Platform guide · Linux
Linux commands cheat sheet
Practical Linux commands for files, processes, storage, networking, services, logs, security, and remote administration — with every option explained.60explained commands6practical sections100%concrete examples
10
System and identity
Orient yourself on an unfamiliar host and capture the essential system facts.
Show the current user and group identitiesidRead-only
Show system uptime and load averagesuptimeRead-only
Print kernel, architecture, and system informationuname -aRead-only
List environment variables alphabeticallyenv | sortRead-only
Print the current time in ISO 8601 formatdate -IsecondsRead-only
Show recent system reboot historylast reboot | head -10Read-only
List active login sessionsloginctl list-sessionsRead-only
Inspect one login sessionloginctl show-session 2 -p Name,Remote,Type,Class,StateRead-only
List users known to logindloginctl list-usersRead-only
Show clock, timezone, and synchronization statetimedatectl statusRead-only
10
Files and text
Find, inspect, search, count, and archive files without losing context.
Find files modified in the last 24 hoursfind . -type f -mtime -1Read-only
Search recursively for text with line numbersrg -n <search-text> <path>Read-only
Search text with line numbers and surrounding contextrg -n -C <lines> --glob '<glob>' <pattern> <path>Read-only
Show a two-level directory treetree -L 2 <path>Read-only
Create a compressed tar archive from a foldertar -czf <archive-file> <folder>caution
Count files below the current directoryfind . -type f | wc -lRead-only
Find empty files below the current directoryfind . -type f -empty -printRead-only
Delete empty directories below the current directoryfind . -type d -empty -deletedanger
List files inside a ZIP archiveunzip -l <archive-file>Read-only
Pretty-print and colorize a JSON documentjq . <file>Read-only
10
Storage and filesystems
Check capacity, inode pressure, and the paths consuming the most space.
Show free disk space in human-readable unitsdf -hRead-only
Find the 20 largest files and folders heredu -ah . | sort -rh | head -20Read-only
Rank the largest directories one level below a pathdu -xhd 1 <path> 2>/dev/null | sort -hr | head -<count>Read-only
Show filesystem inode usagedf -iRead-only
Refresh a folder size every two secondswatch -n 2 du -sh <folder>Read-only
Sample per-process disk I/O and rank active writerspidstat -d <seconds> <count> | awk '$4 ~ /^[0-9]+$/ {print}' | sort -k6,6nr | head -<lines>Read-only
Sample extended device latency and utilization statisticsiostat -xz <seconds> <count>Read-only
Rank directories by the number of files they containfind <path> -xdev -type f -printf '%h\n' | sort | uniq -c | sort -nr | head -<count>Read-only
Find deleted files that still consume disk spacesudo lsof -nP +L1 | sort -k7 -nr | head -<count>caution
Verify fstab syntax, mount targets, and referenced devicessudo findmnt --verify --verbosecaution
10
Processes, services, and logs
Spot resource pressure, failed services, and high-signal system errors.
Show the ten processes using the most CPUps aux | sort -nrk 3,3 | head -10Read-only
Show the ten processes using the most memoryps aux | sort -nrk 4,4 | head -10Read-only
Show Linux memory and swap usagefree -hRead-only
List failed systemd servicessystemctl --failedRead-only
Show priority errors from the current bootjournalctl -p err -bRead-only
Show the latest kernel messagesdmesg | tail -30caution
Capture one non-interactive process snapshottop -b -n 1 | head -20Read-only
Find every log file below the current directoryfind . -type f -name '*.log' -printRead-only
Detect services and versions on selected TCP portsnmap -sV --version-light -p <ports> <host>caution
Rank processes by CPU with memory, age, and full commandps -eo pid,ppid,user,%cpu,%mem,rss,etime,stat,command --sort=-%cpu | head -<count>Read-only
10
Network and secure access
Inspect listeners, DNS, routes, TLS, and SSH before changing the host.
List listening Linux sockets with process detailsss -lntupRead-only
Resolve a hostname to its IP addressdig +short <domain>Read-only
Trace the network path to a hosttraceroute <host>Read-only
Show the default network routeip route show defaultRead-only
Inspect a remote TLS certificateopenssl s_client -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesRead-only
Show the effective OpenSSH client configuration for a hostssh -G <host> | sortRead-only
List listening TCP ports and their processeslsof -iTCP -sTCP:LISTEN -n -PRead-only
Fetch only the HTTP response headerscurl -I <url>Read-only
Print your current public IP addresscurl -s https://api.ipify.orgRead-only
Send four ICMP probes to a hostping -c 4 <host>Read-only
10
Transfer and recovery
Preview remote copies first, then move data with resumable tools.