a file.

awk '{print $1, $5}' access.log

# Extract columns from whitespace-delimited text.

awk '{sum += $3} END {print sum}' metrics.txt

# Aggregate numeric values from a column.

awk '$5 > 100 {print $0}' usage.txt

# Print rows that satisfy a condition.

jq '.' response.json

# Format JSON output for readability.

jq -r '.items[].metadata.name' pods.json

# Read a nested field from JSON.

yq '.services.web.image' docker-compose.yml

# Extract data from YAML.

comm -3 <(sort old.txt) <(sort new.txt)

# Show lines unique to each file or common to both.

join -1 1 -2 1 users.txt emails.txt

# Relational join for sorted text files.

split -l 100000 huge.csv chunk_

# Break a file into smaller pieces.

systemctl status nginx

# Display service state and recent log snippets.

sudo systemctl start nginx

# Start a service immediately.

sudo systemctl stop nginx

# Stop a running service.

sudo systemctl restart nginx

# Restart a service cleanly.

sudo systemctl reload nginx

# Ask a service to reload configuration without full restart.

sudo systemctl enable nginx

# Create boot-time activation links for a unit.

sudo systemctl disable nginx

# Remove boot-time activation for a unit.

systemctl list-units --type=service

# Show active units known to systemd.

journalctl -u nginx -n 100 --no-pager

# Show journal entries for a specific systemd unit.

journalctl -fu nginx

# Stream new journal entries live.

journalctl -b

# Query logs for the active boot session.

timedatectl

# Show or change system clock, timezone, and NTP status.

sudo hostnamectl set-hostname app-prod-01

# Change the system hostname.

sudo fdisk -l

# Show partitions on available disks.

sudo parted /dev/sda print

# Inspect partitions with GNU Parted.

sudo mkfs.ext4 /dev/sdb1

# Format a block device with ext4.

sudo fsck -f /dev/sdb1

# Check and repair a filesystem.

sudo mount /dev/sdb1 /mnt/data

# Attach a filesystem to a mountpoint.

sudo swapon /swapfile

# Activate swap space.

sudo swapoff /swapfile

# Turn off swap usage.

sudo pvs

# Show LVM physical volumes.

sudo vgs

# Show LVM volume groups.

sudo lvs

# Show LVM logical volumes.

sudo lvextend -L +20G /dev/vg0/data

# Increase logical volume size.

sudo resize2fs /dev/vg0/data

# Resize an ext2/3/4 filesystem after volume growth.

vmstat 1 5

# Display system activity, processes, memory, and IO over time.

iostat -xz 1 5

# Report CPU utilization and block-device performance.

sar -u 1 5

# Use sysstat historical metrics.

mpstat -P ALL 1 5

# Display CPU usage by processor.

pidstat 1 5

# Report CPU, memory, and IO by process.

lsof -i :8080

# Show files and sockets opened by processes.

strace -p 12345

# Inspect syscalls made by a process or command.

time rsync -av src/ backup/

# Report elapsed user and system time for a command.

watch -n 2 'df -h && echo && free -h'

# Refresh output at an interval.

timeout 30s curl -I https://example.com

# Stop a command after a maximum duration.