Linux commands worth knowing by heart
Forty commands, twenty of them tagged “basics” — enough to get by on any machine.
Copy
cp -r for a whole directory; cp -a keeps the permissions and dates too.
Connect to a machine
ssh user@host, with -i to point at a key that is not the default one.
Move or rename
mv does both: renaming is moving to a different name.
Follow a log live
tail -f file.log prints the lines as they arrive.
Delete
rm -r for a directory. There is no trash here: what goes does not come back.
List a directory
ls -lh for readable sizes, ls -la to see the hidden files as well.
Drive a service
systemctl status, start, restart. The status also says why it failed.
Print a file
cat for the short ones. Past twenty lines, less does a far better job.
Read a big file
less keeps you in charge of the scrolling, and slash searches inside it.
Search inside files
grep -rn pattern . gives the file and the line, which plain grep does not.
Find a file
find . -name access.log -mtime -7: by name, and touched in the last seven days.
Read the manual
man command, and above all slash pattern to jump to the option you came for.
Run something as root
sudo for one command, sudo -i for a whole shell when there are ten to get through.
Change directory
cd with no argument goes home, cd - goes back to where you just were.
See the processes
ps aux for a snapshot, then a pipe into grep to pick out your own.
Stop a process
kill asks politely, kill -9 does not ask at all. Try the polite one first.
Know where you are
pwd prints the absolute path, and heads off half the mistakes waiting to happen.
Create a directory
mkdir -p a/b/c builds the whole chain at once, and says nothing if it exists.
Find a command you ran before
history | grep pattern, or Ctrl+R, which searches as you type.
Change permissions
chmod 644 for a file, 755 for a directory or an executable.
Measure free space
df -h, filesystem by filesystem. First command to run when a write fails.
Find what is filling the disk
du -sh * in a directory, then walk down into the biggest one. Step by step.
Archive
tar -czf archive.tar.gz directory to build one, -xzf to unpack it.
See the first or last lines
head -n 20 and tail -n 50. On an unknown file, head shows its shape at once.
Replace inside a file
sed -i s/old/new/g file. Without -i, the result only reaches the screen.
Read the system logs
journalctl -u service -f follows one service rather than the whole machine.
Watch things live
htop sorts by CPU or memory, and kills a process without you leaving it.
Copy to another machine
rsync -av source/ server:/target/ resumes where it stopped, which scp cannot.
Call a URL
curl -i shows the response headers, which settles half of the guesswork.
See what is listening on a port
ss -ltnp lists the listening ports with the process behind each one.
Find out who holds a file
lsof file names the process that is stopping you unmounting or deleting it.
Schedule a job
crontab -e to edit, -l to read back. Five fields: minute, hour, day, month, weekday.
Create a symbolic link
ln -s target link. The target is worth giving as an absolute path.
Compare two files
diff -u old new gives the format every other tool knows how to read.
Pull out a column
awk with {print $2} takes the second field, however wide the spacing is.
Act on every result
find … | xargs -n1 command runs the command once per result.
Sort and deduplicate
sort | uniq -c counts the occurrences; uniq only ever works on sorted input.
Check an address
ip a replaces ifconfig; ip r shows which way the packets leave.
Test a machine
ping says whether it answers, not whether the service runs — two questions.
Repeat a command
watch -n 2 command reruns it every two seconds, in the same spot on screen.