Linux Command Cheat Sheet

Use this constantly to confirm where you are before running destructive commands.

`-l` shows details, `-a` includes dotfiles, and `-h` formats sizes in human-readable units.

A fast way to reset back to your home directory.

Useful for toggling between two working directories.

Great for understanding project layout. Install `tree` first on minimal systems.

Helpful when multiple binaries or tool versions are installed.

Less precise than `which`, but useful for quick system lookups.

Important when shell aliases or functions change behavior.

Start broad, then add predicates like size, mtime, owner, or path filters.

Very fast, but results depend on the index being updated with `updatedb`.

Also updates the modification time of an existing file.

`-p` prevents errors if parent directories are missing.

`-a` preserves attributes and recursion, `-v` shows progress.

Also used to move files between directories.

Double-check with `ls` first when deleting important files.

Dangerous. Verify the path carefully before running.

Fails if the directory contains files.

Symlinks are useful for release switching, shared config, and path aliases.

Hard links only work on the same filesystem and usually not for directories.

Excellent for debugging permissions, timestamps, and file identity.

Useful when an extension is misleading or absent.

Useful for quickly finding which directories consume the most space.

Use this before large downloads, backups, or container/image pulls.

Helpful in shell scripting and loops.

Common in scripts that need to construct sibling paths.

Good for small files and quick checks.

Search inside `less` with `/pattern` and quit with `q`.

Useful for previewing large files quickly.

Often used on logs to inspect the latest events.

Classic log-following pattern while a service is running.

Great for line counts in logs, CSVs, or batch outputs.

Useful when discussing exact lines in reviews or incidents.

A staple for colon-, comma-, or tab-delimited data.

Useful for quick column composition without opening a spreadsheet.

Helpful for inspecting CSV-like data in the terminal.

Combine with `uniq`, `comm`, or `join` for powerful text workflows.

Remember to sort first if you want global duplicate counts.

Also useful for squeezing repeated delimiters with `-s`.

Great for preserving command output while still seeing it live.

`-n` adds line numbers. Add `-i` for case-insensitive searches.

A standard codebase search when ripgrep is unavailable.

Useful for stripping comments or blank lines when combined with other filters.

Equivalent to historical `egrep`; `grep -E` is preferred.

Use when the pattern contains regex metacharacters you want treated literally.

Popular for source-code and repo searches due to speed and sane defaults.

Helpful for cleanup jobs and recent-activity investigations.

Useful in disk pressure incidents.

Essential when combining `find` with bulk operations safely.

A good way to recover a command you ran last week but forgot to save.

The first step in diagnosing file access problems.

Numeric modes are concise and script-friendly.

Prefer symbolic recursive modes for directories so execute is only set where appropriate.

Common after copying files as root or changing deployment users.

Useful when a shared service account needs group access.

A stricter umask helps keep new files from being world-readable.

Quickly confirms which groups a process or login shell belongs to.

Handy in `sudo` sessions and provisioning scripts.

Useful when POSIX ACLs override or supplement traditional mode bits.

Helpful when one extra user needs access without changing ownership.

Keep privilege escalation narrow and targeted.

Safer than running the editor as root directly.

`-m` creates the home directory and `-s` sets the login shell.

Always include `-a` with `-G` to avoid overwriting existing supplementary groups.

Also used to lock and unlock passwords on many systems.

Useful for shared file access patterns.

Useful when access depends on group membership.

Classic for service accounts that own app data or databases.

Helpful on shared servers and bastion hosts.

A quick operations view of who is on the machine and what they are doing.

Useful for forensic review and access audits.

Use carefully on multi-user systems.

One of the most common process-inspection commands.

Helpful for understanding supervisors, workers, and spawned shells.

Built into most systems and good for quick diagnostics.

Friendlier than `top` if installed.

Great for scripts and quick service discovery.

Prefer TERM before KILL so apps can shut down cleanly.

Use only when a process ignores or cannot handle graceful signals.

Convenient when you do not want to look up PIDs manually.

Higher nice values are lower priority.

Useful when a process should yield more CPU to others.

Only applies to jobs started from the same shell session.

Useful after pressing Ctrl+Z on a long-running command.

Useful when you need to interact with the command again.

Useful on remote shells when a process should survive disconnects.

Classic recurring scheduler for scripts, backups, and maintenance tasks.

Useful before changing automation on a server.

Useful for maintenance actions that should run once at a known time.

Common first step to see what OS and kernel you are on.

On systemd systems this is richer than plain `hostname`.

Portable way to detect distro family in scripts or debugging.

Useful during incidents and after reboots.

Commonly used alongside `top`, `ps`, and `vmstat`.

Useful for capacity planning and debugging architecture issues.

Excellent for storage troubleshooting and identifying filesystems.

Often used when preparing `/etc/fstab` entries.

Useful to inspect what is currently mounted and with which options.

Always ensure no process is using the mount before unmounting.

Great for device, disk, driver, and OOM-related debugging.

Useful for debugging peripherals, storage, serial, and dev boards.

Useful for graphics, NIC, NVMe, and virtualization inspection.

Modern replacement for `ifconfig` on most Linux systems.

Use this to see whether interfaces are up, down, or renamed.

Essential when debugging egress paths and default gateways.

Modern replacement for `netstat -tulpn` on many systems.

Good first test for network reachability and latency.

Useful for diagnosing where connectivity breaks across hops.

Preferred over older tools for precise DNS debugging.

Still common, though `dig` is often more scriptable and explicit.

Quick and minimal DNS utility.

Great for headers, health checks, APIs, and downloads.

Useful for unattended downloads and mirroring.

A core Linux skill for administration and deployments.

Simple and widely available for secure file copy.

A deployment and backup staple thanks to speed and repeatability.

Excellent for quick TCP connectivity tests.

Use responsibly and only on systems you are authorized to scan.

Powerful for low-level debugging of connections, TLS, DNS, and service issues.

Classic archiving tool for backups and packaging.

Common format for source releases and backups.

Add `-C /target/path` to extract elsewhere.

Simple and widely supported compression format.

Equivalent to `gzip -d`.

Convenient when sharing with systems that expect zip.

Simple cross-platform archive extraction.

Excellent compression ratios, often used for large text dumps.

Useful for verifying downloads and release artifacts.

Mostly used for legacy checks; prefer SHA-256 for stronger integrity assurance.

Useful for one-off substitutions in streams or pipelines.

Create a backup suffix when editing important files.

Helpful for extracting a specific section without opening an editor.

Great for quick field extraction and lightweight reporting.

Useful for fast command-line summaries.

Useful when conditions go beyond what `grep` handles cleanly.

A must-have when APIs or tools emit raw JSON.

Excellent for combining API JSON with shell pipelines.

Useful for Kubernetes, Compose, CI, and config files.

Handy for diffing identifier lists and inventory files.

Useful when doing small-scale data joins in shell pipelines.

Helpful for batch imports or sharing giant files.

A first-stop diagnostic for any systemd-managed service.

Use after install or when recovering a stopped service.

Use before maintenance or configuration changes when needed.

Common after config changes or deployments.

Prefer reload when the service supports it and you want minimal disruption.

Ensures the service starts automatically after reboot.

Useful for deprecated or temporary services.

Useful for discovering services and their current states.

A standard service-specific log query on systemd systems.

Combines `-f` follow mode with unit filtering.

Use `-b -1` to inspect the previous boot.

Important when debugging clock drift, certificates, or scheduled tasks.

Preferred over editing files manually on systemd systems.

Classic disk inventory command.

Useful for modern disks and scripted partition management.

Formatting destroys existing data; verify the target device carefully.

Run on unmounted filesystems when possible.

Ensure the mountpoint exists first.

Useful when adding or restoring swap.

Ensure the system has enough RAM before disabling swap.

Start here when inspecting LVM-backed systems.

Useful for capacity and free-extent checks.

Useful for seeing LV names, sizes, and attributes.

Often followed by filesystem growth with `resize2fs` or `xfs_growfs`.

Common after extending an LV or block device.

A compact snapshot for system pressure and waiting behavior.

Useful for diagnosing disk saturation and queue depth.

Great when sysstat is installed and enabled for ongoing collection.

Useful when one core is pegged but system average looks fine.

Helps connect system pressure to specific workloads.

Excellent for determining what process owns a port or file.

Powerful for seeing what a stuck or failing process is trying to do.

Useful for baseline timing and quick performance comparison.

Great for observing changing state without rerunning commands manually.

Useful in scripts to avoid hanging forever.